Ask whether an exchange is safe and someone will answer in four words: the exchange has insurance. Four separate arrangements sit behind that sentence. Three of them pay nothing in the situation the person asking usually has in mind, and one of them, by the exchange's own wording, cannot be called insurance at all.
One word, four unrelated arrangements
Sorted by where the money comes from, the arrangements published across the major platforms fall into four groups.
- A discretionary fund the platform set aside itself. Binance's SAFU is the one everybody names.
- A futures insurance fund. Carries the word in its title, handles bankrupt positions, and never looks at hacks.
- A commercial crime policy bought from an insurer. Real underwriting, real exclusions printed next to it.
- Deposit insurance on the fiat side. Covers cash sitting in a bank, has a statutory ceiling, and stops at the edge of anything crypto.
Only the last two are insurance in the ordinary sense of the word. Binance says as much about its own futures fund, more bluntly than an outside commentator would dare: notwithstanding the use of the term “insurance”, the Futures Insurance Funds are not insurance products, and Binance is not an insurer.
SAFU: funded from trading fees, paid out at Binance's discretion
The Secure Asset Fund for Users dates to 2018. Binance's account of how it was seeded runs to one line — a percentage of trading fees was allocated to grow it to a sizable level — and the rest of the FAQ page repays attention far better than the origin story does.
Four things on that page are worth copying into your own notes.
Size and custody. As of February 2026 the fund held crypto assets valued at approximately US$1 billion, and Binance states that the value moves with the market. Part of the fund serves as capital reserves under Binance's regulatory obligations in the Abu Dhabi Global Market, and the fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the ADGM Financial Services Regulatory Authority. Two wallet addresses are printed on the same page, one for BTC and one for USDC, so the balance can be checked on-chain without asking anybody.
A floor with a stated trigger. Should the market value drop below US$800 million on BTC price movement, Binance says it will rebalance the fund back to US$1 billion. A number with a trigger attached behaves differently from a number quoted in a press release, and this one can be held against the published addresses.
What the fund covers. The wording names losses sustained by users through a compromise of their Binance account login credentials resulting from a vulnerability or other deficiency in Binance's systems and/or security protocols. Follow the direction of cause in that sentence. The credential compromise has to originate in a platform flaw. A password typed into a lookalike domain, or a code read aloud to someone impersonating support, sits outside the scenario described.
Who decides, and by when. Claims go through Binance Support and should be made within 90 days from the date of the eligible loss. Binance retains full discretion over which types of loss and which claims qualify, and adds that it may change the intended use of the funds from time to time at its discretion.
What discretion means here
Not that a payout never happens — it means the judgement belongs to Binance. The page reserves full discretion over which loss types and which claims qualify, and adds that the intended use of the funds may change from time to time. An outcome therefore turns on how the platform characterises an incident rather than on what you can document about your own loss. An enforceable policy runs the other way round, which marks the real line between a fund a platform set aside and cover bought from an insurer.
The futures insurance fund was never built to pay you
Open the derivatives page on any venue and a balance labelled insurance fund sits there, frequently in the billions. It belongs to a different problem entirely.
When a leveraged position runs past the point where its margin can cover it, the position goes bankrupt, and liquidation settles at the bankruptcy price rather than at whatever the market happens to print. Any gap between that price and the price the liquidation order actually fills at has to land somewhere. The fund is where. Binance draws the boundary in a single sentence: the Futures Insurance Funds are not used to cover traders' losses, and their only purpose is to cover the difference between the bankruptcy price and the execution price of the liquidation order.
Bybit describes the same machinery from the other side. A liquidation closing better than the bankruptcy price leaves surplus margin, which flows into the fund; one closing worse draws from it. The balance on screen is the running total of those two flows, which is why it swells through calm weeks and drops in violent ones.
Binance names one further source: liquidation clearance fees, deducted from traders whose positions are liquidated without going bankrupt, may be allocated to the funds as Binance considers appropriate. The required minimum size is calibrated to a 99.9% confidence interval against historical stressed scenarios, and reviewed quarterly.
The ceiling is the part almost nobody reads. Each fund carries a Maximum Takeover Capacity — a multiple of its current balance, the multiplier pre-determined and kept confidential. Binance's own illustration: a fund holding $1 million with a 3x multiple can absorb $3 million of notional bankrupt positions. Past that point auto-deleveraging begins, and the counterparties selected for closure are the opposing traders ranked by leverage and profitability. Whoever was winning pays the shortfall.
A large balance on the futures data page therefore tells you how much cushion that contract category carries at the moment. On theft, frozen accounts, or a venue going under, it says nothing whatever.
Coinbase: an actual policy, and the exclusions printed beside it
Coinbase buys cover from insurers and publishes its shape. Crime insurance held by Coinbase Global protects a portion of the digital currencies across its storage systems against losses from theft, including cybersecurity breaches. Three qualifications follow in the same block of text, and each one moves the answer.
Losses from unauthorised access to your own account caused by a breach or loss of your credentials fall outside the policy. Non-fungible tokens fall outside it too. And Coinbase writes plainly that total losses may exceed insurance recoveries, so funds may still be at risk — an insurer's limit is a finite number, and a large enough incident runs past it.
Cash travels through an unrelated system. US dollar balances held as cash sit in pooled custodial accounts at FDIC-insured banks or NCUSIF-insured credit unions, structured so Coinbase can claim pass-through insurance for each customer up to the per-depositor limit, currently $250,000. That protection answers the failure of the bank holding the pooled account rather than trouble at Coinbase, and it depends on accurate records plus the determinations of the federal regulator acting as receiver. The institutions involved are named on the same page.
One account, then, carries two balances under two unrelated protection regimes. No marketing line reading “insured” preserves that distinction.
Kraken's answer: balances are not insured
Kraken took the opposite route and simply closed the question. Its support article on whether balances stored on Kraken are insured, last updated 31 March 2025, opens by stating that crypto exchanges do not qualify for deposit insurance programmes, an exchange being no kind of savings institution. It goes on to say that accounts and the crypto held in them are not covered by any insurance, nor by any deposit-insurance or investor-protection scheme anywhere.
The article continues: no security measure the platform provides can compensate for weak personal security. It then points at section 3.2 of the terms, where you accept responsibility for all activity under your account and bear the risk of authorised and unauthorised access alike, to the fullest extent the law allows.
Set beside the three pages above, that bluntness earns its place. It describes the real position of every account on every venue listed here, minus the narrow exceptions each platform spells out for itself.
The four backstops side by side
| Arrangement | What it exists to absorb | Who decides a payout | Stated ceiling or deadline |
|---|---|---|---|
| SAFU (Binance) | Credential compromise traced to a flaw in Binance's systems or security protocols | Binance, at full discretion over loss types and claims | Claims within 90 days of the loss; fund rebalanced to US$1bn should it fall under US$800m |
| Futures insurance fund (Binance, Bybit) | The gap between bankruptcy price and execution price on liquidated positions | Automatic; no claim exists to file | Maximum Takeover Capacity, a confidential multiple of the balance; then auto-deleveraging |
| Crime insurance policy (Coinbase) | Theft, including cybersecurity breaches, from a portion of stored digital currency | The insurer, under the policy wording | Recoveries may fall short of total losses; your own credential breach and NFTs excluded |
| Pass-through deposit insurance (Coinbase cash) | Failure of the bank or credit union holding the pooled custodial account | The federal regulator acting as receiver | $250,000 per depositor; contingent on accurate records; crypto excluded entirely |
Kraken occupies no row: its own help article says balances are not insured and fall outside every deposit-insurance and investor-protection scheme.
The losses none of the four absorb
Line the triggers up and a shape appears. A phishing page that harvests your password and your one-time code produces a loss caused by you, in the language of every document quoted above. A venue that stops processing withdrawals produces a loss none of these mechanisms addresses at all. Both outcomes are commoner than the platform-side breach SAFU describes.
Which puts the useful work elsewhere. Coins you rarely touch can live off the exchange, a trade-off laid out column by column in the custodial versus self-custody comparison. The account you do trade from has a set of switches whose coverage varies more than the marketing suggests; what each security control stops works through them one at a time, and the security settings checklist turns that into something you can run against your own account in a few minutes.
Worth keeping separate from all of this: proof of reserves. A reserve attestation addresses whether the coins exist right now; a backstop fund addresses what gets paid after something has gone wrong. Both can hold true at once, and neither substitutes for the other — the limits of the first are set out in what proof of reserves proves.
How this was checked
Every figure and quoted phrase above was read in 2026-10 from the pages below.
- Binance: Frequently Asked Questions on Secure Asset Fund for Users (SAFU) (published 2024-08-08, page updated 2026-02-02); Introduction to Futures Insurance Funds (page updated 2026-01-04)
- Bybit: Insurance Fund (page states last updated 2026-03-24)
- Coinbase: Insurance (the list of insured depository institutions on that page is marked as of May 2025)
- Kraken: Are balances stored on Kraken insured? (page states last updated 2025-03-31; the page served a localised edition of the same article, so the wording above is summarised rather than quoted)
Spotted a line that has gone stale? Tell us, and the change will appear in the corrections record.