Crypto exchange security: lessons from the biggest hacks
Choosing an exchange is not only about fees and liquidity. Since 2011 users have lost tens of billions of dollars to exchange hacks, insolvencies and smart-contract exploits. This page collects the most important incidents, explains what proof of reserves can and cannot tell you, and gives a simple checklist you can apply to any platform in our Top 100 ranking.
The biggest exchange hacks and collapses
| Year | Platform | What happened | Approx. loss |
|---|---|---|---|
| 2014 | Mt. Gox | Long-running theft of bitcoin led to bankruptcy of the then-largest BTC exchange | ~850,000 BTC |
| 2016 | Bitfinex | Hot-wallet breach of multisig wallets | ~120,000 BTC |
| 2018 | Coincheck | NEM tokens stolen from an internet-connected hot wallet | ~$530M |
| 2019 | Binance | Hackers stole BTC using API keys and 2FA codes; covered by the SAFU fund | ~7,000 BTC |
| 2020 | KuCoin | Hot-wallet private keys compromised; most funds recovered | ~$280M |
| 2022 | FTX | Customer deposits misused; exchange collapsed and filed for bankruptcy | ~$8B shortfall |
| 2025 | Bybit | Attack on a multisig cold-wallet signing process; users fully reimbursed | ~$1.5B in ETH |
Figures are widely reported approximate values at the time of the incident and are provided for educational purposes.
What proof of reserves really means
Merkle-tree snapshot
The exchange publishes a cryptographic snapshot so each user can verify that their balance is included in the total liabilities.
On-chain wallets
Published wallet addresses let anyone check that the assets actually exist on the blockchain at the time of the snapshot.
Reserve ratio
A ratio above 100% means assets exceed customer balances for the audited coins. Check which coins are covered, not just the headline number.
The limitation
Proof of reserves is a point-in-time picture. It usually does not show all liabilities, loans or off-chain debts, so it is a signal, not a guarantee.
Security checklist for every trader
Use an authenticator app or security key
Avoid SMS 2FA where possible; SIM-swap attacks remain one of the most common ways accounts are taken over.
Enable withdrawal whitelist
Allow withdrawals only to addresses you have pre-approved, ideally with a time lock for new addresses.
Set an anti-phishing code
Most major exchanges let you add a personal code to every official email so fake messages are easy to spot.
Keep only trading funds on exchanges
Move long-term holdings to a hardware wallet. Not your keys, not your coins.
Review token approvals on DEXs
Revoke unlimited allowances you no longer need; many wallet drains come from old approvals, not from the DEX itself.
Prefer regulated or transparent venues
MiCA licenses, regular proof of reserves and public insurance funds all lower counterparty risk.
CEX risk vs DEX risk
Centralized exchanges
- Custodial risk: the platform holds your keys.
- Insolvency or misuse of customer funds.
- Account freezes and withdrawal limits.
- Usually offer insurance funds and customer support.
Decentralized exchanges
- Smart-contract bugs and oracle manipulation.
- Phishing sites and malicious approvals.
- Losing your seed phrase means losing your funds.
- No one can freeze your wallet, but no one can refund you either.
Frequently asked questions
Which crypto exchange has never been hacked?
Several large exchanges, such as Coinbase and Kraken, have never suffered a major hot-wallet breach of the platform itself, but individual user accounts can still be compromised through phishing. Past security is a signal, not a promise.
Does proof of reserves guarantee my funds are safe?
No. It shows that assets existed at a specific moment and that your balance was counted. It does not always include all liabilities, so combine it with regulation and track record.
Are DEXs safer than CEXs?
They remove custodial risk but add smart-contract and self-custody risk. Safety depends on how you manage keys and approvals.
What happens to my funds if an exchange goes bankrupt?
Customer assets may be frozen in bankruptcy proceedings for years and often only partially recovered. Keeping savings in self-custody avoids this risk.
Compare safer exchanges
See security-focused scores for 100 CEX and DEX platforms.