Your exchange got hacked. Whose coins are gone?

Quick answer: If an exchange is hacked, you get your coins back only if the company can and will cover the loss. No federal insurance does it for you. Keep on an exchange only what you're actively trading, and move the rest to a wallet you control.

Three hacks, three different endings

In 2014, Mt. Gox lost roughly 850,000 bitcoin and went bankrupt. Customers waited about ten years before creditors started seeing coins come back. Many got a fraction of what their holdings would be worth today.

In 2016, Bitfinex lost around 120,000 bitcoin. The exchange spread the loss across every customer account, a haircut of roughly a third, then issued tokens to make people whole over time. Most customers eventually recovered, but nobody got to choose.

In February 2025, Bybit lost about $1.5 billion in Ethereum in a single theft. U.S. officials tied it to North Korea's Lazarus Group. Bybit covered the hole, and customers kept their balances.

Same crime, three outcomes. The hack itself rarely decides what you lose. The balance sheet of the company holding your coins does.

There's no FDIC for this

Your checking account is protected up to $250,000 per depositor, per bank. Crypto isn't. FDIC coverage doesn't extend to bitcoin on an exchange, and neither does the brokerage-failure protection that covers stocks. Some exchanges carry private crime insurance. Read what it covers. These policies often have limits well below total customer holdings, and they may treat coins in online "hot" storage differently from coins in offline storage.

Then there's the question nobody asks until it's too late. Are the coins on your screen yours, or are they an IOU?

That turns on the terms of service. In the Celsius bankruptcy, a judge ruled in 2023 that coins customers had put into the company's Earn program belonged to the bankrupt estate. The customers were treated as creditors standing in line. That's a ruling about one product under one set of terms, not a rule for every exchange. But it shows what's at stake in the fine print. If you want a definite answer about your account, a lawyer who handles digital assets can read your agreement. This article can't.

What actually happens in the first 72 hours

It usually goes like this.

• Withdrawals freeze. The exchange pauses them, often with a short post on social media. You can't move anything.
• The company investigates. It tries to figure out how much was taken and from which wallets.
• A statement follows. Good ones say plainly whether customer funds are covered. Bad ones are vague, and vague means worry.
• Then one of four things: the exchange covers it, socializes the loss across customers, enters bankruptcy, or negotiates with the thieves for a partial return.

During the freeze, you can do very little. That's the annoying part. A hardware wallet in your desk drawer doesn't freeze. A balance on a website does.

What to do while it's frozen

Don't panic-sell on a different platform to "offset" anything. Don't send coins around out of nervousness.

Do these things instead:

1. Screenshot your balances and download your transaction history. You'll need records for a claim or for taxes.
2. Watch only the exchange's official channels. Type the address yourself.
3. Ignore anyone who offers to recover your funds for a fee. Hack aftermaths are prime time for fraud, and the people who get caught are often the careful ones. We covered how that works in the crypto scams that catch careful people too.
4. Change your passwords and move your two-factor method if there's any chance your own account details were exposed.
5. Ask a CPA about the tax side. Whether a theft or bankruptcy loss is deductible depends on your situation, and the rules for investment losses are narrower than most people assume.

The fix is dull and it works

Self-reliance isn't a slogan here. It's the actual defense.

Decide a trading number. That's the amount you'd be annoyed to lose, not devastated. Keep that on the exchange. Everything else comes off.

Buy a hardware wallet directly from the maker. Never from a reseller or an auction listing. A tampered device is a known scam. When it arrives, set it up yourself and write your recovery phrase on paper.

Store the recovery phrase like a deed. Not in a photo, not in a notes app, not in email. Two copies in two places. The biggest threat to your crypto is your own filing system walks through how people lose coins this way, and it's more common than hacks.

Lock down the account you keep on the exchange.

• Use a hardware security key or an authenticator app, not text-message codes. SIM-swapping makes texts the weak link.
• Turn on a withdrawal address allowlist, so coins can only go to addresses you've pre-approved.
• Use an email address for the exchange that you use nowhere else.
• Add a withdrawal delay if the exchange offers one. A 24-hour hold gives you time to notice a thief.

The trade-off nobody likes to say

Self-custody isn't free. If you lose your recovery phrase, there's no help line. If you send coins to a wrong address, they're gone. Nobody reverses it for you. For a lot of people, a reputable exchange with strong security is a fine place for a small balance, and plenty of people have held coins there for years without incident.

But a long quiet stretch isn't a guarantee. It just means the thieves haven't picked your company yet.

If you're new to all this and still working out what you actually own, Bitcoin, explained for somebody who skipped the last decade is a good place to start before you decide how much to hold anywhere.

One test before you go to bed

Open your exchange account tonight and ask a single question. If this site vanished tomorrow, what would I have left?

If the answer makes your stomach drop, you already know what to do.