When Binance chief Changpeng Zhao highlighted new loss figures from analyst Willy Woo, the crypto community braced for a showdown: are centralized exchanges (CEXs) truly safer than self‑custody? Woo’s data, drawn from River’s 2025 industry report, shows 1.57 million BTC lost through self‑custody versus 1.51 million BTC lost on exchanges – a gap of just 60,000 BTC. Zhao argues that the raw numbers hide a reporting bias that makes exchange hacks appear more dramatic than private‑wallet mishaps.
Exchange breaches are high‑visibility events. A single hack can dominate headlines, prompting journalists, researchers and regulators to track the incident meticulously. By contrast, self‑custody losses – forgotten passwords, lost private keys, or damaged hardware wallets – rarely surface in public databases. Zhao notes that many of these incidents go unreported, suggesting the true scale of self‑custody loss is likely under‑stated.
The structural insight here is the asymmetry in loss reporting. Exchanges operate under regulatory scrutiny and must disclose breaches, while individual users lack a collective reporting mechanism. This creates a data gap that skews risk perception. Moreover, some exchange‑side losses stem from platforms that have ceased operations, such as BitMEX, which shut down in July after an eleven‑year run, further complicating the comparison.
Beyond the numbers, Zhao highlighted Binance’s Secure Asset Fund for Users (SAFU), now bolstered by a $1 billion Bitcoin reserve. The fund’s purpose is to reimburse users affected by CEX‑related breaches, a safety net that self‑custody offers no comparable guarantee. This insurance model is a tangible benefit for institutions that prioritize custodial services, reinforcing why many hedge funds and corporate treasuries continue to allocate a portion of their crypto exposure to reputable exchanges.
Market reaction to the debate has been muted but telling. Institutional investors, who often cite custody risk as a key factor, have shown a modest uptick in exchange‑based exposure over the past quarter, according to on‑chain analytics firm Glassnode. The shift reflects a preference for the operational resilience and insurance mechanisms that large CEXs provide, especially as regulatory frameworks tighten across the United States and Europe.
Real‑world implications surfaced this month when a Coldcard hardware wallet vulnerability allowed an attacker to drain BTC from users in minutes, costing one victim $1.6 million despite following best‑practice security steps. Zhao used the incident to caution that no private‑wallet setup guarantees absolute protection, reinforcing his broader point that risk tolerance, not a binary safety ranking, should drive custody decisions.
While Zhao stopped short of endorsing exchanges over private wallets, his framing pushes the conversation toward risk management strategies. For retail users, the choice may hinge on convenience and the perceived safety net of exchange insurance. For institutions, the decision often involves compliance, auditability and the ability to quickly recover assets after a breach.
Looking ahead, the industry’s hack tracking data shows a 50 % rise in incident count during the first half of 2026, even as the total value stolen has declined. This suggests that while attacks are becoming more frequent, their financial impact is being mitigated – possibly due to better security practices on both exchanges and hardware wallets, as well as the growing presence of compensation funds.
In sum, the debate over custody is less about a clear‑cut safety hierarchy and more about how losses are recorded, compensated, and perceived by market participants. As Bitcoin trades near $60,347, a modest 1.2 % rise over 24 hours, the underlying custody discussion will continue to shape both retail behavior and institutional allocation strategies.
