How to store crypto safely: protect yourself from hacks like the one at Binance

Storing crypto safely has, since October 29, 2026, mainly meant one thing: knowing who holds the keys to your coins. That evening, according to the exchange, around $6.3 billion flowed out of Binance; Chainalysis counts $6.4 billion. It is the biggest crypto hack in history, and the trail leads to North Korea. Binance is covering its customers' losses. If you hold your coins yourself, you do not depend on such promises, but you bear the responsibility yourself. This is how to secure your cryptocurrencies: with a hardware wallet, a wallet scanner and the right settings on your exchange account.

Key points at a glance

• Binance hack: around $6.3 billion according to Binance, $6.4 billion according to Chainalysis, drained on the evening of October 29, 2026.
• Scale: more than three times what North Korea's hackers stole in the whole of 2025, namely $2.02 billion according to Chainalysis.
• Hardware wallet: from €59 (Ledger Nano S Plus, Trezor Safe 3) or $59.90 (Tangem with two cards), manufacturer prices as of October 16, 2026.
• Wallet scanner: MetaMask checks transactions and signatures with security alerts by default, Revoke.cash shows old approvals.
• Exchange account: two-factor protection via an app or security key instead of SMS, plus a withdrawal whitelist.
• Tactics: North Korea's hackers gain access through fake job offers and recruitment tests, according to Chainalysis in its report of December 18, 2025.

How to store crypto safely: what the Binance hack means for you

The key lesson from the Binance hack is that a balance on an exchange is a claim against the exchange, not a coin in your own hands. As long as the exchange can and will pay, you notice nothing. Binance has promised to cover all losses from its own funds and its SAFU emergency fund.

Binance describes how it happened in an announcement of October 30. The entry point was probably the compromised laptop of a DevOps engineer, through which the attackers reached a service container and withdrawals. Binance sees no leak of private wallet keys, and around $3 billion has been frozen on the blockchain. TRM Labs and Chainalysis attribute the attack to the North Korean group TraderTraitor; the full background is in our overview of whether North Korea is behind the Binance hack.

What counts for you as an investor is the scale. According to the Chainalysis annual report, North Korea's hackers stole at least $2.02 billion in the whole of 2025, more than ever before. The Binance hack alone is more than three times as large. Binance can absorb such a loss: according to DefiLlama, the exchange's known wallets held almost $145 billion before the hack, not counting its own tokens such as BNB. At FTX, the outflow on the day of its insolvency in November 2022 ended differently, and customers there waited years for their money. We collect all cases in our crypto hacks and security section.

What you can do with your Binance account after the hack is covered in our article Binance puts the hack at $6.3 billion, and whether the exchange could fail because of it in How much would it take to bankrupt Binance? The following steps apply to every exchange and every wallet.

Exchange, software wallet or hardware wallet: where your crypto is safest

Crypto is safest on a hardware wallet whose recovery phrase only you know. For money you trade with, a regulated exchange is the more convenient place. A software wallet on your phone or computer sits in between: you hold the keys yourself, but on a device that is constantly online.

A proven split: what you actively trade sits on an exchange licensed under the EU's MiCA regulation; we compare providers under regulated crypto exchanges. What you hold for the long term moves to a hardware wallet. That way, an exchange hack hits at most the smaller part.

Hardware wallet: the safest way to store crypto

A hardware wallet generates the private key on the device and never releases it. You confirm every transfer there, not on your computer. A laptop infected with malware, the entry point in the Binance hack, is then not enough to move your coins. Even the best hardware wallet has one limit, though: it protects the key, not every signature. Whatever you confirm on the device is valid, which is why a wallet scanner belongs alongside it.

Tangem is a card the size of a bank card, with no battery and no cable. To confirm, you hold it against your smartphone, and the key sits in a secure element rated EAL6+. By default, Tangem works without a seed phrase; the backup is the second and third card in the set. For anyone withdrawing coins from an exchange for the first time, it is the simplest route. Our link to the Tangem shop carries the code CRYPTOTICKER (affiliate link). Cost, security and everyday use are covered in our review Tangem Wallet: cost and security.

Ledger and Trezor work with a display and cable. You see the recipient address and amount on the device before you confirm, and you secure the wallet with a recovery phrase of 12 or 24 words. Trezor makes its firmware open source.

Buy a hardware wallet directly from the manufacturer and never second-hand. In October 2026, Ledger confirmed an implant in tampered devices that read the recovery phrase during setup and sent it to attackers via mobile network; MediaMarkt and Saturn then pulled Ledger from sale. The background is in our report on the Ledger hack. Never use a phrase that comes enclosed or pre-filled. We compare all models with prices and features in our hardware wallet comparison.

Wallet scanner: how to check transactions before you sign

A wallet scanner checks a transaction or signature before you confirm it and warns you about known fraud patterns, much like a virus scanner. Many retail investors lose their coins not through a cracked key but through a single signature on a fake website. That is exactly where the scanner comes in.

MetaMask Security Alerts

MetaMask has such a scanner built in. According to the MetaMask help pages, security alerts are switched on by default in the browser extension and the app. They check transactions and signature requests using data from Blockaid and other providers, and have two levels: a warning when there is a possible risk and a prominent alert when a request is classified as malicious. The warning blocks nothing, and you could still confirm. In that case, cancel. More on the wallet is in our MetaMask review.

Revoke.cash: find and revoke old approvals

Every approval you have ever granted to an app remains in place until you revoke it. Revoke.cash shows all open token approvals for an address across many blockchains. Your address is enough to view them; to revoke, you connect your wallet and pay only the network fee. How to do this step by step is explained in Revoking token approvals on Ethereum, and how to recognise a dangerous signature in our guide to wallet drainers. You can find an overview of all software wallets in our software wallet comparison.

Storing crypto safely on an exchange: the settings that protect your account

If part of your coins sits on an exchange, five settings decide whether an attacker can do anything with your password alone.

• Two-factor protection via app or security key: an authenticator app, passkey or hardware key instead of SMS. SMS codes can be intercepted through SIM swapping, as described in our guide to SIM swapping protection.
• Withdrawal whitelist: withdrawals only go to addresses you have saved in advance. At many exchanges, a new address comes with a waiting period during which you can spot an attack.
• Anti-phishing code: a word of your choice that appears in every genuine email from the exchange. If it is missing, the email did not come from the exchange.
• Dedicated email address: an address used only for exchange accounts that you give out nowhere else.
• Licensed exchange: providers with a MiCA licence must hold client funds separately from their own assets and are under supervision.

How Binance performs on security, fees and licences is set out in our Binance review.

How to store your seed phrase safely: the backup decides

Whoever knows a wallet's recovery phrase owns the coins. The rule is therefore: never photograph it, never store it in a cloud or notes app, never type it into a website. Write it on paper or, better, on a steel plate, keep it in a place that fire and water cannot reach, and store a second copy somewhere else. No wallet or exchange support team will ever ask for your phrase.

How long paper lasts, what a passphrase adds as a 25th word and when multisig is worthwhile are covered in our guide How to store your seed phrase safely. If you would rather not manage a word list at all, use a card wallet such as Tangem with backup cards.

How North Korea's hackers operate and how to recognise their tactics

North Korea's hackers mainly target people, not technology. According to Chainalysis, they place IT workers as employees in crypto firms and increasingly pose as recruiters for well-known Web3 and AI companies. At the end of a supposed recruitment process comes a "technical test" that harvests credentials and access to the candidate's current employer. Executives receive approaches from supposed investors or buyers asking about systems and access.

For retail investors this means: do not install software sent to you by a recruiter, an investor or a contact from Telegram or LinkedIn, and do not open a coding task on the computer that runs your wallet. A dedicated computer, or at least a separate user account just for crypto, lowers the risk considerably. How one such campaign emptied thousands of wallets is described in our report on North Korean hackers and job offers.

Checklist: how to store crypto safely in seven steps

1. Split your holdings: trading money on an exchange with a MiCA licence, the rest on a hardware wallet.
2. Buy correctly: hardware wallet directly from the manufacturer, check the packaging, generate the phrase yourself.
3. Offline backup: recovery phrase on paper or steel, two locations, never digital.
4. Harden your exchange account: two-factor protection via app or security key, withdrawal whitelist, anti-phishing code.
5. Leave the scanner on: keep MetaMask Security Alerts switched on and take every warning seriously.
6. Clean up approvals: check with Revoke.cash once a month and revoke anything unnecessary.
7. Act fast in an emergency: move any remaining balance immediately to a new wallet with a new phrase, revoke approvals, and inform the exchange and the police.

The Binance hack shows how much money can vanish in a single evening. Binance can cover the loss. With a hardware wallet and these seven steps, you do not have to rely on that in the first place.