Is it safe to keep crypto on an exchange in 2026?

Holding crypto on a centralized exchange carries risks that are easy to overlook until something goes wrong. In the space of two weeks in mid-2026, BitMart announced it was shutting down its trading platform and Coinsbuy lost over $8 million to a hack. Both cases illustrate the core issue with “custodial” arrangements: the exchange holds your private keys, not you. Your coins are only as secure as the exchange’s solvency and security.

What “custodial” actually means

When you buy crypto on Coinbase, Binance, or any centralized exchange and just leave it there, you are not holding the coins the way you hold cash in your pocket. You hold a claim: an entry in the exchange’s database that says it owes you that amount. The exchange holds the private keys (the credentials that actually control and move the crypto on the blockchain), while you only control a login to their platform.

This is the custodial model: a third party holds custody of your assets instead of you. In normal conditions the difference is invisible. Withdrawals go through and balances look correct. But when something goes wrong (a hack, an insolvency, a regulatory freeze, or a decision to wind down), the distinction between holding crypto yourself and holding a claim against an exchange is the only thing that matters.

The alternative is self-custody: you hold the private keys yourself, in a wallet only you control. No one can freeze your funds or drag them into a bankruptcy process. The trade-off is real, though. If you lose the private keys, there is no support team that can recover them for you. The responsibility shifts to you; it does not go away.

The proof: BitMart’s shutdown and the Coinsbuy hack

Two events in mid-2026, roughly two weeks apart, show both sides of custodial risk: one exchange choosing to shut down, and another losing funds to a hack.

BitMart’s shutdown. BitMart announced an orderly wind-down of its trading platform on July 26, 2026 and immediately suspended new registrations. The timeline it set was:

• August 26, 2026 at 01:00 UTC: trading stopped.
• 05:00 UTC the same day: recommended deadline to submit withdrawal requests.
• January 31, 2027 at 15:59 UTC: full operational termination.

The company gave no specific reason beyond “a careful evaluation of the company’s operating conditions, market environment, and future strategic direction.” Requests submitted after the deadline faced additional checks (identity verification, device and IP checks, and sanctions screening) before funds could move. (Source: Cryptowisser, July 2026) BitMart was the second exchange to announce a closure within three days, after BitMEX. (Source: PYMNTS, July 2026)

The Coinsbuy hack. On August 9, 2026, an attacker drained more than $8 million from Coinsbuy across Ethereum and TRON. The attack began with a small 5 USDT test transaction. Then 6.04 million USDT was taken from eight TRON wallets, while 1.89 million USDT and 77 ETH were taken from three Ethereum wallets. Coinsbuy said it covered the full loss from its own reserves (no client funds were lost) and refilled the drained wallets to within 0.05% of their pre-attack balances within 24 hours. (Source: CoinDesk, August 2026)

One case is a company choosing to stop operating. The other is an outside attacker breaking in. A customer holding a balance on either of these platforms could not have prevented the outcome. In both cases, what happens next to your funds depends on decisions made by the platform, not by you as a customer.

How exchange failures escalate

These two events were not outliers for 2026. By late July, roughly $972 million had been stolen across the sector this year, according to CoinDesk (Source: CoinDesk, August 2026). The pace accelerated in the third quarter. From July to September alone, about $1.26 billion was lost to hacks, bringing the 2026 total to about $2.68 billion, according to CertiK (Source: Yahoo Finance, October 2026). Trackers count incidents differently, so their totals never match exactly, but they agree on the direction. The two largest incidents of the quarter were the hack of the Bitget exchange ($387.5 million, announced September 24) (Source: PYMNTS, September 2026) and a drain of the Liquid Network, a Bitcoin sidechain (about $320 million in bitcoin on September 6, most of it returned within days by self-described white-hat hackers) (Source: The Block, September 2026; Finbold, October 2026). Separately, more than 100 crypto projects shut down, filed for bankruptcy, or went dark in 2026, according to RootData data cited by CoinDesk. Four major firms (BitMEX, BitMart, Movement Labs, and Storj Labs) announced closures or filings within a single week in late July alone. (Source: CoinDesk, August 2026)

The pattern that matters isn’t any single incident, it’s how fast an “isolated” event can become a frozen or lost balance. A hack drains a hot wallet in under an hour, as Coinsbuy’s did. A shutdown gives you weeks of notice and a deadline, as BitMart’s did, but only if you’re paying attention and your paperwork clears in time. Either path ends the same way for someone who wasn’t watching: funds you can’t move when you need to.

Custodial vs. non-custodial: what changes and what doesn’t

The natural response is to move the crypto to a wallet you control. That solves the problem for an idle balance on an exchange. It is less straightforward, and often overlooked, when the crypto is also generating a return.

Exchange “earn,” “savings,” or staking products still route your funds through the exchange’s own wallets. The yield is just a separate feature added on top of the same custodial setup. The exchange still holds the private keys, so a shutdown or hack affects money in an earn product the same way it affects an idle balance. Earning a return does not change who controls the underlying assets, and it does not make the platform safer or more solvent.

Non-custodial alternatives exist for a growing number of networks. The core difference is where the private keys live: in a wallet only you control. You sign the transactions yourself, and they are visible on-chain instead of happening inside a company’s internal ledger that you have to trust. We covered this same distinction for Ethereum stakers watching their rewards shrink and for real yield versus inflationary yield more broadly: the source of a return and the custody arrangement around it are two separate questions, and both matter.

Where staking fits in: a non-custodial option for RUNE

If you hold RUNE (the native token of THORChain, a network that lets people swap assets across different blockchains without a centralized exchange in the middle), there is a non-custodial way to earn a return on your balance instead of leaving it idle on an exchange. THORChain is secured by node operators who lock up RUNE as a security deposit, called bonding, and get rewards mainly from the swap fees the network generates.

RUNEBond connects RUNE holders (bond providers) with node operators so you can delegate without running a node yourself. The platform does not control capital. Bonding takes place at the protocol level, using your RUNE from your own wallet.

This is a genuinely different custody arrangement than an exchange balance can offer, but it is not risk-free, and treating it that way would be dishonest. Bonded RUNE cannot be withdrawn on demand. Unbonding only happens once the node operator opens an exit window, which can take days to months. If a node operator misbehaves or performs badly, bonded RUNE can be slashed (reduced as a penalty), and every bond provider on that node shares the loss. Node operators are also whitelisted and vetted rather than open to anyone instantly. These are not footnotes. They are the trade-off for not handing your private keys to a company. We wrote a full breakdown of these mechanics in RUNE bonding risks: lock-ups, slashing and why easy bonding matters, and it’s worth reading before committing capital either way.

What to check before you park crypto anywhere

This is not a recommendation to move funds. It is a short checklist of what to understand about any platform holding your crypto, custodial or not, before you decide anything with your own money.

• Who actually holds the keys. If the answer is “the platform,” you have a claim, not an asset in hand.
• What the exit process looks like on a bad day. Instant withdrawal, a queue, a deadline, or a wind-down process, and how each responds to demand spikes.
• Whether a yield or staking product changes custody. Often it doesn’t: check where the underlying assets actually sit.
• What the platform has said publicly about reserves, audits, or insurance, and whether that’s been independently verified rather than self-reported.
• What penalties or lock-ups apply to non-custodial alternatives, since “not custodial” doesn’t mean “no risk.” It means a different set of risks that you can at least verify yourself.

None of this is financial advice, and it is not a verdict on any specific platform. It is simply a checklist for asking better questions before you trust anyone (including us) with your crypto.

If you hold RUNE and want to see what non-custodial bonding actually looks like in practice, you can compare THORChain node operators on RUNEBond and review their track records before delegating anything.