Ever wonder why some crypto exchanges get hacked even though they claim to protect your private keys? This article explains the common ways exchanges are compromised, how “spoofed transfers” work, and what steps you can take to protect your assets.
The plain explanation
When you keep cryptocurrency on an exchange, you are trusting the platform to manage two things: custody of the coins and the transaction system that moves them. Custody means the exchange holds the private keys that control the coins. The transaction system is the software that processes deposits, withdrawals, and internal transfers.
Most users assume that if an exchange never exposes private keys, the funds are safe. In reality, the security of an exchange also depends on how it authenticates and validates transfer requests. A spoofed transfer is a fraudulent request that appears legitimate to the exchange’s internal systems. If the platform’s controls are weak, the spoofed request can be processed, moving funds out of user accounts without the owners’ consent.
Typical attack vectors include:
- Phishing or credential theft: attackers obtain employee or admin login details and act from inside the organization.
- Insider collusion: a staff member with privileged access helps the hacker bypass checks.
- API abuse: poorly secured application programming interfaces (APIs) allow unauthorized commands.
- Spoofed or forged transaction data: attackers manipulate the data that tells the exchange “User X wants to withdraw Y coins,” making it look authentic.
Once a fraudulent transfer is approved, the coins are usually moved to a hot wallet—a wallet that is online and ready for quick withdrawals. From there, the funds can be quickly sent to a series of mixing services or other exchanges, making it hard to trace.
A real example
In March 2026, the crypto exchange Bitget disclosed that a hack affected $352 million in user funds. According to CEO Gray Chen, the breach was not the result of stolen private keys but rather “spoofed transfers” that fooled the platform’s internal controls. The attackers managed to create transfer requests that appeared legitimate, prompting the system to move large amounts of cryptocurrency to external addresses. Bitget later assured users that the affected funds were “safe,” meaning they had been recovered or compensated, but the incident highlighted how even exchanges that protect private keys can be vulnerable.
What it means for you
If you keep crypto on an exchange, you are exposed to three main risks:
- Operational risk: mistakes or weaknesses in the exchange’s internal processes can lead to loss of funds, even without a breach of private keys.
- Counterparty risk: the exchange itself might become insolvent or be unable to reimburse users after a large hack.
- Regulatory risk: authorities may intervene after a hack, potentially freezing assets or imposing restrictions.
Understanding that security is not just about private keys helps you make smarter decisions about where to store your assets. Diversifying between self‑custody (holding your own private keys) and reputable platforms can reduce exposure.
What to check / how to judge
- Cold‑storage practices: Does the exchange keep the majority of assets in offline wallets that are never connected to the internet?
- Multi‑signature controls: Are withdrawals approved by multiple independent keys or personnel, making a single compromised account insufficient?
- Audit transparency: Does the platform publish regular third‑party security audits or proof‑of‑reserves reports?
- API security: Are API keys limited by IP address, withdrawal limits, and two‑factor authentication?
- Incident response plan: Has the exchange demonstrated a clear process for handling hacks, including user communication and compensation?
FAQ
What’s the difference between a hot wallet and a cold wallet?
A hot wallet is connected to the internet and used for quick transactions, making it convenient but more vulnerable. A cold wallet is offline, typically stored on hardware devices or paper, and is far less exposed to hacking.
Can I trust an exchange that says my funds are “safe” after a hack?
“Safe” usually means the exchange has either recovered the stolen assets or plans to reimburse users. While this is a positive sign, you should still evaluate the platform’s overall security practices before deciding to keep large balances there.
How does two‑factor authentication (2FA) protect against spoofed transfers?
2FA adds a second verification step, such as a code from an authenticator app, which makes it harder for attackers to approve fraudulent withdrawal requests. However, if the spoofed request bypasses the 2FA step through internal system manipulation, the protection is limited, so broader operational security is also essential.
Should I move all my crypto to a personal wallet?
Self‑custody eliminates exchange counterparty risk, but it requires you to securely manage private keys. Many users keep a portion in a personal wallet for long‑term holding and use exchanges only for trading or liquidity, balancing convenience with security.
This article references reporting from coindesk.com.
