Exchange Security: What Happens When a Crypto Exchange Is Hacked

Exchange hacks have been part of crypto’s history since its earliest years, and they remain one of the biggest risks of leaving funds in a custodial account. This guide explains the general mechanics of how exchange compromises typically happen, what tends to happen afterward, and what it means for your own funds — without describing any specific incident’s unverified details.

How exchanges typically get compromised

Common attack vectors include theft of private keys controlling an exchange’s hot wallet (the internet-connected wallet used for day-to-day withdrawals), exploitation of a software vulnerability in the exchange’s own systems or in a connected smart contract (particularly relevant for cross-chain bridges), social engineering targeting employees with privileged access, and insider threats from someone with legitimate internal access misusing it. Large, well-run exchanges invest heavily in defenses against all of these, but no defense is absolute, which is a core reason security-conscious users limit how much they leave on any single platform. Diversifying across a small number of well-established, licensed platforms, rather than concentrating everything on one, is a common risk-management practice among more active traders for this exact reason.

Hot wallets vs cold storage, from the exchange’s side

Reputable exchanges typically keep only a small portion of total customer funds in hot wallets needed for processing withdrawals quickly, with the large majority held in cold storage — offline, air-gapped systems designed to be extremely difficult to access remotely. This structure limits the maximum exposure from a hot-wallet compromise, though it doesn’t eliminate risk entirely, since cold storage security still depends on the exchange’s internal processes and personnel being sound, and moving funds from cold to hot storage to process withdrawals is itself a moment of operational risk.

What typically happens after a hack is discovered

Exchanges commonly halt deposits and withdrawals as an immediate containment step once a breach is detected, to prevent further loss while investigating scope. A forensic investigation follows, often involving outside security firms and, for larger incidents, law enforcement agencies like the FBI or Secret Service, since crypto theft can constitute wire fraud and other federal crimes. Investigations into major thefts can take months or years, and blockchain analysis firms are sometimes able to trace stolen funds even when full recovery isn’t possible. Public disclosure timing and detail vary, and regulatory reporting obligations may also apply depending on the exchange’s licensing and the jurisdictions involved.

Do customers get reimbursed?

There’s no universal answer. Some exchanges maintain internal insurance funds or reserves specifically intended to cover customer losses from a hack, and some have historically absorbed losses to make affected customers whole. Others have not been able to fully reimburse customers, particularly if the loss was large relative to the exchange’s own resources. Crypto held on an exchange is not FDIC or SIPC insured, so any reimbursement in the event of a hack depends entirely on that specific platform’s own policies, reserves, and, if it becomes insolvent, the outcome of a bankruptcy process rather than a government-backed guarantee. This is one of the most important practical differences between a crypto exchange account and a traditional bank or brokerage account for most consumers.

Proof of reserves: a partial transparency tool

In response to past exchange failures, some platforms have adopted “proof of reserves” practices, publishing cryptographic evidence that they hold assets backing customer balances. This can provide some assurance that an exchange isn’t operating with a shortfall at a given point in time, but it’s a snapshot, not a continuous guarantee, and different proof-of-reserves implementations vary in rigor — some independently audited, others self-reported. It’s a useful signal to look for, not a substitute for understanding an exchange’s overall licensing and security track record. Proof of reserves also typically covers assets, not liabilities in detail, so it can leave open questions about an exchange’s broader financial health even when the specific reserve snapshot looks solid.

Bridges: a recurring weak point

Cross-chain bridges, which let assets move between different blockchains, have historically been a frequent target because they often hold large pooled reserves secured by a relatively small set of validating parties or a smart contract with a large attack surface. A bridge exploit is technically distinct from a direct exchange hack, but the practical effect on end users can look similar: assets locked in the bridge become inaccessible or are stolen outright. This is one of the reasons some security-conscious users are cautious about moving assets across chains through bridges they haven’t specifically researched, preferring native assets and well-established, audited paths over convenience shortcuts.

Why “not your keys, not your coins” is the recurring lesson

Nearly every major exchange compromise in crypto’s history has reinforced the same underlying lesson: funds held by a third party are only as safe as that party’s security practices, solvency, and internal controls, none of which an individual customer can fully verify or control. This doesn’t mean custodial exchanges are inherently unsafe to use for their intended purpose — buying, selling, and active trading — but it’s a strong argument for not treating an exchange account as a long-term vault for funds you don’t need liquid, a distinction our custodial vs self-custody guide covers in more detail.

How to reduce your own exposure

The most direct way to eliminate exchange hack risk to your own funds is to withdraw crypto you don’t need for active trading to a self-custody wallet you control, covered in our custodial vs self-custody guide. For funds you do keep on an exchange, favor platforms that are properly licensed (see our state licensing guide), publish proof-of-reserves data, and have a track record of transparent incident response, and enable the strongest available account security, covered in our wallet security guide.

Frequently asked questions

Is my crypto insured on a US exchange the way a bank deposit is?

No. Crypto itself is not FDIC or SIPC insured on any exchange, licensed or not. Some platforms hold cash balances in FDIC-insured partner bank accounts, but that generally covers cash, not crypto assets.

Does a licensed exchange guarantee it can’t be hacked?

No. Licensing establishes regulatory oversight, capital requirements, and accountability, but it doesn’t make any platform immune to a security breach. It does generally mean more established security and compliance obligations than an unlicensed platform.

What should I do immediately if I suspect my exchange account was compromised?

Contact the exchange’s official support channel directly (not a number or link from an unsolicited message), change your password and review account security settings from a trusted device, and enable or reset two-factor authentication using an authenticator app rather than SMS if you haven’t already.

Are cross-chain bridges as safe as a regular exchange?

Not necessarily. Bridges have historically been a frequent target for exploits due to concentrated reserves and complex smart-contract attack surfaces, so moving significant funds through an unfamiliar bridge deserves extra research and caution.