Wondering why your crypto holdings can disappear from an exchange overnight? This article explains the mechanics behind exchange hacks, the common vulnerabilities attackers exploit, and what you can do to keep your assets safe.
The plain explanation
An exchange is a platform that holds users’ cryptocurrencies in wallets that it controls. When you deposit, the exchange creates an internal ledger entry rather than moving coins on the blockchain each time. This convenience means the exchange holds large pools of private keys—digital passwords that unlock the coins. If an attacker gains access to those keys, they can move the funds to their own addresses.
There are three broad ways a hack can occur:
- Software vulnerabilities. Flaws in the exchange’s code—such as unchecked inputs, outdated libraries, or misconfigured APIs—can let attackers inject malicious commands.
- Insider threats. Employees with privileged access may steal keys or manipulate the system, either deliberately or through negligence.
- Social engineering and credential theft. Phishing emails, fake login pages, or credential stuffing attacks can give criminals the usernames and passwords needed to breach admin accounts.
Once inside, attackers typically move the stolen crypto through a series of rapid transactions, often using mixing services or multiple wallets to obscure the trail. Because blockchain transactions are irreversible, the exchange must bear the loss unless it can recover the funds through legal channels.
A real example
In March 2026, Binance—one of the world’s largest cryptocurrency exchanges—was hit by a suspected security breach that resulted in an estimated $6.3 billion worth of Bitcoin and Ether being transferred out of its hot wallets. The incident coincided with a separate exploit on the prediction‑market platform Polymarket, causing both Bitcoin and Ether prices to tumble. Analysts at Standard Chartered warned that the market could stay under pressure while confidence rebuilds.
What it means for you
If you keep your crypto on an exchange, you are trusting that the platform’s security measures are robust enough to protect the private keys that control your assets. A successful hack can lead to total loss of the deposited funds, regardless of how much you have diversified across other assets. Even large, well‑funded exchanges are not immune, so it’s crucial to treat any on‑exchange balance as a custodial service rather than ownership.
What to check / how to judge
- Cold‑storage ratio. Find out what percentage of the exchange’s assets are kept in offline “cold wallets” that are not connected to the internet. A higher cold‑storage share generally reduces exposure to remote attacks.
- Security audits. Look for publicly available third‑party audits of the exchange’s smart contracts, APIs, and overall architecture. Regular audits indicate a proactive security posture.
- Multi‑factor authentication (MFA). Ensure the platform requires MFA for both user logins and especially for any administrative actions. The more layers of verification, the harder it is for stolen credentials to be useful.
- Insurance or compensation policies. Some exchanges offer coverage for losses due to hacks. Review the terms to understand what is covered and any claim procedures.
- Withdrawal limits and withdrawal whitelists. Platforms that let you set daily limits or restrict withdrawals to pre‑approved addresses add an extra barrier for attackers.
FAQ
Can I completely avoid risk by using a hardware wallet?
Storing crypto in a hardware wallet you control eliminates the exchange’s custodial risk. However, you must protect the device and its recovery phrase; loss or theft of those can also result in loss of funds.
What’s the difference between a “hot wallet” and a “cold wallet”?
A hot wallet is connected to the internet and used for frequent transactions, making it more convenient but also more vulnerable. A cold wallet is offline, typically a hardware device or paper backup, and is used for long‑term storage.
If an exchange gets hacked, can I get my money back?
Recovery depends on the exchange’s insurance, legal actions, and the ability to trace the stolen coins. In many cases, users receive partial compensation, but there is no guarantee of full restitution.
Should I keep a small amount on an exchange for trading and move the rest to cold storage?
That is a common strategy. Keep only the amount you need for active trading in the exchange’s hot wallet, and transfer the remainder to a personal cold wallet where you control the private keys.
This article references reporting from coindesk.com.
