Updated Rules checked 2026-10-22
Is Binance safe? No exchange can guarantee that nothing will ever go wrong, but you can check the record. In Binance’s official announcements, the platform’s wallets were breached only once, on 2019-05-07: 7,000 BTC was taken from a hot wallet, and the Secure Asset Fund for Users (SAFU) covered the full amount. The latest proof of reserves is the 2026-10-01 snapshot, with reserve ratios of 100.35% for BTC, 100.0001% for ETH and 103.88% for USDT.
On regulation, Binance’s licenses page states that the global platform, Binance.com, is regulated by the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM) through three Nest companies. Counting ADGM, the page lists registrations or licenses in 15 jurisdictions, including Kazakhstan, Bahrain, Dubai and Japan. Whether an app is genuine depends on where you download it. The only official channels are the download page on binance.com, the App Store (developer Binance Switzerland AG) and Google Play (developer Binance Inc., package com.binance.dev). Never install an APK that someone sends you in a private message.
Below, the hack record, reserves, licenses, app checks, account settings and restricted regions are covered one by one, each with its official source. This information can only help you judge the risk; whether to use Binance, and how much to keep there, is still your decision.
Key points:
1. Binance’s official announcements record only one theft from platform wallets, on 2019-05-07: 7,000 BTC, about 2% of its total BTC holdings at the time, fully covered by SAFU. Deposits and withdrawals were suspended, which Binance estimated at the time would last about a week.
2. 2026-10-01 proof of reserves: BTC reserve ratio 100.35% (a surplus of about 2,430.91 BTC), ETH 100.0001% (a surplus of only about 3.32 ETH), USDT 103.88%. Verification uses a Merkle tree plus zk-SNARKs; no third-party accounting firm is listed.
3. SAFU is held by Nest Clearing and Custody Limited, which is regulated in ADGM. Binance says it was worth about USD 1 billion as of February 2026. When I checked the officially published SAFU bitcoin address on 2026-10-22, its on-chain balance was 15,000.00147092 BTC.
4. Get the official app only from the binance.com download page, the App Store or Google Play; the Android installer offered on the website is hosted on download.binance.com. Binance explains that fake apps may copy the same name and icon, and may also swap your deposit address.
5. Binance’s prohibited countries list, version 2026-01-05, names the United States, Canada and the Netherlands, plus Cuba, North Korea, Iran, Crimea, Donetsk and Luhansk. The Terms of Use forbid using a VPN to get around the restrictions.
The information below was checked against official pages on 2026-10-22 (data check date) and is shared for reference.
Has Binance been hacked? How did it respond?
Three incidents come up often, and only the 2019 one was a theft from the Binance exchange’s own wallets:
| Date | Incident | Loss | Official response | Source |
|---|---|---|---|---|
| 2018-03-07 | Hackers used accounts obtained through phishing to create API keys, pumped the price on the VIA/BTC market, and tried to move BTC to 31 accounts prepared in advance | Binance said no funds were stolen | Risk controls automatically suspended all withdrawals and the VIA deposited by the hackers was frozen; withdrawals resumed after checks | Binance announcement, 2018-03-08 |
| 2019-05-07 | Hackers obtained a large number of user API keys and 2FA codes and withdrew from the BTC hot wallet in a single transaction | 7,000 BTC (the hot wallet held about 2% of total BTC holdings) | Covered in full by SAFU, and Binance stated that user funds were not affected; deposits and withdrawals were suspended, with the security review estimated at about a week | Binance announcement, 2019-05-07 |
| 2022-10-06 | BSC Token Hub, BNB Chain’s cross-chain bridge, was attacked; this was not a Binance exchange wallet | 2,000,000 BNB minted and taken (about USD 570 million), of which about USD 100 million was not recovered | BSC validators upgraded the chain so most of the funds stayed stuck at the attacker’s address; BNB Chain stated the loss was on BNB Chain and users were not affected | BNB Chain statement, 2022-10-11 |
Source and date: the official announcement in each row, viewed 2026-10-22. I could not find a separate announcement in the Binance Support Center giving the date withdrawals resumed in 2019, so only the estimate Binance gave at the time is shown. From 2019 to 2026-10-22, I found no other theft from platform wallets in Binance’s official announcements, which matches this site’s exchange security record.
The 2018 and 2019 attacks have one thing in common: the hackers first used phishing to get users’ account details, API keys or verification codes, then picked their moment. Security is not only about the exchange’s wallets. Login details and codes that users hand over to fake websites and fake apps can be used against them just the same.
How much is in SAFU now, and what does it cover?
According to the Binance SAFU FAQ (updated 2026-02-09), SAFU is held and managed by Nest Clearing and Custody Limited, a recognized clearing house regulated by the ADGM Financial Services Regulatory Authority. As of February 2026, SAFU held crypto assets worth about USD 1 billion. If a drop in the BTC price pushes its value below USD 800 million, Binance will rebalance it back to USD 1 billion. The officially published BTC address is 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD. When I checked it on a blockchain explorer on 2026-10-22, the balance was 15,000.00147092 BTC.
Dividing 15,000 BTC by the 688,572.68 BTC of user assets in the 2026-10-01 PoR gives about 2.18%. SAFU has to cover every coin, so this ratio only helps you picture the scale; it is not a payout cap. Read the coverage carefully too. The FAQ refers to losses caused by “a leak of account login credentials resulting from vulnerabilities or flaws in Binance’s systems or security protocols.” Claims must be filed through customer support within 90 days of the loss, and Binance alone decides which cases qualify. For losses caused by installing a fake app yourself, Binance’s security article on fake apps states that Binance is not responsible.
Does Binance’s US guilty plea affect user assets?
This was a compliance case, not a theft of user assets. According to the US Department of Justice press release of 2023-11-21, Binance Holdings Limited admitted to violating the Bank Secrecy Act, operating an unlicensed money transmitting business and violating the International Emergency Economic Powers Act. It agreed to forfeit USD 2,510,650,588 and pay a criminal fine of USD 1,805,475,575, a total of USD 4,316,126,163, and to accept an independent compliance monitor for three years. Founder Changpeng Zhao pleaded guilty and stepped down as CEO. Regulatory records in other countries are covered in the exchange security record and the Binance review.
How to read Binance’s proof of reserves (PoR)
Binance takes a snapshot of user assets at 00:00 (UTC) on the 1st of each month and publishes the results by the 7th, using a Merkle tree plus zk-SNARKs so users can verify it themselves (Binance guide to verifying account balances, updated 2026-08-05). The latest snapshot I found on 2026-10-22 was 2026-10-01; under the rules, the next one should be published by 2026-11-07.
| Coin | User assets | Held by Binance | Reserve ratio | Surplus | Of which third-party custody |
|---|---|---|---|---|---|
| BTC | 688,572.68 | 691,003.59 | 100.35% | about 2,430.91 | 11,453.47 (1.66%) |
| ETH | 3,799,136.43 | 3,799,139.75 | 100.0001% | about 3.32 | 122,664.53 (3.23%) |
| USDT | about 32.028 billion | about 33.271 billion | 103.88% | about 1.243 billion | about 275 million (0.83%) |
| USDC | about 7.178 billion | about 7.771 billion | 108.26% | about 593 million | about 54 million (0.70%) |
| BNB | 43,039,944.91 | 43,242,324.47 | 100.47% | about 202,379.56 | 513,314.55 (1.19%) |
Source: the data interface of the Binance PoR page (snapshot ID PR01OCT26, 55 coins in total), read 2026-10-22. I calculated the “Surplus” column and the third-party custody share from the official figures, using Binance’s holdings as the denominator for the custody share. The audit field in the same data says zk-SNARKs and lists no accounting firm.
Two things stand out in this table. First, a reserve ratio above 100% can be above it by very little: ETH is at 100.0001%, a surplus of only 3.32 ETH. Second, the third-party custody portion cannot be checked on-chain yourself, and it covers 1.66% of BTC and 3.23% of ETH. PoR only answers one question: at the moment of the snapshot, were the user assets included in the calculation backed by the same amount of coins? It does not show the company’s own borrowing or other liabilities. A comparison of 13 exchanges is in the proof of reserves comparison.
To confirm your own balance was included, the official steps are:
- Go to the verification tool page Binance published on GitHub and download the matching version; snapshots from 2026-08-01 onward use version 1.2.1.
- Log in to Binance on the web, click [Profile] → [Wallet] → [Verification], expand the verification details and check that the verification type is “Merkle Tree + Zksnarks”.
- Click [Download Merkle Tree] to download the data, put it in the tool’s config folder, and run the verification program with the -user parameter to verify your account. The report is a snapshot, so it is normal for it not to match your current balance.
Who legally owns the assets you keep on Binance?
The Binance.com Terms of Use (effective 2026-07-21) state that your contract is with three ADGM companies, and that Nest Clearing and Custody Limited (NCCL) handles custody as trustee. Clause 8.4 explains that NCCL records its own assets and client assets separately in its internal ledger and reconciles the ledger with the omnibus wallets at least once a week; assets held on trust do not belong to NCCL, and if NCCL becomes insolvent, the protections under ADGM rules apply. The same terms also state that Binance has no obligation to insure digital assets.
Where is Binance registered or licensed?
The list below follows Binance’s “Licenses, Registrations and Other Legal Matters” page (viewed 2026-10-22; the page shows no update date), with names as Binance writes them:
| Jurisdiction | Binance entity | Regulator | Registration or license type |
|---|---|---|---|
| Abu Dhabi (ADGM, global platform) | Nest Exchange Limited, Nest Clearing and Custody Limited, Nest Trading Limited | FSRA | Recognized investment exchange (derivatives), recognized clearing house (including custody), financial services permission |
| Kazakhstan (AIFC) | BN KZ Technologies Limited | AFSA | License to operate a digital asset trading facility, provide custody and deal as principal |
| Bahrain | Binance Bahrain BSC(c) | Central Bank of Bahrain | Category 4 crypto-asset service provider (CASP) license |
| Dubai | Binance FZE | VARA | Virtual asset service provider (VASP) license |
| Australia | InvestbyBit Pty Ltd (Binance Australia) | AUSTRAC | Digital currency exchange (DCE) registration |
| India | Nest Exchange Limited | Financial Intelligence Unit (FIU) of India | Registration as an offshore reporting entity |
| Indonesia | PT. ASET DIGITAL BERKAT (Tokocrypto) | Bappebti | Physical crypto asset trader (PFAK) license, obtained 2024-09-06 |
| Japan | Binance Japan Inc. | Financial Services Agency (JFSA) | Crypto-asset exchange service provider, Kanto Local Finance Bureau No. 00031 |
| New Zealand | Investbybit Limited | Financial Service Providers Register | Registered as FSP1003864; the page states this does not mean it is supervised by a New Zealand regulator |
| Thailand | Gulf Binance Co., Ltd. | Ministry of Finance of Thailand, Securities and Exchange Commission of Thailand | Digital asset business license (joint venture with Gulf Edge) |
| Mexico | Bmex Techfin | Tax Administration Service (SAT) | Vulnerable Activity registration (activities vulnerable to money laundering) |
| El Salvador | Binance Services Latinoamérica | CNAD, Central Reserve Bank | Digital asset service provider (DASP) and bitcoin service provider (BSP) licenses |
| Argentina | Binance Services Latinoamérica | National Securities Commission (CNV) | VASP registration No. 76, 2024-09-11 |
| Brazil | Simpaul Corretora | Regulator not stated on the official page | Securities broker, authorized to issue electronic money |
| South Africa | Binance RSA | FSCA | Provides crypto products under a FAIS exemption (excluding futures and options) |
Source: the official PDF on the same page, read 2026-10-22. For Mexico and Bahrain, the PDF also lists separate payment entities (Medá, BPay Global). When I checked on 2026-10-22, the list included no European country.
Two points in this table are easy to misread. First, a “registration” is not the same as a “license”: in the New Zealand row, Binance itself states that being registered does not mean active supervision by the local regulator. Second, local entities serve local users; under the Terms of Use, an account opened on binance.com has its contract with the three ADGM companies. Rules differ from country to country, so the local regulator’s notices are what count.
How to tell if the Binance website and app are real: is the Binance APK safe?
Start with the web address. Binance’s guide to spoofed URLs tells users to confirm the domain is binance.com and the address starts with https://, and its anti-scam guide also recommends checking that the SSL certificate belongs to *.binance.com or *.binance.net. The 2018 attack used a Unicode domain that looked almost exactly like binance.com; the only difference was an extra dot under each of two letters. If you see a suspicious URL, email address, phone number or Telegram account, you can check it with Binance Verify. The tool also reminds you that Binance will never ask you to transfer crypto or make a payment through a private message.
Next, the app. These are the official channels I found on 2026-10-22:
| Channel | What to check | Source |
|---|---|---|
| Official download page | The URL is binance.com/…/download; the page shows Android 3.21.6 and iOS 3.22.4 | Binance download page |
| Official Android installer (APK) | Download domain download.binance.com, file name BNApp64.apk, about 321 MB (the server shows it was updated 2026-10-19) | Page data of the Binance download page |
| App Store | Developer and seller are both Binance Switzerland AG, App ID 1436799971, version 3.22.4, about 59,000 ratings | App Store page |
| Google Play | Developer Binance Inc., package name com.binance.dev, 100 million+ downloads, updated 2026-10-16 | Google Play page |
| Send an email to [email protected] to get the official download links for the latest Apple and Android versions | Binance guide to avoiding fake apps |
Source and date: the pages in the table above, viewed 2026-10-22; version numbers and download counts change over time.
So whether a Binance APK is safe depends on where the file came from. An installer reached from the binance.com download page and served from download.binance.com is the official file; an APK from Telegram, LINE, WhatsApp, a search ad or a “tutorial site” cannot be verified. Binance describes two kinds of fake app: one imitates the name and icon, and the other is official code that has been modified and repackaged, with the same name and icon, so it looks almost identical. Based on two Binance articles (2023-02-21, 2023-10-27), you can check the following:
- Store listing: a distorted icon, unnecessary permission requests, a description full of typos, very few downloads, or a recent release date with a large number of reviews are all warning signs. The official app has 100 million+ downloads on Google Play.
- Developer details: compare them with the developer names in the table above, Binance Inc. on Google Play and Binance Switzerland AG on the App Store. Binance also warns that fake listings occasionally appear in the official stores too.
- Check the address before you deposit: the most common fake-app trick is to replace the address or QR code on the deposit page, or make the “Copy” button paste someone else’s address. Binance recommends logging in to the website in a private browser window, opening the [Deposit] page and comparing it with the address on your phone character by character.
- Check again when you withdraw: confirm the address on the [Confirm Order] page and compare it with the notification email Binance sends. A successful small test does not prove the app is real; Binance states that some fake apps let small amounts through and only divert the funds once a large amount is sent.
- If you have already installed a suspicious app: remove it immediately, reinstall from an official channel, change your account password and contact customer support. If something looks wrong with your account, you can lock it first from your profile picture in the app → [Security] → [Disable Account] (Binance scam prevention notes).
The safe way is to type binance.com yourself, open the download page, and go from there to the App Store, Google Play or the official installer, without clicking any download link someone sends you. Other ways scammers impersonate exchanges are covered in exchange scam types; if someone tells you to “pay a deposit or tax before you can withdraw,” that is the standard script of the fake exchange withdrawal scam.
Which security settings should you turn on for your Binance account?
- Two-factor authentication (2FA): Binance’s account security tips recommend using a passkey or an authenticator app instead of SMS, and remind you never to give your codes to anyone, including people who ask you to take a screenshot or share your screen.
- Anti-Phishing Code: once it is set, every genuine email and SMS from Binance carries this code; a wrong or missing code may mean phishing. It must be 6 to 8 characters, use at least three of uppercase letters, lowercase letters, numbers and underscores, and contain no special characters. On the web it is under [Account] → [Security] → [Advanced Security]; in the app, go to Profile → [Account Info] → [Security] → [Anti-Phishing Code] (Anti-Phishing Code guide, updated 2026-08-28).
- Withdrawal Whitelist: when it is on, you can only withdraw to whitelisted addresses, up to 200 of them. You can also turn on a lock period for whitelisted withdrawals, so newly added addresses must wait a while before they can be used. Disabling or changing the whitelist may suspend withdrawals for 24, 48 or 72 hours (withdrawal settings guide).
- “Require passkey verification”: when it is on, both login and withdrawals need a passkey, and if you lose it you cannot log in. Binance requires you to turn it off before changing phones, changing your iCloud account or reinstalling the app (passkey feature guide).
- The cost of resetting 2FA: the review takes up to 24 hours, and after the reset, withdrawals, C2C selling, internal transfers and payments are disabled for up to 48 hours (2FA reset guide, updated 2026-06-03). After security actions such as changing your password, withdrawals are also suspended for 24 to 48 hours, and the hold cannot be lifted early (withdrawal suspension guide).
It is best to set all of this up while you are not in a hurry to withdraw. The settings of 13 exchanges are compared in exchange account security settings, and the Binance deposit and withdrawal steps are in how to deposit and withdraw on Binance.
Where can’t you use Binance?
Binance’s list of prohibited countries (updated 2026-01-05) has three groups. United States: anyone located, incorporated, resident, holding citizenship or operating there cannot use Binance. Canada and the Netherlands: anyone located, incorporated or resident there. The third group is Cuba, North Korea, Iran, Crimea and the so-called Donetsk and Luhansk People’s Republics. Clause 2.1 of the Terms of Use makes this list an eligibility condition for registration, and individual users must also be at least 18.
Clause 25.5 of the Terms of Use adds that services may be fully or partly restricted in some countries, not only those on the list; if you travel to a listed region, you may be unable to view or manage your orders and positions; and you must not get around the restrictions by changing your IP with a VPN or similar means. Restricted regions across 13 exchanges are compared in exchange restricted countries.
FAQ
Is it safe to keep money on Binance?
No exchange can guarantee absolute safety. What you can check on Binance is this: its platform wallets were breached only once, in 2019, and SAFU covered the full loss; in the 2026-10-01 proof of reserves, the BTC, ETH and USDT reserve ratios were all above 100%. Assets on an exchange are held by the exchange, and the terms state that Binance has no obligation to insure them. For coins you will not trade for a long time, consider keeping them in your own wallet; see the crypto wallet guide.
Could Binance collapse?
No data can predict whether an exchange will collapse; all you can look at are the public numbers. Binance publishes a proof of reserves every month, and in the 2026-10-01 snapshot the ETH surplus was only about 3.32 ETH; PoR also does not show the company’s own liabilities. The Terms of Use state that client assets are held on trust by NCCL, and that if NCCL becomes insolvent the protections under ADGM rules apply, but how things are actually handled would depend on the procedure at the time.
Has Binance been hacked? Were users compensated?
The exchange’s wallets were breached once. On 2019-05-07, 7,000 BTC was taken from the BTC hot wallet, about 2% of its total BTC holdings at the time; Binance announced that SAFU covered the full amount and user funds were not affected. What was attacked on 2022-10-06 was BNB Chain’s cross-chain bridge, not a Binance exchange wallet, and BNB Chain said users were not affected.
Is the Binance APK safe? Where should I download it?
An APK obtained from the binance.com download page and served from the download.binance.com domain is the official file. An APK someone sends you cannot be verified, so do not install it. Binance explains that repackaged fake apps have exactly the same name and icon as the real one and may swap your deposit address, so before your first deposit after installing, compare the address in a private window on the official website.
What is the developer name of the Binance app?
As of 2026-10-22, the developer on Google Play is Binance Inc., with the package name com.binance.dev; on the App Store, the developer and seller are Binance Switzerland AG, App ID 1436799971. The name shown may differ between regional stores, so it is best to reach the store from the binance.com download page.
What should I do if my Binance withdrawal is stuck?
First check whether it is a security hold: withdrawals stop for 24 to 48 hours after a password change, for up to 48 hours after a 2FA reset, and possibly for 24, 48 or 72 hours after a whitelist change, and all of these can only be waited out. Binance states that a withdrawal usually gets a TxID within 1 to 30 minutes after it is submitted, and you only need to contact support if there is still none after 6 hours (steps in how to deposit and withdraw on Binance). For other reasons an account may be frozen, see what to do if your exchange account is frozen. Anyone who asks you to pay first before you can withdraw is a scammer; the usual script is described in the fake exchange withdrawal scam.
Is Binance’s proof of reserves audited by a third party?
No accounting firm is listed at the moment. Binance uses a Merkle tree plus zk-SNARKs, and the audit field in the 2026-10-01 snapshot data says zk-SNARKs. This method lets you confirm your own balance was counted in the user total, but the third-party custody portion (about 1.66% for BTC) cannot be checked on-chain yourself.
For Binance’s fees, rebates and products, read the Binance review. How to sign up is in Binance referral code, and the identity verification steps are in the Binance KYC guide. The hack and regulatory records of 13 exchanges are in the exchange security record.