A crypto exchange hack is a theft in which an attacker gets access to the coins an exchange holds for its customers. It usually happens one of three ways: the attacker steals the keys that control the wallets, exploits a flaw in the exchange's own software or processes, or tricks an insider into opening the door. The pattern repeats across incidents, which is why the history is worth learning.
The most important qualification: when an exchange is breached, customers can lose funds they cannot get back, because the exchange held the keys, not the customer. That is the core trade-off of leaving assets on a platform. Understanding how the breaches happen is the first step to judging how much risk you are carrying.
Where do the coins actually sit?
An exchange is a business that matches buyers and sellers. To make trading instant, it keeps customer assets in wallets it controls. These are called custodial wallets, and the exchange holds the private keys — the secret codes that move the money.
Exchanges split those holdings. A small share sits in "hot wallets" connected to the internet, ready for withdrawals. The larger share sits in "cold storage," keys kept offline. The split matters because hot wallets are the exposed surface: an attacker who reaches them can move funds immediately, while cold storage is only at risk if the keys or the people handling them are compromised.
Think of it like a farm stand and a locked barn — the analogy breaks down here, because a barn cannot be emptied from another continent in seconds. Hot wallets can be. That is the difference the technology adds.
What actually gets attacked?
Across documented incidents, the same targets show up again and again.
- Keys and signing systems. If an attacker obtains the keys, or corrupts the system that authorises movements of funds, the coins go. This is why key management is the centre of exchange security.
- Software flaws. A bug in the exchange's code, or in code it relies on, can let someone withdraw more than they deposited or bypass a check entirely.
- People. Spear phishing — targeted fake messages — and compromised employee accounts have repeatedly given attackers a foothold inside the company itself.
- Third parties. Vendors, payment processors, and partners connected to an exchange can be the weak link even when the exchange's own defences hold.
Notice what is missing from that list: the blockchain itself. In these breaches, the ledger does its job. The theft happens at the edges, where people and companies hold keys.
How does a typical breach unfold?
The sequence is usually less cinematic than the headlines suggest.
- An attacker studies the target for weeks or months, looking at staff, suppliers, and public code.
- They get one foothold — a phished credential, a malware infection, a misconfigured server.
- They move quietly, escalating access and learning how withdrawals are approved.
- They either drain the hot wallets directly or manipulate the approval process so a large transfer looks routine.
- The funds are moved out fast, often through mixers or smaller venues, which is why recovery is rare.
The speed of the final step is the part users feel. Once coins leave a custodial wallet, the exchange cannot simply reverse the transaction the way a bank might reverse a fraudulent transfer. Blockchain transfers are final by design.
What did the industry learn?
The repeated breaches pushed real changes, though none removed the risk entirely.
- More holdings moved into cold storage, with hot wallets kept to working balances.
- Withdrawal controls improved: address allowlists, delays on large withdrawals, and multiple people required to approve big moves.
- Proof of reserves — an exchange showing, with cryptographic evidence, that it controls the assets it claims — became a common demand after several collapses and breaches eroded trust.
- Security audits and bug bounty programmes, where researchers are paid to report flaws before criminals find them, became standard practice rather than a luxury.
Our analysis of the pattern is simple: the industry got better at the technical layer, and attackers shifted toward the human layer — phishing staff, abusing support processes, and targeting users directly. The weakest link keeps moving, which is why no exchange can honestly promise safety.
What this means for you as a customer
You cannot fix an exchange's key management. You can decide how much of your money is exposed to its failure.
- Treat an exchange account as a trading account, not a vault. Funds on an exchange are an IOU from the company.
- Use a strong, unique password and two-factor authentication — a password manager makes this practical, as explained in Password managers explained: why and how to switch.
- Lock down the account itself with the habits in how to secure a crypto exchange account.
- Know your exit plan if an account is compromised: the steps in what to do if your wallet is compromised apply to exchange accounts too.
Choosing a venue matters as well. General market guidance such as TradingView's cryptocurrency market FAQ advises researching a platform and evaluating risks before trading, and Crypto.com's own onboarding material directs new users to complete identity verification and to choose a heavily regulated, secure platform. Those are the vendors' claims about themselves, so weigh them accordingly — marketing is not an audit.
Finally, the honest framing: crypto assets can lose most or all of their value quickly, and exchange risk sits on top of that market risk. Self-custody removes exchange risk but adds its own — a lost seed phrase is a loss no support desk can undo. Neither option is risk-free; the question is which risks you are better equipped to manage.
The takeaway
Exchange hacks happen because keys, software, and people are attackable, and the assets they protect are portable and irreversible once moved. The historical patterns — stolen keys, exploited flaws, tricked insiders — have not disappeared. They have shaped better defences, from cold storage to withdrawal controls, but the responsibility left with the user is unchanged: limit what sits on any platform, secure the account you do keep there, and understand that recovery after a breach is the exception, not the rule.
