Binance Hack: Who Pays When a Crypto Exchange Loses Investors’ Money?

Crypto Custody Gaps Put Exchange Liability Under Scrutiny

A major exchange hack exposes a difficult question for customers: who bears the loss when a platform controls the keys?

An account balance does not settle who owns the assets

Crypto held on an exchange may appear in a customer’s online account, but the platform can control the wallets and private keys used to move it. That creates a distinction between operational control and legal ownership. Customers may retain beneficial ownership, but the answer can depend on the user agreement, custody arrangements, whether assets are segregated and how the platform actually handles them.

This distinction matters if assets are stolen or the exchange becomes insolvent. If customer holdings can be identified as belonging to users, they may be treated differently from the platform’s own assets. If a customer instead has only a contractual claim for equivalent crypto or money, recovery may depend on the exchange’s ability to meet that obligation.

Compensation may turn on the exchange’s duty of care

A cyberattack does not automatically establish that an exchange must compensate every affected customer. Liability may arise if the platform failed to take reasonable care, breached its contract or failed in its duties as custodian. The legal question is whether the exchange’s conduct contributed to the loss, rather than simply whether a hack occurred.

The supplied legal analysis cites a 2025 Bombay High Court view that a platform does not carry absolute liability for every cyberattack, while still having a duty to exercise reasonable care. A force majeure clause might excuse a temporary interruption to services; that is not necessarily the same as excusing the disappearance of a customer’s underlying assets. Under Sections 37 and 73 of the Indian Contract Act, customers may seek compensation for a contractual breach, but must establish the breach, its link to the loss and the damages suffered. Binance’s voluntary guarantee to cover this loss is separate from its general legal obligations.

Indian compliance rules do not insure crypto balances

India lacks a specific framework governing exchanges’ financial soundness, custody of crypto assets and compensation when holdings are lost. The Prevention of Money Laundering Act brings activities including exchanging, transferring and providing custody for virtual digital assets within its scope. Covered exchanges must register with FIU-IND and meet relevant customer identification, record-keeping and reporting requirements.

Those rules support financial transparency and anti-money-laundering oversight; they do not guarantee customer assets or provide automatic reimbursement after a theft. Binance was fined ₹18.82 crore by FIU-IND in June 2024 for violating PMLA obligations, but that enforcement action does not itself create a compensation scheme for users. The gap between transaction monitoring and asset protection remains central to the policy debate.

Insolvency can make recovery slower and less certain

If an exchange fails, the ownership question becomes part of a broader insolvency process. The Insolvency and Bankruptcy Code excludes certain customer-owned assets, including assets held in trust, from a liquidation estate when ownership is established. But a contractual claim does not automatically give a customer priority, and inadequate assets may mean partial recovery or none. Offshore operations can add another complication because Indian insolvency law may not govern the exchange’s foreign entity.

An IBBI research paper published in October 2026 recommended recognising virtual digital assets as property under insolvency law and separating customer holdings from an exchange’s own assets. These are recommendations, not current statutory requirements. Legal routes exist, but a July 2, 2026 Delhi High Court judgment involving BitBNS customers illustrates that seeking release of funds or compensation does not ensure recovery, particularly where exchanges operate across borders.

Customers facing frozen withdrawals or suspected losses can preserve account statements, transaction records, wallet addresses, withdrawal requests and communications, then file a formal complaint with the exchange. Suspected cyber fraud can also be reported through the National Cyber Crime Reporting Portal or by calling 1930. Depending on the dispute, civil courts or consumer commissions may be options.

Key Highlights

• Exchange control of private keys does not by itself determine who legally owns customer crypto.
• Compensation may depend on proving a breach of duty or contract and linking it to the loss.
• PMLA compliance does not amount to insurance or a customer reimbursement guarantee.
• Under insolvency, ownership evidence and asset segregation can affect recovery prospects.
• Binance’s voluntary commitment to cover this loss should not be treated as a universal legal rule.

Investor Note: Before holding substantial crypto on an exchange, review its custody terms and keep independent records of balances and transactions. The legal outcome of a loss can depend on the facts, the contract and the jurisdiction, so exchange access should not be mistaken for guaranteed protection of capital.