Binance Hacked: What Are the Rules for Storing Customers' Crypto Assets in Indonesia?

Binance Hack in Q4 2026 again highlighted a crucial question for crypto owners: who controls the assets when balances are held on an exchange?

In its official update on October 30, 2026, Binance acknowledged the security incident and stated that the investigation is still ongoing, including examining the alleged compromise of work devices. 

In Indonesia, crypto asset storage regulations limit the amount of consumer assets that traders can hold themselves.

Understanding these divisions helps customers assess the protection available, as well as know its limits.

Key Takeaways

• Traders may only store a maximum of 30% of consumer assets themselves, the remainder is placed with the Storage Manager.

• Of the self-stored portion, a minimum of 70% uses cold storage and a maximum of 30% uses hot storage.

• The merchant's hot storage limit is equivalent to a maximum of 9% of the consumer's total assets, but not the maximum limit on possible losses.

What Lessons Does the Binance Hack Bring to Indonesian Customers?

Binance's explanation for the October 29 incident cited abuse of access to its internal transaction signing service.

Asset movements involve hot wallets, so the issue involves the authority to sign transactions, not just the theft of customer account passwords. 

The lesson for Indonesian readers is that crypto exchange security has multiple layers. Storage locations, employee access, transaction approvals, and the ability to stop suspicious activity all need to be assessed together.

Enabling two-factor authentication still helps protect personal accounts.

However, these steps do not replace securing the service provider's storage infrastructure.

Read Also: Binance Hack Chronology: Lazarus Group and the Largest Crypto Heist in History

What are the Rules for Crypto Asset Storage in Indonesia?

The basis isPOJK Number 27 of 2024, ofng has been in effect since January 10, 2025. 

This regulation was then amended through POJK Number 23 of 2025, an examination of the amendment document did not find a replacement for the provisions on storage division in Article 91. (source: https://ojk.go.id/id/regulation/Pages/POJK-27-2024-AKD-AK.aspx)

Article 91 limits consumer assets that are kept by traders to a maximum of30%, with the remainder required to be with the Storage Manager.

From the self-storage portion, at least 70% must be offline and maximum 30% daring.

The term “trader” is important because the applications commonly known as exchanges have a particular position in Indonesia’s trade structure.

These Indonesian crypto wallet regulations govern the obligations of organizers, not the allocation of personal wallets to each investor.

The Depository Manager is an OJK-licensed business entity with the functions of storing, maintaining, supervising, and/or handing over digital financial assets.

So, the institution has a different role from the application where customers enter orders.

Read Also:Binance Uses Half of SAFU's BTC Reserves, What Impact Will This Have on Users?

Why is the Hot Wallet Limit Called a Maximum of 9%?

Number 9%is the result of multiplying two limits:30% × 30%. 

The denominator is total assets consumers, while the second limit applies to the portion kept by the trader himself.

The following illustration uses total consumer assets worth IDR 100 billion.

This is an example calculation, not a report of a specific platform's storage composition.

If the trader stores less than 30% himself, the nominal limit for hot storage also decreases.

Thus, 9% is the upper limit based on the maximum self-storage portion scenario.

The figure also does not show the composition of the wallets in the Storage Manager.

Concluding that the entire ecosystem only has 9% of hot wallets would go beyond the scope of this calculation.

Read Also:PEPE and UNI Purchased by Wallet Allegedly Linked to Binance Hack

Does Cold Storage Guarantee Assets Cannot Be Stolen?

Cold storage reduces storage connectivity to the internet.

Hot storage supports online operational needs, so both have different functions and risk exposures. 

However, the cold storage percentage alone does not explain who approved the asset transfer.

Based on the incident mechanism explained by Binance, the security of the signing process also determines whether unauthorized instructions can be executed.

Therefore, crypto asset storage limits should not be read as a guarantee that losses will definitely stop at 9%.

Access disruptions, operational errors, or other system compromises require separate assessments.

Want to have exposure to American stocks? Register at Bittime and start investing through tokenized stocks.

How Are Crypto Asset Consumer Protections Implemented?

Article 91 requires traders to maintain security and be responsible for the loss of consumer assets that they store.

These assets must be recorded separately and may not be used for the benefit of the trader without the consumer's permission. 

The obligation provides a basis for accountability, but does not explain that every incident automatically resolves with immediate reimbursement.

Customers need to keep records of balances, transactions and complaint communications.

Check the name of the business entity and its permit status through OJK sources, then read the storage and incident handling policies.

To get to know the transaction services, you can register at Bittime while reviewing the terms of service before depositing assets.

Bittime is a licensed and regulated Digital Financial Asset Trader (PAKD) supervised by Indonesia’s Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from just Rp10,000. The registration process is fast, secure, and you can get started today.

Track USDT to IDR conversions and monitor your favorite crypto assets in real time. Everything is available in one crypto investment app that you can download for free on the Play Store

Ready to start? Register now on Bittime and execute your investment strategy with a platform trusted by millions of users in Indonesia.

FAQ

What is the maximum amount of customer assets that a trader is allowed to keep for himself?

Maximum 30% of the consumer's total digital financial assets, with the remainder placed with the Depository Manager.

Are all customer assets required to be stored in a cold wallet?

No. Article 91 regulates the division of cold and hot storage into portions stored by traders themselves.

Does the 9% hot wallet limit apply to every customer account?

This figure is the result of a calculation of the consumer's total assets, not the individual distribution provisions for each account.

Does the rule limit storage in personal wallets?

Article 91 regulates merchants. Self-storage has different key ownership and user responsibilities.

Does OJK's permit guarantee that the exchange is hack-free?

Permissions are not proof of immunity from attack. Compliance, access control, and operational security still need to work together.