Binance, the world’s largest cryptocurrency exchange, resumed operations after temporarily suspending them following a cyberattack. The theft resulted in the loss of almost $6.3 billion worth of digital assets.
The incident raises an important question for cryptocurrency users: When an exchange holding their digital assets is hacked, who is responsible for returning the money? The answer depends on how the assets are held, the exchange’s contractual obligations and the legal protection available to customers.
Who controls your crypto on an exchange?
When someone invests in crypto through an exchange, the digital currency appears on their online dashboard. However, the person concerned may not have direct access to the digital wallet in which the asset is stored.
“Legal ownership and operational control are distinct,” said Alay Razvi, managing partner, Accord Juris.
When cryptocurrency is purchased through an exchange, the investor may retain beneficial ownership, while the exchange controls the private keys and processes transactions. Keeping assets in an exchange wallet does not automatically transfer ownership to the exchange. However, the user agreement, custody arrangements, segregation of assets and actual dealings determine whether the investor owns cryptocurrency or merely has a contractual claim for equivalent assets, Razvi added.
The extent of customers’ ownership rights will depend on the contractual arrangements and applicable laws.
If hackers steal crypto, does the exchange have to compensate investors?
“Liability turns on fault because security is the core of the service,” said Kunal Sharma, managing partner, TARAksh Lawyers and Consultants.
An exchange can be held liable when a cyberattack succeeds because of its failure to take reasonable care, a breach of contract or a breach of its duty as custodian. Disclaimers and force majeure clauses are unlikely to shield it from losses caused by weaknesses in its own systems or controls, although practical hurdles often limit what investors can recover, he added.
“The Bombay High Court in 2025 accepted, prima facie, that no absolute liability attaches to a platform in case of a cyberattack, but that a liability attributable to a reasonable duty of care does,” said Anshul Verma, partner, SKV Law Offices.
Force majeure is where the court drew a useful distinction. A clause might excuse a platform from providing its services for a while, but that is different from allowing a user’s underlying asset to simply disappear, Verma added.
The Indian Contract Act, 1872, also governs contractual relationships between parties. Section 37 of the Act specifies that parties must perform their contractual promises. Section 73 provides for compensation when a breach of contract causes a loss to an aggrieved party.
If an exchange fails to comply with the provisions of the Act, customers can seek compensation, provided the aggrieved party establishes the breach, the connection between that breach and their loss, and the amount of damages.
In this case, Binance has voluntarily guaranteed to cover the loss. This should not be confused with its general legal obligations.
What protection do Indian crypto investors have?
India does not have a concrete regulatory framework governing the financial soundness of cryptocurrency exchanges, the custody of assets and compensation for losses.
However, certain laws can be used to safeguard customers’ interests in such scenarios. The Prevention of Money Laundering Act, 2002 (PMLA), is one such law. Through a notification, the government brought activities such as exchanging virtual digital assets (VDAs), transferring them and providing custody services within the PMLA framework. Exchanges carrying out these activities must register with the Financial Intelligence Unit-India (FIU-IND) and comply with applicable customer identification, record-keeping and reporting requirements.
Binance was also fined ₹18.82 crore by FIU-IND in June 2024 for violating its obligations under the PMLA.
However, these requirements primarily address money laundering and financial transparency. They do not guarantee the safety of customer holdings or provide automatic compensation if an exchange loses cryptocurrency. This highlights the policy gap between monitoring crypto transactions and protecting the assets of people using these platforms.
What happens if a crypto exchange goes bankrupt?
The situation becomes more complicated if an exchange loses cryptocurrency and subsequently becomes insolvent.
Under the Insolvency and Bankruptcy Code, 2016 (IBC), the assets of a company undergoing insolvency are dealt with through a legal process to settle its liabilities. But a key question arises when an exchange holds cryptocurrency belonging to customers: Should those assets be treated as the company’s property or returned to their actual owners?
“If liquidation is governed by the IBC, Section 36(4) excludes customer-owned assets, including assets held in trust, from the liquidation estate, provided ownership is established,” said Supriya Majumdar, Partner, Elarra Law Offices.
A contractual repayment claim alone gives no automatic priority, and insufficient assets may result in partial or no recovery. Indian law does not automatically govern an offshore exchange’s insolvency, Majumdar added.
India’s insolvency law does not yet provide clear, crypto-specific rules to resolve all such ownership and segregation questions. This raises important questions about the nature of liabilities towards customers.
A limitation-of-liability clause may, however, be examined by courts if a customer challenges its fairness or enforceability. In K C Theatre v. State of Jammu and Kashmir (2023), the Supreme Court observed that unreasonable contractual terms imposed by a party with greater bargaining power may not always be enforceable against the weaker party.
An October 2026 research paper published by the Insolvency and Bankruptcy Board of India (IBBI) flagged these gaps. It recommended recognising virtual digital assets as property under insolvency law and keeping customers’ holdings separate from an exchange’s own assets to protect customers from unlimited liability. These recommendations are merely suggestions, not existing statutory requirements.
What can Indian investors do if an exchange freezes withdrawals or loses their money?
Customers facing withdrawal restrictions should first preserve evidence relating to their accounts, including account statements, transaction records, wallet addresses, withdrawal requests and communications with the exchange.
They can raise a formal complaint with the platform. If they suspect unauthorised transfers or cyber fraud, they can report the incident through the National Cyber Crime Reporting Portal or call 1930.
Depending on the nature of the dispute, customers may also approach civil courts or consumer commissions for appropriate relief.
In a July 2, 2026, judgment in Amit Ranjan and Others v. Union of India and Others, the Delhi High Court dismissed an appeal by BitBNS customers seeking the release of their funds and compensation. The judgment illustrates that although legal remedies may be available, recovering cryptocurrency can be difficult, particularly when exchanges operate through entities in different countries.
The Binance incident raises questions beyond digital theft. It highlights the urgency of developing clearer, pragmatic rules on customer ownership and the protection of digital assets, while establishing accountability for private exchanges and the State.
