CoinFeeHub reference
Exchange hacks 2022–2026: what happened to users’ money
Most large exchange losses since 2022 came from stolen keys or compromised internal access, not from customers’ own passwords. In three of the seven cases below (Bitget, Bybit, BingX) the exchange said it covered customer balances from its own reserves; WazirX customers recovered part of their claims through a restructuring, and FTX was a fraud case, not a hack. Losing an account to a stolen login is a separate risk, covered in the account-takeover guide.
Seven cases, 2022–2026
| Date | Exchange | Loss | How it happened | Were customers made whole? | Source |
|---|---|---|---|---|---|
| 2026-09-24 | Bitget | ≈ $388M | Zero-day in a third-party security product led to internal credentials; withdrawals were sent across 11 chains | Bitget: account balances unaffected; its Protection Fund covers the loss. Withdrawals reopened in phases, 28 Sep – 2 Oct 2026 | Bitget 2026-09-26; The Hacker News 2026-10-01 (secondary) |
| 2025-02-21 | Bybit | $1.46B in ETH and ETH tokens | A cold-wallet multisig transfer was approved through a manipulated Safe{Wallet} interface. The FBI attributed it to North Korea’s “TraderTraitor” on 2025-02-26 | Bybit said yes: client assets were 1:1 backed, withdrawals stayed open and the ETH gap was closed within about 72 hours | Bybit timeline 2025-03-03; FBI IC3 2025-02-26 |
| 2025-05-15 | Coinbase | No wallet theft; Coinbase estimated $180–400M in costs | Bribed overseas support agents leaked customer data (names, addresses, ID images, balances), later used to impersonate Coinbase. A $20M ransom demand was refused | Coinbase said it will reimburse customers tricked into sending funds to the attackers | Coinbase 2025-05-15; SEC 8-K 2025-05-14 |
| 2024-09-20 | BingX | ≈ $43M (later reports ≈ $52M) | Abnormal outflows from hot wallets | BingX said losses would be covered from its reserves; main withdrawals resumed on 2024-09-21 | The Block 2024-09-20; Cointelegraph 2024-09-20 (both secondary) |
| 2024-05 | DMM Bitcoin | 4,502.9 BTC (≈ $308M) | A wallet-software supplier was compromised through a fake recruiter; a legitimate transaction was then manipulated. FBI, DC3 and Japan’s National Police Agency attributed it to TraderTraitor | Not stated in the FBI release | FBI 2024-12-23 |
| 2024-07-18 | WazirX | ≈ $235M | Multisig wallet compromise | Partly. A court-sanctioned restructuring distributed about 85% of rebalanced net liquid assets in late October 2025 — not 85% of each user’s original balance; the remainder is tracked through recovery tokens | Outlook Money 2026-01-10 (secondary) |
| 2022-11 | FTX | Customer deposits | Not a hack: customer funds were misappropriated. Sam Bankman-Fried was sentenced to 25 years | Handled through bankruptcy, outside the scope of this page | U.S. DOJ 2024-03-28 |
Theft totals by year
| Period | Stolen | What stands out | Source |
|---|---|---|---|
| 2022 | $3.8B | The record year for thefts from crypto businesses | Chainalysis 2023-02-01 |
| 2024 | ≈ $2.2B | Private-key compromises were the largest share (43.8%); DMM Bitcoin was the largest single case | Chainalysis 2024-12-19 |
| 2025 | > $3.4B | North Korea-linked actors took $2.02B and were behind 76% of service compromises, in Chainalysis’s terms; Bybit alone ≈ $1.5B. Personal-wallet thefts: $713M across 158,000 incidents | Chainalysis 2025-12-18 |
| H1 2026 | $972M | 207 incidents, a record count, with lower total losses (TRM Labs figures) | Crowdfund Insider 2026-07-02 (secondary) |
What this means for your own account
Two different risks
Custodial risk: the exchange itself loses funds. You cannot prevent it; you can limit how much sits on an exchange and check how the exchange says it would cover a loss. A protection fund or 1:1 backing statement is the exchange’s own commitment, not insurance.
Account-takeover risk: someone signs in as you and withdraws. This is the part you control, and exchanges generally treat it as your loss.
What to do this week
- Turn on an authenticator app or passkey, an anti-phishing code and a withdrawal whitelist — see the 8-exchange setup matrix.
- Learn the six takeover patterns — how exchange accounts get stolen.
- Save the first-hour response plan before you need it.
Taiwan context
Taiwan’s Legislative Yuan passed the Virtual Asset Services Act on 2026-06-30. It moves providers from registration to Financial Supervisory Commission licensing, expected from 2027 at the earliest, with up to two years for existing registered providers to apply (TechNews, secondary). This page does not establish any platform’s licence status; check FSC notices for MAX or offshore exchanges.
Common questions
Did Bybit customers lose money in the 2025 hack?
Bybit said client assets were 1:1 backed, kept withdrawals open and closed the ETH gap within about 72 hours through loans, deposits and purchases (Bybit timeline, 2025-03-03).
Is a protection fund the same as insurance?
No. It is a reserve the exchange controls, and payouts are its decision. Bitget said its Protection Fund covered the September 2026 incident.
Would 2FA have stopped these hacks?
No. These were exchange-side compromises. 2FA protects your own login, which is the account-takeover risk.
Was FTX a hack?
No. The U.S. Department of Justice case was fraud and misappropriation of customer funds; Sam Bankman-Fried was sentenced to 25 years on 2024-03-28.
Sources and editorial notes
Sources checked 2026-10-07. Exchange and government pages are primary; news reports are marked secondary. Amounts are in US dollars at the time reported. No investment advice.
- Bitget · Withdrawals resume in phases · 2026-09-26
- The Hacker News · Bitget confirms third-party zero-day · 2026-10-01 (secondary)
- Bybit · Security incident timeline · 2025-03-03
- FBI IC3 · PSA I-022625-PSA on the Bybit theft · 2025-02-26
- Coinbase · Standing up to extortionists · 2025-05-15
- SEC · Coinbase Form 8-K · 2025-05-14
- The Block · BingX exploit · 2024-09-20 (secondary)
- Cointelegraph · BingX resumes withdrawals · 2024-09-20 (secondary)
- FBI · DMM Bitcoin attribution · 2024-12-23
- Outlook Money · WazirX recovery distribution · 2026-01-10 (secondary)
- U.S. DOJ · Bankman-Fried sentenced · 2024-03-28
- Chainalysis · 2025 theft report · 2025-12-18; 2024 report · 2024-12-19; 2022 report · 2023-02-01
- Crowdfund Insider · H1 2026 hacks (TRM Labs data) · 2026-07-02 (secondary)
- TechNews · Virtual Asset Services Act passed · 2026-06-30 (secondary)
Change note
2026-10-07 · Page created with seven cases and yearly totals.