Most people don't get where their funds actually sit on exchanges.

Here's the reality:

Exchanges keep the bulk of user assets in cold wallets — completely offline. Only a fraction lives in hot wallets (online) to handle withdrawals and daily ops.

The attacker drained the hot wallets.

Binance confirmed: the exchange eats the loss, not users.

This is why cold storage matters. Hot wallets are the attack surface. Always has been.