A Historical Review of Crypto Exchange Security
As the central hubs for the centralized storage and trading of digital assets, cryptocurrency exchanges have long been primary targets for cyber hackers and advanced persistent threat (APT) attacks. Historically, multiple major security incidents have not only resulted in massive asset losses but have also profoundly reshaped industry security standards regarding cold and hot wallet segregation, multi-signature mechanisms, and third-party dependencies.
Review of Major Exchange Hacks Over the Years
- Mt. Gox (2014): Once handling 70% of global Bitcoin trading, the platform was the largest exchange in the world at the time. Due to system vulnerabilities and continuous hacker theft, a total of approximately 850,000 Bitcoins were lost (worth about $470 million to $615 million at the time), leading the platform to declare bankruptcy in February 2014.
- Coincheck (2018): Due to a hot wallet security vulnerability, hackers stole NEM (XEM) valued at $534 million. Afterwards, the platform used its own funds to fully compensate affected customers.
- KuCoin (September 2020): Following a hot wallet private key leak, hackers stole approximately $281 million. The platform subsequently recovered a portion of the assets through on-chain tracking and law enforcement cooperation, while covering the remaining losses from its own funds.
- Bybit (February 2025): Suffered a hacker attack resulting in losses of approximately $1.46 billion. Hackers targeted and illegally transferred funds from Ethereum multi-signature cold and hot wallets using phishing attacks and smart contract vulnerabilities.
- Bitget (September 2026): Unauthorized outflows occurred from certain hot and warm wallets, resulting in losses of approximately $387.5 million. The root cause was traced to a vulnerability in a third-party security product. Following the incident, the platform announced that its protection fund would fully cover the losses.
- Binance (October 2026): Its hot wallet was targeted by a highly sophisticated attack involving fake recruitment, malware, internal AI tools, and Ethereum upgrade mechanisms such as EIP-7702. Approximately $6.3 billion to $6.4 billion in assets were stolen, making it the largest theft in crypto history. A portion of the stolen assets has been frozen, and the platform has pledged full coverage for the losses.
Exchange Security Measures and Industry Implications
From early code vulnerabilities and private key management errors to recent multi-dimensional attacks combining social engineering, fake recruitment, and complex smart contract vulnerabilities, hacker tactics continue to evolve. Major top-tier platforms are progressively introducing mechanisms such as multi-signature, decentralized cold storage, risk reserves, and protection funds to counter escalating cybersecurity challenges.
