Will Binance give me back my crypto if someone got into my account and withdrew it? Only if the access happened through a failure of the exchange itself, because Regulation (EU) 2023/1114, known as MiCA, makes a provider that holds crypto-assets in custody liable for those lost through an incident attributable to it, up to their market value at the time of the loss. If the intruder came in with your own credentials, obtained through a fake email, a duplicate of your SIM card or an infected phone, the platform is not liable, and what remains is to freeze the funds at the exchange where they have landed before they move again and to open criminal proceedings. The bank is liable for the euro balance and the charges on your card, not for the cryptocurrency.
I take it in parts, because the answer changes depending on where the crypto was held, how they got in and what the stolen assets have been turned into.
Shutting the door and keeping the trail, what depends only on you this afternoon
Whoever emptied your account usually keeps access for hours, and in that time moves whatever is left, changes the recovery details and deletes the alerts. Everything that follows is done from a device other than the one you suspect is compromised.
Change the password of the email account linked to the exchange or the wallet and check for forwarding rules, recovery addresses or open sessions you do not recognise, because the email is what resets everything else. If the platform lets you freeze or disable the account, do it, and report the incident through its official channel keeping the ticket number. If you held crypto in a self-custody wallet and the seed phrase may have been exposed, whatever is left goes to a new wallet created on a clean device, and the old one is never used again. If the linked card or your bank account shows movements you did not make, call the bank and block it. If your phone suddenly lost signal a few hours earlier, call your mobile operator, because that is the sign of a SIM swap.
Evidence is almost always lost through cleaning up. Do not wipe the phone or the computer, do not delete the login alert emails, the text messages with codes or the messages from the supposed support team. Take screenshots with the date visible of the transaction history, the destination addresses, the transaction identifiers (the TXID or hash) and the withdrawal confirmation emails. That identifier is what allows the money to be followed on the blockchain and it is the first thing the court will ask for.
Do not hire anyone who writes to you, or appears in an advert, offering to trace and recover the crypto for an upfront fee. That is the second scam, aimed at whoever has just suffered the first. For technical guidance you have INCIBE’s 017 helpline, free of charge, which does not replace the criminal complaint.
Your phone, your Hotmail account or Discord was hacked, and from there the exchange account
Cryptocurrency is almost never stolen by attacking the blockchain. It is stolen by coming in through one of these doors, and which one it was decides the legal answer.
A SIM swap means someone obtains from your operator a new card with your number. Your phone loses signal and the SMS codes from the exchange and the email account start reaching the attacker, who thereby empties accounts protected with text verification. If they got into your Hotmail, Outlook or Gmail account, they do not need the exchange password, because they reset it from there. On Discord and Telegram, where crypto communities gather, it is common for a profile carrying the platform’s name and logo to message you privately to “verify the account” or “resolve a block” and lead you to a website imitating the real one, when no platform ever asks for a wallet’s seed phrase and no genuine support team messages you first. Infected devices add their own variant, programs that read the clipboard and swap the destination address for the attacker’s, fake wallet apps downloaded outside the official stores or tampered browser extensions. Then there is the poisoned signature, in wallets connected to decentralised applications, where approving a transaction that looks ordinary is enough to grant a contract unlimited permission over your tokens. Nobody stole your key, you signed.
Hence the first distinction. If the exchange held the crypto in custody for you and the breach was its own, it is liable. If they came in with your credentials through any of those routes, in principle it is not. And if the crypto was in a self-custody wallet, no third party was holding it and recovery depends entirely on following the trail.
What MiCA requires of Binance, Coinbase or any exchange holding your crypto in custody
Regulation (EU) 2023/1114 on markets in crypto-assets has applied to crypto-asset service providers since 30 December 2024, and in Spain, with the transitional period over, anyone offering custody has to be authorised, with the CNMV as the competent authority. Before MiCA the only filter was the Bank of Spain’s register of exchange and custody providers, in which Law 10/2010 on the prevention of money laundering required these operators to enrol when it listed them as obliged entities in its article 2.1.z). Checking whether the platform where you held your money is authorised is the first fact that matters, because it determines whether there is someone against whom the regulation can be enforced.
Two articles concern you. Article 70 requires the provider to keep clients’ crypto-assets segregated from its own, protected against its own creditors. Article 75 governs custody and administration on behalf of clients and provides that the provider is liable to the client for the loss of crypto-assets, or of the means of access to them, resulting from an incident attributable to it, capped at the market value of the crypto-asset at the time of the loss. Incidents are not attributable to it where it demonstrates that they occurred independently of the provision of the service or of its operations, such as a failure inherent in the blockchain itself.
The case turns on the word “attributable”. An intrusion into the exchange’s systems, an employee leaking data, a failure in the credential reset process or a withdrawal that its detection systems should have stopped fall on the custodian’s side. A phishing email in which you typed in your password and code falls on yours. Between the two there is a wide zone, because many thefts combine a user error with a provider weakness, for example a change of recovery email approved with no waiting period and followed by a full withdrawal to a new address. If the exchange had to notify a security breach to the data protection authority, an obligation the General Data Protection Regulation imposes on any controller, that fact points to an incident of its own.
Platforms have their own compensation policies, some with internal funds they advertise for breach cases. These are voluntary and apply on their terms. Liability under article 75 does not depend on the platform’s willingness to accept it, and clauses in its terms of use excluding it do not remove it. How the evidence that the incident was attributable to the exchange is built is the lawyer’s work.
The bank refunds euros, not cryptocurrency
The second half of the question has a shorter answer. Crypto-assets held in custody are not legal tender, and the payment services rules, the ones that oblige the bank to refund transactions the customer did not authorise, do not reach them. They reach everything that in your case was money.
| What was taken from you | Who is liable | Basis |
|---|---|---|
| Crypto held in custody at the exchange, access through a platform failure | The exchange, up to market value at the time of the loss | Article 75 of the MiCA Regulation |
| Crypto held in custody, access with your credentials (phishing, SIM swap, malware) | The exchange is not liable unless a weakness of its own is proven; what remains is the freeze and criminal proceedings | Article 75 of the MiCA Regulation, non-attributable incident |
| Crypto in a self-custody wallet | Nobody but the perpetrator; recovery by tracing and freezing at the destination exchange | Criminal Code and precautionary measures under the Criminal Procedure Act |
| Euro balance inside the platform | The payment service provider, as an unauthorised transaction | Payment services rules |
| Card charges or transfers from your bank ordered by the attacker | The bank, as an unauthorised transaction | Payment services rules |
The euro balance you held inside the platform is money, and the duty to refund an unauthorised transaction falls on whoever managed it. The same goes for the linked card the attacker used to buy crypto from your account, or the transfer ordered from your online banking after taking over your email. Once the euros were converted into crypto and withdrawn, that leg stops being a payment transaction and is recovered, if at all, through the freeze and criminal proceedings.
The line works the other way too. If it was you who transferred money to a platform because a supposed adviser persuaded you to invest and you then could not withdraw it, that is an investment scam and not an unauthorised transaction, and the bank is not liable merely because you were deceived. I deal with it in the article on getting a bank refund after phishing. How the claim for unauthorised transactions is put to the bank is part of the lawyer’s brief.
Once what was lost is sorted into those three drawers is when the firm takes the matter on, because the three claims are prepared together and on the same evidence, and on the banking fraud page I explain what we do in each.
Following the money on the blockchain and stopping it before it moves again
The blockchain is public, and that is the only thing working in your favour. Every movement from the address your crypto went to is recorded for anyone to see. The problem is pace. Whoever steals crypto splits it, routes it through several chains and finally brings it to an exchange to convert it into euros or dollars, because a cryptocurrency he cannot spend is useless to him. That exit exchange is the point where the money can be stopped.
Since 30 December 2024 Regulation (EU) 2023/1113 has required transfers of crypto-assets between providers to carry the originator’s and beneficiary’s details, like a bank transfer. Law 10/2010, by making exchanges obliged entities for anti-money-laundering purposes, requires them to identify their customers. When stolen crypto enters a regulated platform, behind that account there is a name, an identity document and a history the court can request.
The investigating court may order, among the first measures entrusted to it by article 13 of the Criminal Procedure Act to secure evidence and protect the injured parties, and as a precautionary measure to secure pecuniary liability under articles 589 and following of the same Act, that the destination exchange be instructed to freeze the funds and disclose the account holder’s identity. Platforms authorised in the European Union comply with those orders. Those operating from jurisdictions with no cooperation with Spain, sometimes and late.
Speed decides the outcome. A freeze requested in the first days finds the money and one requested a month later finds an empty account. That is why the tracing and the request to the court do not wait for the police to finish their investigation, and why the complaint filed on day one has to carry the transaction identifiers and the destination addresses.
Breaking into your account and emptying it, articles 197 bis, 248 and 264 of the Criminal Code
What has been done to you fits several offences at once.
Accessing your exchange account, your email or your wallet without authorisation and defeating its security measures is the offence of unlawful access to a computer system under article 197 bis of the Criminal Code, punishable with six months to two years’ imprisonment. It exists even if nothing was taken, and I develop it in the article on a hacked business Instagram account and the ransom demand. If they also seized your emails to prepare the attack, article 197.1 comes in, discovery and disclosure of secrets, with one to four years’ imprisonment and a fine of twelve to twenty-four months.
Withdrawing the crypto is computer fraud under article 248.2.a), which punishes anyone who, for gain and by means of computer manipulation or a similar device, achieves a non-consented transfer of any patrimonial asset to another’s detriment. Cryptocurrency is a patrimonial asset for these purposes. The penalty, under article 249, is six months to three years’ imprisonment where the amount defrauded exceeds 400 euros. If the value taken exceeds 50,000 euros, or the act affects a large number of people, article 250.1 raises it to one to six years’ imprisonment and a fine of six to twelve months, and above 250,000 euros article 250.2 places it between four and eight years’ imprisonment. The value is set at the exchange rate at the time of the theft.
Changing your recovery email, disabling your authentication or locking you out of your own account is, in addition, the offence of computer damage under article 264, which punishes with six months to three years’ imprisonment anyone who, without authorisation and seriously, deletes, alters, suppresses or renders inaccessible another’s computer data.
That the perpetrator is unidentified or abroad does not change the classification. It changes the prospects of a conviction, and explains why criminal proceedings matter in these matters above all for what they allow to be frozen and for the civil liability they carry once someone is identified, even if only the holder of the destination account.
Reporting in A Coruña a theft that left through a server on another continent
The complaint is filed with the National Police, the Guardia Civil or directly with the duty investigating court. The competent court is that of the place where you suffered the loss, because the Supreme Court applies to offences committed over the internet the ubiquity doctrine, under which the offence is deemed committed in every place where any element of it took place, and the financial loss is one of them. That the exchange’s server is in Ireland or Malta, or that the perpetrator operates from another continent, does not oblige you to report there.
There are two reasons for a lawyer to draft that complaint rather than you dictating it at a police station. A complaint that does not identify the transactions, the addresses and the exchanges involved sits in a drawer, because the cybercrime unit has to reconstruct what you already know. And the freeze request is not something the police make on their own, it has to be asked of the court, with the complaint or immediately afterwards, and asking badly or late amounts to not asking.
The limitation periods under article 131 of the Criminal Code are generous. Unlawful access and basic fraud are time-barred after five years, and aggravated fraud under articles 250.1 and 250.2 after ten. What runs against you is the money, which dissipates within weeks.
When the perpetrator is not identified, the court usually orders a provisional dismissal, a shelving that is reopened if new information appears. In crypto thefts it appears often, because destination addresses cross-match with those of other victims, in Spain or abroad, and an arrest in another investigation drags yours along. Meanwhile, the claim against the exchange under article 75 of MiCA and the claim against the bank follow their own course and do not depend on there being a convicted person.
It is also worth saying when it is not worth it. If the amount is a few hundred euros, the trail ends in a crypto mixer and there was no failure attributable to the platform and no euro charges, the complaint must still be filed, because it feeds the investigations that cross-match addresses, but instructing a lawyer to pursue the claim makes no economic sense. If the sum is significant, the trail reaches an identifiable exchange or the platform had something to do with it, it does.
Your exchange account used as a stopover for other victims’ money
Whoever robbed you needs accounts to move and cash out the money, and yours, while he controlled it, may have served to receive and forward other victims’ crypto. If the police detect that traffic, the first name that comes up is yours, and the complaint filed in time is what shows that traffic was not yours.
The risk is greater in the reverse case. If someone asked for your Binance account or your wallet to “receive a payment and forward it” in exchange for a commission, you have acted as a mule. Article 301 of the Criminal Code punishes money laundering with six months to six years’ imprisonment and a fine of one to three times the value of the assets, and its paragraph 3 punishes the gross negligence form, that of the person who did not know but should have suspected, with six months to two years’ imprisonment. The criminal defence of anyone appearing as holder of a pass-through account is exercised from the first police summons, and that person should not attend to give a statement alone.
Frequently asked questions
How do I know if my phone has been hacked?
The clearest sign is suddenly losing signal, with no network fault, because it indicates a SIM swap. Others are login emails from devices you do not recognise, verification codes arriving without you requesting them, apps you did not install, abnormal battery or data use and, in wallets, destination addresses that change when pasted. If you see any of these, act from another device.
My WhatsApp has been hacked, what can I do?
Re-register your number on WhatsApp from your phone, which expels the intruder, and switch on two-step verification. If your phone lost signal, call your operator first, because the WhatsApp attack is usually the first step of a SIM swap that later empties the exchange. Warn your contacts, who will be asked for money or crypto in your name, and keep the messages.
Where and how exactly do I file the complaint in Spain and what should I bring?
At any National Police station, Guardia Civil post or duty court, regardless of where the exchange is based. Bring your ID, the screenshots of the transaction history with the TXIDs, the destination addresses, the emails and text messages from the attack, the ticket opened with the platform and, if there are charges, the bank statement. Drafted by a lawyer, the complaint already includes the freeze request.
The freeze request to the court, the step to take now and who takes it
With the screenshots taken and the account frozen, what has to happen today is for a lawyer to file the complaint with the transaction identifiers and ask the court to order the freeze at the exchange where the crypto has landed, and for the same brief to raise the custodian’s liability under MiCA and the refund of the euros by the bank. At the firm we act for the defence and the prosecution in cybercrime cases and we handle that brief from day one. You can write to us through the contact page or call +34 677 841 007. We reply as promptly as we can.