Wondering why your crypto holdings can disappear from an exchange and what you can do to keep them safe? This article explains the mechanics behind exchange hacks, the typical vulnerabilities exploited, and practical steps you can take to protect your assets.
What an exchange hack actually is
A crypto exchange is a platform that holds users’ digital assets and facilitates buying, selling, and transferring. When a hacker gains unauthorized access to the exchange’s systems, they can move funds out of users’ wallets without permission. The most common attack vectors include:
- Phishing and credential theft: Attackers trick employees or users into revealing login details.
- Software vulnerabilities: Bugs in the exchange’s code or in third‑party services can be exploited to bypass security checks.
- Insider threats: Employees with privileged access may misuse their rights.
- Compromised private keys: If an exchange stores private keys (the cryptographic passwords that control assets) in an insecure manner, those keys can be stolen.
Once the attacker has control, they can initiate withdrawals to addresses they control. Because blockchain transactions are irreversible, the stolen funds cannot be reclaimed by the exchange.
Real‑world illustration
In November 2022, a major Brazilian exchange reported that a hack had been contained. However, a later investigation found that the same attacker continued to siphon funds for several hours after the initial containment claim. The attacker managed to steal roughly $391,000, primarily from wallets linked to BitMart, as identified by blockchain analytics firm Bitquery. The founder of BitMart confirmed the breach on November 2 and suspected a connection between the two incidents.
What this means for you
If you keep your crypto on an exchange, you are trusting the platform with the private keys that control your assets. A successful hack can result in a total loss of the funds stored there, regardless of how reputable the exchange appears. Even if an exchange quickly announces that an attack is “contained,” the damage may already be done, as the BitMart case shows.
How to evaluate an exchange’s security
Before depositing large amounts, consider the following checks:
- Custody model: Does the exchange hold funds in cold storage (offline wallets) or hot wallets (online, more vulnerable)? A higher proportion of cold storage is generally safer.
- Regulatory compliance: Is the exchange registered with relevant financial authorities and subject to audits?
- Security certifications: Look for third‑party audits, bug bounty programs, and certifications such as ISO 27001.
- Transparency reports: Does the exchange publish regular security updates, incident response plans, and proof of reserves?
- Two‑factor authentication (2FA): Mandatory 2FA for withdrawals adds an extra layer of protection.
- Withdrawal limits: Daily or per‑transaction caps can limit the amount an attacker can move in a single breach.
FAQ
Can I recover funds after an exchange hack?
Because blockchain transactions are final, recovering stolen crypto is extremely difficult. Some exchanges may reimburse users from insurance funds, but this depends on the platform’s policies and available reserves.
Is keeping crypto in a hardware wallet safer than using an exchange?
Yes. A hardware wallet stores your private keys offline, making them inaccessible to remote attackers. You retain full control, but you also assume responsibility for securely backing up the recovery seed.
What is a “cold wallet” and why does it matter?
A cold wallet is an offline storage method for private keys, often a hardware device or paper backup. Since it is not connected to the internet, it is far less vulnerable to hacking attempts compared to “hot wallets,” which reside on servers that are online.
Should I enable withdrawal whitelists?
Withdrawal whitelists allow you to specify approved addresses for outgoing transfers. Enabling this feature means that even if a hacker obtains your credentials, they cannot move funds to an unapproved address without your explicit approval.
This article references reporting from coindesk.com.
