Crypto exchange hacked or withdrawals paused: what to do

If a crypto exchange was hacked or paused withdrawals, your first move is not to follow a link in a text message. Find out which part of your transaction is stopped, preserve evidence, and read the exchange's official updates. A balance displayed in an account is not proof that the assets can already be withdrawn. And a withdrawal request without a transaction ID may not yet have reached a blockchain.

A precautionary pause may end without customer losses. It may also last longer than expected. There is no universal reopening deadline or recovery guarantee. While the exchange controls the custody wallet's keys, it controls when withdrawals can resume. You can prepare your next move without rushing into a scam disguised as customer support.

What should you do right now?

1. Open the app or type the official website address yourself. Ignore unsolicited links, sponsored search results, and social-media accounts claiming to offer priority help.
2. Check whether the pause affects your account, your asset, a network, or the whole platform. One reopened network does not mean every token on it is withdrawable.
3. Save your account statement, balance, support case and error message, including dates and times. Keep personal details out of public posts.
4. If you requested a withdrawal, look for a TXID, the transaction identifier. Without one, ask the exchange for the order's status. With one, check the appropriate network explorer.
5. Do not send funds to an address provided by supposed support. A “verification wallet” is not a normal recovery step.

If the warning concerns a takeover of your personal account, rather than an incident at the exchange, the priorities change. Contact official support to secure access, change credentials, review sessions and two-factor authentication, and preserve evidence before deleting alerts.

Does the balance on a hacked exchange mean my crypto is safe?

The balance is the exchange's record of what it owes you. It is not the same as a confirmed transaction in a wallet you control. During an incident, a company may continue showing balances while pausing withdrawals to investigate and replenish assets. The screen alone cannot tell you whether withdrawal infrastructure is ready or when it will be.

In an October 30, 2026 statement, Binance said its hot wallets had been compromised the day before, with an estimated US$6.3 billion loss in tokens. Binance said it would absorb the impact using its SAFU fund and corporate resources, but paused withdrawals for security checks. On November 5, withdrawals were still reopening by asset and network. That is a company's dated commitment and service status, not a general guarantee for every exchange.

Mercado Bitcoin said on November 4 it planned to restore website access gradually starting November 9, initially for viewing balances and statements. Transfers, withdrawals, and trading would return after further security checks. It said it would replenish affected assets from its own resources. As of November 5, access to a balance would still not mean access to a withdrawal.

These examples show why the official status for your asset and network matters more than a headline declaring that withdrawals are back.

Do reserve proofs, segregation rules, or deposit insurance protect me?

These are different forms of evidence or protection, not interchangeable promises.

• Asset segregation means separating customer assets from a provider's own assets. Brazil's BCB Resolution 520/2025 sets requirements for providers within its scope, including segregation and proof-of-reserves mechanisms. It is not insurance against every loss and does not guarantee a quick reopening.
• Proof of reserves aims to show that a provider holds assets it says it holds for customers. Check the method, snapshot date, and covered assets. A reserve snapshot does not, by itself, answer every question about liabilities, operational controls, or solvency.
• Brazil's FGC deposit guarantee applies to specified financial instruments at member institutions under its rules. Crypto held on an exchange is not an FGC-covered bank deposit merely because the interface displays a fiat value.

A company's pledge to use its own money to make customers whole is separate again. Read the official announcement and watch for execution. Do not mistake a pledge, reserve proof, or segregation requirement for compensation already delivered.

My withdrawal is pending. Where did it stop?

A TXID splits the investigation in two. If the order says “under review” and has no TXID, it may still be inside the exchange. Check the in-app history and support case. Ask official support for the order's specific state; do not submit the same withdrawal repeatedly without understanding what happened.

If there is a TXID, you have an identifier to inspect on the corresponding blockchain. Check network, asset, destination, and confirmations in the right explorer. A TXID alone is not proof that the receiving platform credited your account. Some receivers wait for confirmations or only accept a particular token on that network. Save the explorer link for support.

If you chose the wrong network, do not try to “fix” it by sending more funds. Recovery depends on who controls the destination address and the network used. Read our guide to sending crypto on the wrong network (in Portuguese) before taking another step.

How to withdraw safely when services resume

Do not turn a reopening into a race. A rushed transfer to the wrong address can be irreversible. Use a short sequence:

1. Confirm the asset-and-network pair on the withdrawal screen. Reopening may be phased and its status can change.
2. Choose a destination whose custody model you understand. A self-custody software wallet, hardware wallet, or another institution may fit. Self-custody removes some exchange dependency but makes you responsible for access, security, and recovery. Our exchange-versus-wallet guide (in Portuguese) explains the trade-off.
3. Copy the receiving address from the destination app and verify the asset and network at both ends. Recheck even saved addresses. If you are moving Bitcoin, see how to withdraw BTC from an exchange (in Portuguese). A 0x address is not a Bitcoin mainnet address.
4. Consider a small test transfer if it exceeds the minimum withdrawal amount and the fee is reasonable. Wait for confirmation and credit at the destination before sending the rest.
5. Record the TXID and the fee shown before approval. Network and exchange fees vary; use the current quote in the withdrawal screen.

For USDT, the network is particularly important. Our Binance-to-wallet USDT guide (in Portuguese) shows the checks on both sides. Picnic can receive crypto into a wallet under your control, but only use an asset-and-network combination currently offered on its deposit screen. Do not assume any token on any network is supported.

How do you spot fake support after an exchange hack?

Scammers copy exchange branding, buy search ads, and promise “priority release,” “wallet verification,” or “compensation.” In its November 4 update, Mercado Bitcoin explicitly warned that it does not request codes, passwords, photos, or deposits through WhatsApp, email, social media, or phone calls.

Never share a password, authentication code, private key, or seed phrase. Never connect your wallet to a website suggested by an unsolicited message. If you have signed something suspicious, stop interacting, preserve evidence, and seek help through official channels. Our guide to crypto scams in Brazil (in Portuguese) explains how a malicious approval can drain even a wallet protected by a strong login.

What if the exchange does not give a useful answer?

File a specific request through official support. Include the asset, network, amount, date, order number, and the outcome you seek. Save case numbers and announcements. Ask whether the withdrawal was broadcast, whether a TXID exists, and what timeline the company currently provides. Do not treat that timeline as guaranteed.

In Brazil, check whether the company participates in Consumidor.gov.br; participating companies have up to ten days to respond there. Consumer-protection bodies or independent legal advice may also be appropriate. There is no universal “wait X hours” rule for every incident.

The next decision is about custody, not panic. Once transfers are actually available, verify the network, make a proportionate test, and only then move the amount you planned. If you want to understand the model first, start with what self-custody means (in Portuguese). Picnic's passkey wallet lets you keep control of your assets without writing down a seed phrase, but you still need to verify transactions and protect your access.

---

Picnic is a technology platform that lets users independently interact with USDC, a U.S. dollar-pegged stablecoin issued by Circle, on public blockchains. USDC is not legal tender in Brazil.

Displayed exchange rates vary with market conditions. The final applicable amount is the one shown on the transaction confirmation screen. Cryptoassets involve risks, including volatility and loss of peg.

Picnic does not custody user assets and is neither a financial institution nor a virtual asset service provider. Sending and receiving U.S. dollar payments through a U.S. account is offered in partnership with Noah Savings Inc. Terms and conditions apply.

Information verified in April 2026.