Two very different things get lumped together as “exchange risk”: a hack, where outsiders steal funds from a still-solvent exchange, and a collapse, where the exchange itself fails and customers become creditors in a bankruptcy. The distinction matters because it changes both how funds are lost and whether, and when, customers see them again.
Hacks are thefts; collapses are insolvencies
A hack is an external attack. The exchange usually continues to operate and may absorb the loss itself, as Bybit did after roughly $1.5 billion was stolen on February 21, 2025 — a theft the FBI attributed to North Korean “TraderTraitor” actors. A collapse is different. Mt. Gox, QuadrigaCX and FTX were not simply robbed; their customers became unsecured creditors who waited years for a partial return, if any. Treating a solvent-but-hacked exchange like a failing one, or the reverse, leads to the wrong decision in both directions.
The safety nets do not extend to crypto
In the United States, the two familiar backstops do not cover exchange balances. FDIC insurance protects deposits at insured banks, not crypto held by a company that merely resembles a bank. SIPC protects cash and securities at member brokerages against broker failure, and it explicitly does not protect digital asset securities that are unregistered investment contracts — even when held at a SIPC member firm. That gap is structural, not a matter of which exchange you pick.
What “insured” does and does not mean
Some exchanges run their own protection or insurance funds, but those are private arrangements with their own limits and terms, not a government guarantee. A promise to “cover all losses” is meaningful only to the extent the exchange remains able to pay. In a collapse, the same reserves that might have covered a hack may already be gone, and a customer claim is only as good as what remains in the estate.
Self-custody shifts the risk; it does not remove it
Coins held in a wallet the owner controls are not part of an exchange’s bankruptcy estate, which is why self-custody is so often recommended after a major failure. But the owner then carries the risk of lost or compromised keys, with no custodian to appeal to for a reset. The realistic choice is between counterparty risk and operational risk, not between risk and safety. A watch-only wallet can track those coins without exposing the keys.
How to read the next headline
When a large loss is reported, the useful questions are always the same. Was it a hack or a collapse? Who actually bears the loss, and is the assurance coming from the exchange itself or from an independent authority? If the exchange fails, are customer funds segregated or part of the bankruptcy estate? And if you hold a balance there, is it backed by anything other than the exchange’s promise? Those questions, not the size of the number in the headline, are what determine whether your funds come back.
Adapted from Biggest Crypto Exchange Hacks and Collapses of All Time.