FDIC Insured Crypto Exchange? What That Promise Actually Covers

Score: real insurance, wrong failure. When an exchange says "FDIC insured," the fine print almost always means your U.S. dollars might be covered if the exchange's partner bank goes under. It does not cover your crypto. It does not cover the exchange getting hacked. It does not cover the exchange itself going broke — which is how crypto users actually lose money.

"Not your keys, not your crypto" is the old warning. This week it got a live test: on October 29, 2026, attackers moved roughly $6.3 billion out of Binance wallets in about twenty minutes, the biggest crypto theft on record (Reuters, October 30, 2026). Binance users were not rescued by any government insurance. Binance said it would cover losses from its own funds. That is the whole lesson of this post in one event: when an exchange bleeds, the thing standing between you and zero is the exchange's own balance sheet — not three letters from Washington.

But the marketing keeps leaning on those three letters — in big type. The limits show up in small type, if at all. So let's read the small type, from the FDIC itself.

What FDIC insurance actually is

The FDIC is a U.S. agency that insures deposits at FDIC-insured banks. If the bank fails, depositors get back up to $250,000 per depositor, per insured bank, per ownership category, interest included. Checking, savings, money market deposit accounts, and CDs count. That is the entire product.

Here is what it is not. The FDIC's own consumer page lists what deposit insurance does not cover, and the list includes stocks, bonds, mutual funds, annuities — and crypto assets, explicitly, even if you bought them through a bank. The FDIC said it again in its July 29, 2022 fact sheet on crypto companies: deposit insurance protects bank depositors if an insured bank fails; it "does not apply upon the failure of a non-bank, such as a crypto company," and it does not protect non-deposit products "such as stocks, bonds, mutual funds, securities, commodities, or crypto assets."

Read that sentence the way a lawyer wrote it, because one did. Two separate walls:

1. The asset wall. Crypto is never a deposit, so crypto is never insured. Full stop.
2. The failure wall. Even for plain U.S. dollars, the trigger is the bank failing. Not the app. Not the exchange. The bank.

Pass-through insurance: the one real mechanism

So why do exchanges mention the FDIC at all? Because some really do park customer dollars at real banks, and a real mechanism exists to cover those dollars: pass-through insurance — narrower than the ads suggest.

When you send dollars to a U.S. exchange, you are usually not a customer of any bank. The exchange pools everyone's cash into one big custodial (omnibus) account at a partner bank — Coinbase's help pages describe accounts titled, in effect, "Coinbase Inc. FBO its customers" (FBO = "for the benefit of"). Pass-through insurance is the FDIC looking through that account and treating each customer as a depositor for their share, up to $250,000 each.

For that look-through to work, federal rules (12 CFR 330.5 and 330.7) require three things:

• The money must actually be on deposit at the insured bank. Not in transit, not lent out, not parked in Treasuries by the platform.
• The bank's records must show the account is held in a custodial or agency capacity — the FBO titling, not the exchange's own corporate money.
• The records must identify the real owners and their shares — kept by the bank or by the platform "in good faith and in the regular course of business."

Miss those conditions and the look-through collapses: the FDIC can treat the whole pool as one deposit belonging to the exchange, insured for $250,000 total, split among everyone.

And even when every condition is met, remember the failure wall. Pass-through coverage pays if the partner bank fails. If the exchange fails while the bank is fine, the FDIC pays nothing — your dollars come back through the exchange's own process or its bankruptcy, because legally they were never lost. Whether that process is fast or fair is a different question, and 2022 answered it the hard way (see Voyager, below).

The $10,000 test

Say you keep $10,000 in USD and $40,000 in bitcoin on a U.S. exchange that uses pass-through banking.

• The partner bank fails. Your $10,000 of cash is eligible for pass-through coverage, up to the limits, if the records are good. Your bitcoin: not a deposit, not covered, and also not at the bank at all.
• The exchange is hacked. FDIC pays $0 on both. Coverage was never triggered.
• The exchange goes insolvent. FDIC pays $0 on both. You are in the bankruptcy line.
• Your stablecoins depeg. FDIC pays $0. USDC and USDT are not deposits — and under the GENIUS Act (signed July 18, 2025), payment stablecoins are by law not deposits and not FDIC-insured, even with 1:1 reserves in cash and short-term Treasuries. Reserves are a promise structure, not insurance.

One more trap inside the "good" scenario: the cap is per bank, not per app. Hold $180,000 in your own account at a bank where your exchange also parks custodial cash, and your balances stack against one $250,000 limit. Coinbase's disclosures warn about exactly this.

What fails	Your USD cash at the exchange	Your crypto at the exchange
Partner bank fails	Eligible — pass-through up to $250,000, if titling and records meet 12 CFR 330.5/330.7	No
Exchange is hacked	No	No
Exchange goes insolvent	No	No
Stablecoin depegs	No (stablecoins are not deposits)	No

They were warned — in writing, repeatedly

None of this is a gray area the industry stumbled into. The FDIC spent 2022 telling crypto firms, in public, to stop implying otherwise.

• July 28, 2022 — The FDIC and the Federal Reserve jointly ordered Voyager Digital to cease and desist from false or misleading statements about its deposit insurance status. Voyager had told customers their funds were protected. Voyager was already in bankruptcy by then.
• July 29, 2022 — The FDIC published a fact sheet, "What the Public Needs to Know About FDIC Deposit Insurance and Crypto Companies," with an advisory to banks (FIL-35-2022), spelling out that insurance covers bank failure only and never crypto assets.
• August 19, 2022 — Cease-and-desist letters to five companies, including FTX US, after its president tweeted that employer direct deposits were "stored in individually FDIC-insured bank accounts in the users' names." The tweet was deleted. Three months later FTX collapsed — and deposit insurance paid no one, because no insured bank had failed.
• February 15, 2023 — Letters to four more entities, including exchange CEX.IO and sites reviewing it, over fine print claiming wallet dollars were "FDIC-insured up to $250,000 per account."
• March 27, 2023 — A letter to a neobank that had suggested, in English and Spanish, that FDIC insurance would protect customers' crypto assets. The FDIC's reply, in substance: we do not insure crypto assets.

Then the rule caught up with the letters. The FDIC's amended Part 328 rules (final rule December 20, 2023; effective April 1, 2024; full compliance January 1, 2025) say a non-bank talking about deposit insurance must disclose that it is not an FDIC-insured bank, that insurance covers only the failure of the insured bank, and which bank holds the deposits. Crypto assets were written into the definition of non-deposit products — the things that are not insured. That rule is why the careful platforms' fine print now behaves (next section). The FDIC's March 28, 2025 guidance (FIL-7-2025) later let supervised banks do crypto business without prior notice — a permission change, not an insurance change. The coverage rules are unchanged today. Checked October 30, 2026.

Voyager: the day it didn't pay

Voyager Digital is the cleanest test case this question will ever get, because Voyager did the thing right on paper: customer dollars sat in an omnibus account for the benefit of customers at Metropolitan Commercial Bank — an actual FDIC-insured bank. If pass-through insurance were the shield the marketing implied, Voyager customers should have been fine.

Voyager filed for Chapter 11 on July 5, 2022, after crypto hedge fund Three Arrows Capital defaulted on a loan of more than $650 million from Voyager. Withdrawals froze. And the FDIC paid Voyager customers exactly $0 — correctly, under its own rules. Metropolitan Commercial Bank never failed. The bank said so itself, in words worth reading twice: FDIC insurance "does not protect against the failure of Voyager, any act or omission of Voyager or its employees, or the loss in value of cryptocurrency or other assets."

What customers actually got came from the bankruptcy court, months and years later: an initial distribution of about 35.72% of each allowed claim in 2023, and a second of about 34.28% starting July 31, 2024 — roughly 70% of the allowed claim in total, valued as of the bankruptcy date, for those who received both rounds. Slow, partial, and run by lawyers — not by deposit insurance. That is the honest picture of "FDIC insured" at a failing crypto platform: the insurance sat untouched in the vault, because the wrong building burned down.

Has pass-through coverage ever paid crypto customers? We could not find a case. No major crypto partner bank has failed, so the mechanism is untested at crypto scale — real insurance against an event that has not happened, attached to the part of your balance (idle USD) that is usually the smallest.

What the big platforms' own fine print says today

Checked on their official pages, October 30, 2026:

Coinbase — the most complete disclosure of the group. Its U.S. user agreement (updated October 21, 2026) says USD held as cash sits in pooled custodial accounts at FDIC-insured banks or NCUSIF-insured credit unions, arranged for pass-through insurance up to $250,000 — contingent on correct customer information, accurate records, and the regulator's determination at receivership. The same agreement says Coinbase may instead place cash in U.S. Treasuries or government money market funds — not deposits, not FDIC-insured — and states plainly: "Coinbase is not an FDIC-insured bank." Crypto is covered only by its private crime insurance, which "protects a portion of digital currencies held across our storage systems against losses from theft, including cybersecurity breaches" — and does not cover losses from someone getting into your account with your credentials.

Crypto.com — admirably blunt once you reach the security page: U.S. users' USD is held at Community Federal Savings Bank or other FDIC-insured network banks, insured up to $250,000 "but only in the event the respective FDIC member fails," and "FDIC insurance does not protect your funds in the event of Crypto.com's failure or from the risk of theft or fraud."

Gemini — its support page says U.S. dollars "may be held" at Western Alliance Bank, Cross River Bank, Customers Bank, and State Street Bank "and thus may be eligible for FDIC 'pass-through' insurance, subject to applicable limitations." Note the two "may"s. That is the legally accurate way to say it, and it is a long way from the word "insured" standing alone in an ad.

Kraken — the edge case. Kraken Financial is an actual bank — a Wyoming Special Purpose Depository Institution (SPDI), full-reserve, not allowed to lend deposits out. But a charter is not insurance. Its own disclosure: "Kraken Financial is not an FDIC-insured bank and deposits are neither insured by nor subject to the protections of the FDIC." SPDIs substitute 100% reserves for insurance. Different shield, same lesson: read the mechanism, not the label.

One genuine exception deserves one line: a token that is legally a bank deposit — like SoFi Bank's tokenized deposit (SOFIE, launched October 22, 2026), where each token represents $1 on deposit at the FDIC-insured bank itself — can be eligible for deposit insurance within the usual limits. The protection follows the legal status (a deposit at an insured bank), never the token wrapper.

What actually protects you — ranked honestly

1. Your own keys, for anything sized like savings. Self-custody removes the exchange-failure column from the table entirely. It swaps in your own operational risk — seed phrases, inheritance, mistakes — real risk, but yours, not a stranger's balance sheet. Our rundown of what happens when keys aren't yours: Not Your Keys, Not Your Crypto.

2. Segregation and verifiable 1:1 backing. Customer assets held 1:1, never lent without your explicit instruction, with proof of reserves you can check your own balance against. No guarantee — reserves are a snapshot and liabilities are the hard half — but commingling is how exchange failures become customer losses, and this is the direct counter.

3. The exchange's own balance sheet and emergency funds. When Binance was hit for ~$6.3 billion this week, users were covered by Binance's money, including its ~$1 billion Secure Asset Fund for Users (SAFU, held in bitcoin, per Binance in 2026 — even the industry's flagship fund was a fraction of this one loss). Public companies like Coinbase also publish audited financials. This layer is discretionary, but historically it is the layer that has actually paid.

4. Private crime insurance. Real, but partial: it covers a portion of crypto in the platform's storage against theft and breaches, has a limit platforms generally don't publish, and excludes the most common loss of all — someone draining your account with your login. A tiebreaker between platforms, not a guarantee.

5. Pass-through FDIC coverage on idle USD. Real insurance, wrong risk. It covers the least likely actor to fail (a regulated U.S. bank), only for cash the platform chose to hold as bank deposits (not Treasuries), only up to $250,000 shared with your own accounts at that bank, and only with clean records. Keep idle USD small and it barely matters either way — which is rather the point.

The pattern: protection tracks who holds the asset and what legal claim you have, not which logos appear in the marketing. "FDIC insured" on an exchange is a true statement about a side pocket of your balance, marketed like it covers the whole account. It insures the vault across the street. Your money is in this one.

Get posts like this by email: Subscribe to BogusAPY

Check it yourself: links and sources

Every figure and quote above was checked against these on October 30, 2026:

• FDIC, "The Importance of Deposit Insurance and Understanding Your Coverage" — the $250,000 limit and the not-covered list, crypto assets included: https://www.fdic.gov/resources/consumers/consumer-news/2022-08.html
• FDIC press release, July 29, 2022, "FDIC Issues a Fact Sheet to the Public on FDIC Deposit Insurance and Crypto Companies" (with FIL-35-2022): https://www.fdic.gov/news/press-releases/2022/pr22058.html
• Pass-through conditions, 12 CFR 330.5 and 330.7 (summarized in the FDIC/agency joint statement on third-party deposit arrangements): https://creditunionregulatoryguidance.transistor.fm/episodes/joint-statement-on-banks-arrangements-with-third-parties-to-deliver-bank-deposit-products-and-services/transcript
• FDIC, final rule amending Part 328 (December 20, 2023), FIL-65-2023: https://www.fdic.gov/news/financial-institution-letters/2023/fil23065.html
• FDIC cease-and-desist letters, August 19, 2022 (FTX US and four others) — FDIC press release as reported: https://www.clearyenforcementwatch.com/2022/08/fdic-issues-cease-and-desist-letters-to-companies-for-crypto-related-representations-about-deposit-insurance/
• FDIC letter to CEX.IO, February 15, 2023: https://cointelegraph.com/news/fdic-warns-cex-io-and-its-reviewers-to-remove-potentially-false-claims-about-insurance
• FDIC letter to a neobank, March 27, 2023: https://infobytes.orrick.com/2023-03-30/fdic-orders-neobank-stop-fraudulent-deposit-insurance-representations/
• Metropolitan Commercial Bank, FDIC coverage statement for Voyager customers (the "does not protect against the failure of Voyager" language): https://slashdot.org/comments.pl?sid=21672676&cid=62678512
• Voyager bankruptcy distributions (35.72% initial; 34.28% second, from July 31, 2024; ~70% cumulative of allowed claims): https://boxmining.com/voyager-digital-bankrupt-victim-of-the-three-arrows-capital-collapse/
• Coinbase U.S. User Agreement (updated October 21, 2026), USD wallet and pass-through terms: https://www.coinbase.com/legal/user_agreement/united_states
• Coinbase, "How is U.S. Dollar cash stored at Coinbase?" (FBO titling, partner institutions): https://help.coinbase.com/en/coinbase/other-topics/other/client-cash
• Coinbase Insurance page (crime insurance scope and exclusions): https://www.coinbase.com/en-br/legal/insurance
• Crypto.com Security page (USD network-bank disclosure): https://crypto.com/id/security/
• Gemini Support, "Are my funds insured?": https://support.gemini.com/hc/en-us/articles/205823016-Are-my-funds-insured
• Kraken, kBTC page footer disclosure ("Kraken Financial is not an FDIC-insured bank…"): https://www.kraken.com/kbtc
• GENIUS Act — payment stablecoins are not deposits and are not FDIC-insured; 1:1 reserve requirements (House Financial Services section-by-section): https://financialservices.house.gov/uploadedfiles/2025-07-10_--_sbs_floor_genius_final.pdf
• OCC final GENIUS Act rule, October 21, 2026; Act and rule effective January 18, 2027 (summary): https://phemex.com/blogs/occ-finalizes-genius-act-stablecoin-rules-2027-changes
• Binance hack (~$6.3B) and SAFU (~$1 billion, in bitcoin, per Binance), Reuters, October 30, 2026: https://www.reuters.com/legal/litigation/binances-63-billion-hack-how-crypto-insurance-works-2026-10-30/
• Companion post: Not Your Keys, Not Your Crypto — https://www.bogusapy.com/2026/10/not-your-keys-not-your-crypto.html

Not financial advice.