Where Is Your Money Safest? A Bank, an Exchange, Your Own Keys, Cash or Gold

No single place is safest, because a bank, an exchange, your own keys, cash and gold each fail in a different way. Ask two questions of each: who else can touch your money, and who covers you when it goes wrong. None of them is the safe one, so most people end up using more than one, one place for each job their money does.

Key takeaways

• Each place fails differently, and each one's strength is another's weakness.
• A bank can freeze you, and a law is only as good as whoever keeps it: in Lebanon most frozen savings still haven't come back. An exchange can be hacked and covers you only if it chooses. With your own keys, no one can block you and no one refunds you.
• Phishing works the same everywhere. What changes is who is there afterwards.
• The position here is some of each, one place per job, and no percentages. The one rule: don't keep all your eggs in one basket.

What happened at Binance, and who covered the loss?

Short answer: thieves took about $6.3 billion from Binance on 29 October 2026, most of it within about 20 minutes, according to TRM Labs. Binance says it is absorbing the loss, covering users from its user-protection fund, part of its futures insurance fund and its treasury.

Binance suspended withdrawals and reopened them on Sunday 1 November. It says it has covered up to 90% of the stolen assets and will keep buying the rest until coverage reaches 100% (CNBC). The FBI says North Korea was responsible. Binance has not published a root cause.

About $2.7 billion was frozen within days, including about $1.77 billion of Tether and about $825 million of Circle's USDC, according to TRM. The attacker still held about $2.4 billion. The user-protection fund, SAFU, was set up in July 2018 with 10% of trading fees, and Chainalysis estimated it could cover roughly a third of the remaining loss.

Who else can touch your money in each place?

Short answer: a bank or an exchange can freeze or pause your money. With your own keys, no one else can touch it, with one exception: a stablecoin issuer can freeze its own token even in your wallet. Cash and gold can still be stolen, destroyed or seized.

In March 2013, Cyprus closed its banks for almost two weeks and capped withdrawals at €300 a day when they reopened. Lebanon has limited withdrawals informally since October 2019, under central bank circulars that a 2026 report expects to be extended to about July 2027. Binance paused withdrawals. In Sudan, outages hit the Bankak banking app in late August and early September 2026, and some traders now refuse to sell unless they're paid in cash.

Who covers a loss in each place?

Short answer: in the US a bank covers deposits up to $250,000 by law, but a law is only as good as the state that keeps it. An exchange covers you if it chooses, as Binance is doing this month. With your own keys, cash or gold, you cover the loss yourself.

Deposit insurance covers a bank failing, not theft. The FDIC does not insure against theft or fraud. Regulation E limits what you lose on an unauthorized electronic transfer to $50, $500 or more depending on how fast you report. It excludes transfers by someone you gave access to, so a bank won't cover a transfer you authorized, even through a scam.

The law is not always better. Lebanon's depositors have been frozen out since 2019, and a February 2026 Ankura study projects that about 550,000 may not recover their savings even within the $100,000 ceiling. In October 2026 banks began offering to swap frozen dollar accounts for property, bonds or bank equity at 15,000 pounds to the dollar, against a market rate of about 89,500: roughly a sixth. In Sudan, the war that began in 2023 locked depositors out of their savings. A guarantee is only as good as the state behind it.

Even the cap is a decision in a crisis. When SVB failed, 86.4% of its deposits were uninsured, and regulators protected all depositors on 12 March 2023. The FDIC then recovered its loss through a $16.3 billion special assessment, over 95% of it from banks with $50 billion or more in assets. FTX shows the other side: prosecutors put customer losses at about $8 billion.

How many people are hit at once?

Short answer: at a bank or an exchange, everyone who uses it is exposed at once. With your own keys it is usually just you, unless the device itself is flawed, as two hardware wallets turned out to be in 2026.

SVB lost $42 billion in one day, 9 March 2023, about a quarter of its deposits. Lebanon's limits hit the whole system. At Binance, every customer was affected by the pause.

Self-custody has its own correlated failures. A build error in Coldcard firmware from March 2021 made some devices generate keys from a weak random number generator, cutting effective strength from 128 bits to as little as 40 on older devices. Thieves began emptying wallets on 30 July 2026. TRM, citing Galaxy Research, counts about 1,816 BTC, around $116 million, from more than 5,200 addresses (estimates vary). A firmware update stops new weak keys but doesn't fix an existing one.

Ledger found hidden hardware in some devices sold by one Southeast Asian reseller, CryptoBilis. It copied the 24-word recovery phrase from the screen during setup and sent it over a mobile network. On-chain estimates run up to $93 million across 300-plus wallets, which Ledger hasn't confirmed, and it hasn't verified thefts involving devices bought elsewhere. In both cases the owner did nothing wrong after unboxing.

Can you undo your own mistake?

Short answer: at a bank, sometimes. At an exchange, a support team exists. With your own keys, never: a transaction you authorized is final. That is the price of nobody being able to block you or hold your money for you.

Two years ago, five digits of USDC landed in my MetaMask wallet, one of the first wallets I ever made, which I hadn't used much. At first I thought the money hadn't come through. Then I opened a blockchain scanner and saw it had arrived and then been moved, a few hours later. A year before, I'd clicked a link and given a website permission to spend from that wallet. I didn't know I had. The thief hadn't bothered with the small amounts that came and went. When a big one landed, he took it. I revoked everything. There was no one to report it to. It sucked.

What I'd given was a token approval. MetaMask describes it as a signed permission that lets a site spend a set amount of one of your tokens, and says malicious ones often grant unlimited access. It stays active until you revoke it, and disconnecting from the site doesn't cancel it. Revoking is a transaction, so it costs a small network fee. MetaMask's advice is to check your approvals regularly.

Phishing is a big problem in every situation. A bank account can be phished too. This time it hurt because it was crypto. A bank won't cover a transfer you authorized either, because Regulation E treats it as yours. If you authorize it, it's on you, wherever the money sits. Scam Sniffer counted $83.85 million lost to wallet-drainer phishing on Ethereum-style chains in 2025, across 106,106 victims.

How hard is it to move a large sum?

Short answer: a bank can question or block a wire, an exchange can pause withdrawals, and your own keys move anywhere, instantly and irreversibly. Cash and gold are the hardest: cash is bulky, gold is heavy, and neither moves in size without friction.

Gold also costs to buy and sell: dealer guides, which have a commercial interest, quote premiums of roughly 2% to 6% over the market price and buy back below it. Fakes exist. Tungsten is almost as dense as gold, so weighing doesn't catch it, and only an assay does. Both can be stolen, and gold can be seized or stopped at a border. Rules for taking cash or gold across borders vary by country.

Is self-custody safer than an exchange?

Short answer: it depends on which risk you mean. In August 2026, Binance's founder Changpeng Zhao argued exchanges are statistically safer, citing estimates of about 1.57 million BTC lost from self-custody against 1.51 million from exchange hacks. He runs an exchange, so weigh it as a claim, not a verdict.

His self-custody figure includes keys that were simply lost. An exchange's failure hits everyone at once and is covered or not by the company. A self-custody failure is mostly individual and carries no cover at all. They fail differently.

So where should you keep your money?

Short answer: in more than one place, because none of them is the safe one. Use a bank for spending, an exchange for moving quickly, your own keys for money only you control, some cash for when systems are down and some gold for wealth that isn't anyone's debt.

What you use depends on the job and on where you live. With your own keys, nobody can block you and nobody can fix your mistake; a bank can often undo your mistake, but it can lock you out. The one rule that holds everywhere: don't keep all your eggs in one basket.

A bank deposit is a claim on the bank, spendable with the bank's agreement. You can't change that for the whole system, but you can look at your own accounts and ask which job each one does. And go check what your old wallets are still allowed to spend.

We built The Lifedao Academy and the non-custodial Nobank so there is a place to start learning how holding your own keys works: academy.thelifedao.io.

Frequently asked questions

What happened to users' money in the Binance hack? Thieves took about $6.3 billion on 29 October 2026. Binance says it is covering its customers from its own funds, and had covered up to 90% by 31 October.

Does FDIC insurance cover theft? No. It covers a bank failing, up to $250,000 per depositor. Regulation E limits your loss on unauthorized electronic transfers, but a bank won't cover a transfer you authorized, even through a scam.

What is a token approval and how do I revoke one? It is a signed permission that lets a site spend a set amount of one of your tokens, and it stays active until you revoke it. MetaMask lets you view and revoke approvals, for a small network fee.

Can a hardware wallet be hacked? Two failed in 2026: Coldcard, through weak key generation, and Ledger devices sold by one reseller, which had hidden hardware that copied the recovery phrase.

Can my crypto be frozen if it is in my own wallet? The wallet can't be, but a stablecoin issuer can freeze its own token. Tether and Circle froze about $2.6 billion linked to the Binance theft, according to TRM.

How money works, and how you can keep it riba-free.