Crypto Exchange Security: How to Evaluate If Your Exchange Is Safe

$1.4 Billion Stolen in 2026: Why Exchange Security Isn't Optional

Let's start with the number that should make every exchange user uncomfortable: approximately $1.4 billion stolen across 250 attacks through September 2026, according to DefiLlama. September alone accounted for $766 million — the single costliest month this year.

The biggest hit? Bitget lost $351.6 million on September 24, 2026, when attackers exploited compromised third-party security infrastructure to trigger forged withdrawal commands. Funds were moved across Ethereum, EVM chains, XRP Ledger, Zcash and Tron within a single hour. The exchange suspects North Korea's Lazarus Group.

But Bitget isn't an isolated case. Here's what 2025-2026 looks like for exchange security:

The pattern is clear: attackers are shifting from DeFi smart contract exploits to targeting exchange back-end infrastructure. A single compromised vendor or internal tool can bypass years of cold storage investment. Your funds are only as safe as the weakest link in the exchange's operational chain.

Rule of thumb: if an exchange can't show you verifiable proof that your money exists, you're trusting a website. That's not investing — that's hoping.

Proof of Reserves: What the Numbers Actually Mean

After the FTX collapse in late 2022, proof of reserves (PoR) became the industry's transparency baseline. The concept is straightforward: an exchange publishes cryptographic evidence that it holds enough on-chain assets to cover every user's balance. But the details matter enormously.

Two main verification methods:

• Merkle Tree: Used by Bitget, MEXC, CoinEx and Phemex. You can verify your individual balance is included in the total liabilities. Bitget goes a step further by publishing open-source verification code on GitHub.
• zk-STARK: Used by OKX. More privacy-preserving (doesn't reveal individual balances), but achieves the same goal: proving total assets ≥ total liabilities.

Current reserve ratios (2026 data):

What PoR does NOT prove:

• The exchange doesn't have massive off-balance-sheet debts or loans (FTX had a 100%+ reserve ratio on paper while Alameda Research borrowed billions)
• The assets are liquid and not locked in staking, lending or proprietary trading
• The exchange won't become insolvent next week
• Operational security is sound — a 100% reserve doesn't prevent a hack

PoR is a necessary but insufficient signal. Think of it as a minimum bar, not a gold star.

Insurance Funds: Size Matters, But So Does Scope

Insurance funds are supposed to protect users when things go wrong — hacks, system failures, extreme market events. But "insurance fund" is a marketing term that covers three very different mechanisms. Understanding which type your exchange offers (and what it actually covers) is critical.

Three things to check before you trust an insurance fund:

1. Published scope or terms: What events does it cover? Binance's SAFU describes protection in "extreme cases" — but that language is vague. Most funds explicitly exclude phishing, SIM swaps, account takeovers and trading losses.
2. Independent verifiability: Can you check the fund balance on-chain? Binance (public BTC wallet), Bybit (daily balance history) and MEXC (wallet addresses) pass this test. Bitget's fund has not been independently verified.
3. Documented payout precedent: Has the fund actually been used? A fund that's never paid out is untested. Binance has used SAFU twice. Bybit covered its $1.4B loss through emergency loans and reserves rather than the insurance fund itself, which raises questions about the fund's real role.

The uncomfortable truth: fund size is the weakest signal. A $1 billion fund with no published terms, no verifiable balance and no payout history is less trustworthy than a $100 million fund that's been audited, verified on-chain and used at least once.

The Hack History Test: Who Got Hacked and Who Paid Users Back

Every exchange is a target. The question isn't whether they'll be attacked — it's how they respond when (not if) something goes wrong.

Best response: Bybit (Feb 2025, $1.5B)

The largest exchange hack in history. Lazarus Group (FBI-confirmed) exploited a smart contract vulnerability. Bybit covered the entire loss through emergency loans and reserves. Withdrawals never paused. Users lost nothing. The exchange continued operating normally within hours. This set the gold standard for incident response.

Tested response: Binance (2019, ~$40M)

SAFU covered the loss. Users were reimbursed. The exchange published a detailed post-mortem. A smaller incident in December 2025 (Trust Wallet, ~$7M) was also covered by SAFU. The pattern shows a functioning insurance mechanism.

Uncertain response: Bitget (Sep 2026, $351.6M)

CEO Gracy Chen claimed the $464 million User Protection Fund covers the loss and that cold wallets were untouched. However, withdrawals were paused pending a security review. The attacker used forged withdrawal commands through compromised third-party infrastructure — an operational security failure, not a cryptographic one. As of October 2026, the incident report is still pending full publication.

What to look for in hack response:

• Was there a withdrawal pause? If yes, how long?
• Did users lose funds, or did the exchange cover it?
• Was there a transparent post-mortem within 72 hours?
• Did the exchange change its security practices afterward?

Cold Storage and Operational Security: The Invisible Layer

Cold storage — keeping the majority of funds in wallets that are never connected to the internet — is the most basic security measure. Yet the Bitget hack demonstrated that even robust cold storage policies can't protect against compromised operational infrastructure.

What good looks like:

• 95%+ cold storage: Industry standard for reputable platforms. OKX, Binance and Bybit all claim to keep the vast majority of assets in cold or offline wallets.
• Multi-signature requirements: Withdrawals from cold wallets should require multiple authorized signers across different geographic locations.
• Regular third-party security audits: Not just once at launch, but ongoing. Exchanges that publish annual or semi-annual audit reports from firms like Hacken, CertiK or SlowMist demonstrate commitment.
• Bug bounty programs: Paying white-hat hackers to find vulnerabilities before malicious actors exploit them. OKX, Binance and Bybit all run active programs.

What the Bitget hack teaches us:

The attacker didn't steal private keys. They exploited a flaw in a back-end system and spoofed transaction history to trigger unauthorized withdrawals. That means the exchange's own systems were tricked into believing the withdrawals were legitimate. Cold storage protects against key theft, but not against compromised operational tools.

This is why operational security matters as much as custody. Ask: how does the exchange authorize withdrawals? What third-party vendors have access? How are internal tools audited?

The 4-Minute Security Checklist

Before depositing significant funds on any exchange, run through these checks:

If an exchange fails three or more of these checks, your funds are at elevated risk regardless of how good the trading interface looks or how low the fees are.

For exchange-by-exchange security scores, check our exchange review database where we evaluate each platform across all six dimensions.