What happened at every exchange that lost customer money

Every exchange that has operated at scale for long enough has lost money. Treating an incident as disqualifying would eliminate the entire market, and it would eliminate the wrong venues, because a breach tells you about one day and the aftermath tells you about the institution.

So the question we record for every incident in our exchange rating is not what happened. It is: were users made whole, how fast, and out of what.

In February 2025, Bybit lost roughly $1.4–1.5bn through a compromised third-party signing tool rather than its own systems — the largest exchange theft ever recorded.

Withdrawals never stopped. The gap was closed in about 72 hours. No user lost money. That is not a promise in a marketing document; it is a matter of record, and it is the strongest single piece of evidence any venue in our rating has about its ability to absorb a loss.

Worth noting what did not do the work: Bybit's roughly $986m "insurance fund" is a derivatives liquidation backstop, not theft cover. The recovery came from the balance sheet and emergency borrowing. Capacity to pay is the thing; the fund was a different product with a similar name.

Binance, 2019: 7,000 BTC — about $40m at the time — stolen from a hot wallet via compromised API keys, covered by the SAFU fund and users made whole. SAFU has a published on-chain address and a stated replenishment rule, and this payout is the reason it counts as evidence rather than assertion. Almost every other exchange "insurance fund" has neither property.

Coinbase, 2021: funds taken from roughly 6,000 customer accounts through credential compromise and an SMS-2FA bypass. The exchange's own systems held; individual accounts fell. Customers were reimbursed.

Coinbase, 2025: overseas support contractors were bribed to exfiltrate customer personal data. No passwords or private keys were compromised and no funds were directly accessed; the losses that followed came from social engineering against the exposed customers. Coinbase covered them.

Both are worth reading as a lesson about your own setup rather than about Coinbase — see what to set up before depositing.

Gate.io, 2019: roughly 40,000 ETC lost to a 51% attack on Ethereum Classic — a failure of the chain rather than the exchange. Gate stated it would absorb the loss and users were covered.

Kraken, 2024: a roughly $3m loss from its own treasury through a deposit-crediting bug found by security researchers, patched in about 47 minutes. Kraken states no client assets were at risk.

• Where a solvent operator existed, users were made whole — usually within days, sometimes within hours.
• Where the failed entity was the only source of funds, recovery took years and was partial. That is the difference between a hack and an insolvency, and it is the more important distinction.
• The size of the loss predicted nothing. The largest theft on record produced the fastest full recovery.
• Marketing about security predicted nothing either. Several venues with the most elaborate security pages have the least verifiable protection — BitMart's own risk disclosure states that assets held with it are not covered by any compensation, protection or insurance scheme, and the only fund it operates renders "No Data".

The size of the loss predicted nothing. The largest theft on record produced the fastest full recovery.

Judge a venue by its aftermath, not its incident count. Ask whether users were made whole, how quickly, and from what source — and be sceptical of protection funds without a public address and a payout in the record. Then keep only a working balance there regardless, because the venues that paid did so by choice.