Wondering why a seemingly reputable exchange can lose millions of dollars in a single attack? This article explains how exchange hacks work, what the different types of wallets are, and what steps you can take to keep your crypto safe while still earning online.
What an exchange hack actually is
When you buy or store cryptocurrency on an exchange, the platform holds the assets on its behalf. Most of the time the exchange keeps the bulk of user funds in hot wallets—online accounts that are connected to the internet so that deposits, withdrawals, and trades can be processed instantly. Because hot wallets are always reachable, they are also the easiest target for attackers.
In contrast, a cold wallet stores private keys offline, often on a hardware device or paper. Cold storage is far less vulnerable to remote attacks, but it also slows down the ability to move funds quickly, which is why exchanges typically keep only a fraction of total assets in cold storage and the rest in hot wallets.
Hackers look for ways to gain access to the private keys that control a hot wallet. Common methods include phishing employees, exploiting software vulnerabilities, compromising API keys, or using social engineering to trick staff into approving a transaction. Once the attacker controls a wallet, they can initiate standard blockchain transfers—no smart‑contract tricks required—to move the assets to addresses they control.
Real‑world illustration: the Mercado Bitcoin breach
On 2 November 2026, Brazil’s exchange Mercado Bitcoin announced a security incident that resulted in more than $46 million worth of cryptocurrency being drained from its wallets. The company immediately paused deposits and withdrawals, but the attackers continued to move funds for several hours after the suspension.
Security analysis from Certik’s senior engineer Dickson Wu showed that the breach began with “small chains” on layer‑2 networks such as Base, Optimism, and Arbitrum. After four hours the attackers shifted to the exchange’s main hot wallets, funneling tiny amounts of Ether (ETH) from over 27 000 different addresses. Thousands of micro‑transfers were then consolidated into a single address, a pattern typical of money‑laundering tactics on blockchain.
By 4:42 pm UTC, stablecoin issuers Tether and Circle had frozen about $6.2 million of the stolen assets. Roughly $20 million had already been moved to newly created wallets, while the remaining $20 million stayed in addresses linked to the exchange, including all 106 BTC that were initially taken.
What this means for you
If you keep your crypto on an exchange, you are trusting the platform’s security practices. A breach can happen even when the exchange publicly states that “customer funds and data are safe.” While many exchanges have insurance or compensation policies, there is no universal guarantee that you will be made whole.
For users who earn passive income through staking, cloud mining, or other platform‑based rewards, a hack can abruptly halt payouts and potentially expose your earned tokens to loss. The risk is especially acute for smaller, regional exchanges that may lack the extensive security teams of global players.
How to evaluate an exchange’s security
- Hot‑vs‑cold storage ratio: Reputable platforms disclose what percentage of assets is kept in cold storage. The higher the cold‑storage share, the lower the exposure to online attacks.
- Multi‑signature (multisig) wallets: These require multiple private keys to approve a transaction, adding a layer of protection against a single compromised key.
- Regular security audits: Look for third‑party audit reports from firms such as Certik, Trail of Bits, or Quantstamp. Audits should cover both smart‑contract code and the exchange’s infrastructure.
- Incident response plan: An exchange should have a clear protocol for freezing withdrawals, notifying users, and working with law‑enforcement and stablecoin issuers after a breach.
- Insurance or compensation fund: Some platforms maintain a reserve to cover user losses. Verify the terms and any caps on coverage.
- Regulatory compliance: Exchanges operating under strict data‑protection and financial regulations (e.g., Brazil’s LGPD) are more likely to maintain robust security standards.
FAQ
What’s the difference between a hot wallet and a cold wallet?
A hot wallet is an online account that can send and receive transactions instantly, making it convenient for trading but vulnerable to hacks. A cold wallet stores private keys offline, protecting them from remote attacks but requiring extra steps to move funds.
Can I completely avoid risk by keeping my crypto in a personal wallet?
Storing crypto in a personal hardware wallet eliminates exchange risk, but you become solely responsible for safeguarding the seed phrase. Losing that phrase means permanent loss of access.
How do stablecoin issuers freeze stolen funds?
Issuers like Tether and Circle can blacklist specific blockchain addresses, preventing further transfers of their tokens from those addresses. This is why a portion of the stolen assets in the Mercado Bitcoin case was frozen.
What should I do if an exchange I use announces a hack?
First, stop all deposits and withdrawals. Move any remaining funds to a personal cold wallet if possible. Monitor the exchange’s communications for updates on asset recovery and check whether they offer compensation or insurance.
This article references reporting from cointelegraph.com.
