The Eight Noteworthy Cryptocurrency Exchange Hacks and Thefts Examined (2020–2024)
What Happened, What We Learned and Recovery Efforts
Manuscript Date: 1 September 2026
Published Date: 23 October 2026
Last Updated: 23 October 2026
Greetings, beautiful people. 😊☕
Historical period: 1 January 2020–31 December 2024
Research cutoff: 16 October 2026
Imagine checking your cryptocurrency exchange account over your morning coffee, only to discover that withdrawals have been suspended. Your balance might still appear on the screen, but you cannot move your assets. The exchange announces a security incident, investigators begin tracing transactions, and customers are left wondering a simple question:
What happens to my money now?
This is one of the uncomfortable realities of keeping cryptocurrency on a centralised exchange.
Exchanges make buying, selling and trading digital assets convenient. However, when an exchange controls the private keys associated with customers’ cryptocurrency, users depend on its security systems, internal controls, employees, service providers and financial resources.
Even a customer who uses a strong password and two-factor authentication cannot personally prevent every attack against an exchange’s wallet infrastructure.
Between 2020 and 2024, several prominent cryptocurrency exchanges suffered significant thefts or unauthorised withdrawals. Some companies reported that they would compensate affected customers. Others faced lengthy recovery efforts, financial difficulties or restructuring proceedings. In some cases, investigators eventually identified the cyber actors responsible; in others, the complete technical details remained uncertain.
The differences matter. A reported theft of US$200 million does not necessarily mean customers ultimately lost US$200 million. Some assets might be frozen or recovered, an exchange might reimburse affected users from its own resources, or creditors might receive distributions through a legal process. Conversely, a company continuing to operate after an attack does not prove that every loss has been resolved.
In this article, we’ll examine eight noteworthy incidents, what investigators or the exchanges reported, how the companies responded, and what the cases teach us about protecting digital assets.
We will follow the evidence wherever it leads. ☕🔎 After all, a little detective work is useful when the subject is cryptocurrency security.
Our aim is to understand the risks clearly enough to make informed decisions. After all, security works best when we understand what we are trying to protect.
#H2> 🧭 Research Scope and Selection Criteria
This article covers eight selected incidents involving centralised cryptocurrency exchanges or exchange businesses between 1 January 2020 and 31 December 2024. Later developments are included where relevant to the customer impact or recovery outcome.
The cases were selected for their security lessons, reported financial significance, investigative importance and consequences for customers. They are not presented as a definitive ranking of the eight largest exchange thefts.
The article distinguishes among:
Reported theft: Cryptocurrency transferred without the exchange’s authorisation, based on available incident reports.
Estimated loss: The approximate dollar value attributed to the stolen assets at a particular time.
Asset recovery: Cryptocurrency retrieved, frozen or otherwise made available through a recovery process.
Customer reimbursement: Replacement value provided to affected customers by the exchange or another party.
Creditor distribution: Payments made under bankruptcy, insolvency or restructuring arrangements.
Unresolved loss: An amount for which complete recovery or compensation has not been established by the sources cited.
These terms are not interchangeable. A company can compensate customers without recovering the original cryptocurrency, and a creditor distribution does not necessarily mean that the stolen assets have been recovered.
The incidents below concern exchange businesses and their custody or operational systems. Attacks against unrelated decentralised finance protocols, independent bridges or personal wallets are outside the scope of this selection.
#H2> 📊 At a Glance — Eight Exchange Incidents
The figures below are approximate reported values, not a uniform measure of final unrecovered losses. Different estimates can reflect token prices, valuation dates, the assets counted and the evidence available when the estimate was published.
2020 — KuCoin
Approximate reported value: US$275–285 million
Principal issue: Hot-wallet private-key compromise
Reported response or later outcome: Recovery efforts, cooperation with other parties and a commitment to cover affected customer losses.
2021 — BitMart
Approximate reported value: Approximately US$196 million
Principal issue: Two hot wallets compromised
Reported response or later outcome: Compensation commitment; substantial later financial and restructuring difficulties.
2022 — Crypto.com
Approximate reported value: Approximately US$34 million
Principal issue: Unauthorised withdrawals affecting 483 users
Reported response or later outcome: Company reported reimbursing affected accounts.
2022 — FTX
Approximate reported value: Approximately US$400–415 million
Principal issue: Unauthorised transfers associated with the exchange’s collapse
Reported response or later outcome: Asset tracing and recovery within the wider bankruptcy process.
2023 — CoinEx
Approximate reported value: Approximately US$70 million
Principal issue: Hot-wallet private-key leakage, according to the exchange’s preliminary findings
Reported response or later outcome: Wallet containment, phased service restoration and a commitment to bear losses.
2023 — Poloniex
Approximate reported value: Approximately US$120–132 million
Principal issue: Compromised wallet-signing authority or private keys
Reported response or later outcome: Reimbursement commitment and reported freezing of some associated assets.
2024 — WazirX
Approximate reported value: Approximately US$230–235 million
Principal issue: Multisignature-wallet and transaction-approval compromise
Reported response or later outcome: Court-supervised restructuring and a scheme effective in October 2025.
2024 — DMM Bitcoin
Approximate reported value: Approximately US$308 million
Principal issue: Manipulated transaction following compromise of a wallet-service employee
Reported response or later outcome: Official attribution to North Korean cyber actors and transfer of customer accounts and assets to SBI VC Trade.
How to read these figures: The amount initially taken, the amount eventually recovered and the amount customers ultimately receive are three different measurements. Where the available sources do not establish a complete recovery total, this article does not claim one.
A spreadsheet can make figures look wonderfully tidy. The underlying story is usually less tidy, particularly when token prices change and recovery efforts continue for years.
The uncomfortable part is discovering what went wrong. The useful part is learning what might be done differently next time. 📝
#H2> 1. KuCoin — September 2020 🔑
Incident date: 26 September 2020
Approximate reported value: US$275–285 million initially reported
#H3> What happened?
KuCoin detected unusual withdrawals from its hot wallets on 26 September 2020. The affected wallets held Bitcoin, Ether-related assets and other cryptocurrencies.
A hot wallet is connected to systems that can process transactions relatively quickly. Exchanges need such wallets to facilitate deposits and withdrawals, but their online accessibility makes the protection of their signing credentials particularly important.
In its subsequent account of the incident, KuCoin identified leakage of a hot-wallet private key as the cause. A private key is a cryptographic credential that authorises transactions from a wallet. If an attacker obtains the necessary signing authority, the attacker may be able to move the assets without breaking the blockchain itself.
KuCoin said its cold wallets remained safe and committed to covering customer losses arising from the incident.
Primary source: KuCoin — Official website and incident updates.
#H3> How much was taken, and what happened afterwards?
Contemporary estimates commonly placed the initial value of the stolen assets at approximately US$275 million to US$285 million. The figure was not a single, independently audited final-loss measurement.
KuCoin coordinated with other exchanges, token projects and law-enforcement agencies in efforts to freeze or recover assets. Certain cryptocurrency issuers can freeze tokens where their systems provide that capability, although this is not possible for every asset.
These efforts illustrate an important distinction: recovering stolen assets depends on the cryptocurrency involved, where it moves, whether an intermediary can intervene and whether investigators can identify and access the relevant funds.
Following a blockchain transaction can be a little like following a trail of breadcrumbs. The trail may be visible, but identifying who is holding the basket at the end is a separate challenge.
KuCoin also committed to covering affected customer losses. That commitment is distinct from recovering every stolen token.
The exchange continued operating after the breach, so the incident did not immediately result in a business closure or bankruptcy.
A separate development occurred in January 2025, when the KuCoin operating entity pleaded guilty in the United States to operating an unlicensed money-transmitting business and agreed to penalties exceeding US$297 million. This was a separate regulatory and compliance matter, not a finding that the 2020 theft caused the later case.
See the U.S. Department of Justice announcement of 27 January 2025.
#H3> Why does the incident matter?
KuCoin demonstrates that keeping most customer assets in cold storage is not sufficient by itself. The exchange must also protect hot-wallet keys, restrict signing authority, monitor unusual transactions and have an effective emergency response.
For customers, an exchange’s promise to reimburse losses is relevant, but it is only one part of the assessment. Security controls, financial resources and transparent communication also matter.
Lesson for customers: Ask how an exchange limits the assets exposed to online wallets and how it responds if a signing credential is compromised.
Security is often about asking the right questions before trouble arrives. 🔍 Unfortunately, hindsight tends to be a much better detective than foresight.
#H2> 2. BitMart — December 2021 🔐
Incident date: 4 December 2021
Approximate reported value: US$150 million initially estimated by BitMart; approximately US$196 million in subsequent public estimates.
#H3> What happened?
BitMart announced a security breach affecting an Ethereum hot wallet and a Binance Smart Chain hot wallet on 4 December 2021.
The exchange initially estimated the loss at approximately US$150 million. Subsequent blockchain monitoring placed the value of the assets taken at around US$196 million.
BitMart later attributed the incident primarily to a stolen private key that compromised the two hot wallets.
The difference between the initial estimate and subsequent figures is a useful reminder that incident estimates can change as investigators identify affected tokens and calculate their values. Cryptocurrency prices also fluctuate, so estimates made at different times are not necessarily directly comparable.
Primary source: BitMart — Official announcements.
#H3> How did BitMart respond?
BitMart suspended withdrawals while investigating the breach and restoring services. It said it would use its own funds to cover the losses and compensate affected customers.
The exchange also contacted token projects to explore possible responses, including token swaps. Such measures can sometimes help restrict the movement or use of stolen assets, depending on the token’s design and the cooperation available.
However, the public incident announcements do not establish that all the stolen cryptocurrency was recovered.
Compensation and recovery are separate questions. An exchange might replace customers’ lost value using other resources even if the original cryptocurrency remains outside its control.
#H3> Why did the story become more significant in 2026?
BitMart’s later financial difficulties changed the context in which the 2021 incident is understood.
In July 2026, BitMart announced an orderly cessation of operations. Subsequent announcements described work on a potential restructuring plan, creditor distributions and possible business resumption. On 30 September 2026, it published an initial indicative proposal offering users alternative potential recovery arrangements.
The proposal discussed options that included upfront distributions or deferred potential recoveries linked to efforts to pursue the proceeds of the hack. These were proposed arrangements, not proof of completed repayment or a guarantee of full recovery.
Readers can review the company’s initial indicative proposal and roadmap and its official announcement archive.
As of 16 October 2026, the proposal should be described as a developing restructuring and restitution process. The available announcements do not justify stating that every customer has been repaid or that the 2021 theft has been fully recovered.
A proposal is a step in a process, not the same thing as money arriving in a customer’s account. It is a small wording distinction with potentially very large consequences.
#H3> What can we learn?
A company may continue operating for years after a major security incident, while the financial consequences remain unresolved. A later business failure can make it more difficult for customers to assess the value and timing of potential recovery.
Lesson for customers: An exchange’s security is not just a technical matter. Its reserves, financial transparency, ability to absorb losses and arrangements for customers also deserve attention.
#H2> 3. Crypto.com — January 2022 🛡️
Incident disclosed: January 2022
Approximate reported value: US$33.8 million, commonly rounded to US$34 million
Reported affected users: 483
#H3> What happened?
Crypto.com disclosed unauthorised withdrawals affecting 483 users in January 2022.
The quantities reported included approximately 4,836.26 ETH, 443.93 BTC and US$66,200 in other cryptocurrencies. At the prices used in contemporary reporting, the total was approximately US$33.8 million.
The incident attracted attention partly because users had reported missing funds before the company provided its detailed explanation. That sequence highlights an often-overlooked part of incident response: customers need timely, understandable information when something appears wrong with their accounts.
The figures were covered by TechCrunch’s January 2022 report.
#H3> What security issue was involved?
The incident involved unauthorised withdrawals from customer accounts. Contemporary reports discussed a compromise of the platform’s two-factor authentication process, but the public information should not be reduced to the claim that one authentication feature alone explains the entire incident.
Two-factor authentication, or 2FA, adds a verification step beyond a password. It can strengthen account security, but the complete withdrawal process matters too.
For example, an exchange might require additional checks for a new device, an unfamiliar withdrawal address or an unusual transaction. If other controls fail to detect suspicious behaviour, the presence of 2FA does not automatically prevent every unauthorised withdrawal.
Security is a team effort among several controls. One strong player helps, but no single player should be expected to defend the entire pitch.
#H3> How did Crypto.com respond?
Crypto.com reported that it had reimbursed all affected accounts. It also announced additional security measures, including stronger multi-factor authentication arrangements and its Worldwide Account Protection Program, subject to the programme’s terms.
This reported outcome distinguishes the case from incidents in which customers’ recovery depended on a prolonged insolvency or restructuring process.
However, the company’s reimbursement statement is not the same as an independent audit of every technical detail or every aspect of its response.
#H3> What does this mean for everyday users?
Login security and withdrawal security are related, but they are not identical.
Customers should use unique passwords, enable strong available authentication, secure the email account connected to their exchange and avoid approving unexpected login or verification requests.
Lesson for customers: Strong authentication is an important layer of protection, not a guarantee against every possible attack.
#H2> 4. FTX — November 2022 ⚖️
Incident period: November 2022, during FTX’s collapse
Approximate reported value: US$400–415 million associated with unauthorised post-collapse transfers.
#H3> Why does this case require special care?
FTX is an important case in cryptocurrency exchange history, but it differs from a straightforward hot-wallet theft.
Following FTX’s collapse and bankruptcy filing in November 2022, unauthorised transfers involving hundreds of millions of dollars in cryptocurrency were reported. FTX’s bankruptcy team subsequently referred to approximately US$415 million in hacked cryptocurrency associated with the exchange and related entities.
The reported amount is significant, but it should not be confused with the much larger questions surrounding FTX’s missing customer funds, liabilities and alleged misuse of assets.
In December 2022, the U.S. Department of Justice announced criminal charges against FTX founder Sam Bankman-Fried concerning alleged fraud and related offences. Those allegations formed part of the wider collapse and legal proceedings; they are not, by themselves, proof of who carried out every unauthorised post-collapse transfer.
See the U.S. Department of Justice’s 13 December 2022 announcement.
#H3> What happened to the cryptocurrency?
As FTX entered bankruptcy administration, its systems and wallets were being secured and transferred into the control of the restructuring process. Unauthorised transfers complicated the work of identifying, securing and recovering assets for creditors.
Blockchain records can show that cryptocurrency moved between addresses. They do not, by themselves, prove who controlled every destination address or why each transaction occurred.
Consequently, the reported US$400–415 million should be treated as an incident-related estimate rather than the total amount FTX owed customers.
#H3> The difference between theft and bankruptcy
A theft removes assets from a business. Insolvency concerns a company’s inability to meet its obligations under the applicable legal test.
Bankruptcy is a legal process through which those obligations and assets may be administered.
These concepts can overlap, but they are not interchangeable.
FTX was already collapsing when the unauthorised transfers became a major issue. It would therefore be misleading to describe the transfers as the sole cause of the company’s failure.
The bankruptcy estate pursued asset recovery and distributions to creditors. Customer outcomes depended on the legal claims process, assets available to the estate, and the applicable distribution arrangements.
Any repayment through the bankruptcy process should not automatically be described as direct reimbursement of the cryptocurrency involved in the post-collapse transfers.
A legal finding can answer an important question without magically completing every other task on the list. The investigation, the bankruptcy and the recovery of particular assets are related matters, but they are not one giant process with a single finish button.
#H3> What can customers learn?
An exchange can suffer from technical security problems while also facing serious governance, accounting and financial-control failures.
Lesson for customers: Wallet security matters, but so do the handling of customer assets, financial reporting, corporate governance and the legal arrangements that apply if an exchange fails.
#H2> 5. CoinEx — September 2023 🔑
Incident date: 12 September 2023
Approximate reported value: US$70 million
#H3> What happened?
CoinEx detected abnormal withdrawals from several hot-wallet addresses on 12 September 2023.
In its subsequent incident updates, the exchange identified leakage of hot-wallet private keys as the preliminary cause.
The affected assets included Bitcoin, Ether, XRP, Bitcoin Cash, Solana and numerous other tokens.
CoinEx said its cold wallets were unaffected.
The estimated loss was approximately US$70 million, although the precise dollar figure depended on the assets included and the valuation used.
Primary source: CoinEx — Official website and incident updates.
#H3> How did the exchange respond?
CoinEx suspended affected wallet operations, restricted deposits and withdrawals, moved remaining assets away from affected systems and began rebuilding its wallet infrastructure.
It also contacted other exchanges and wallet services in an effort to identify and freeze associated assets.
The company said its user-asset security fund would bear the losses and stated that customer assets would not be affected by the incident. Deposits and withdrawals for major cryptocurrencies resumed in stages beginning on 21 September 2023.
Those actions illustrate the importance of containing an incident quickly. Restricting withdrawals and securing unaffected assets can limit further damage while an investigation proceeds.
However, service restoration is not proof that every stolen asset has been recovered. Likewise, a commitment to absorb losses is a statement of the company’s response, not an independent audit of its financial position.
#H3> Why does the incident matter?
CoinEx illustrates how one compromised wallet infrastructure can expose multiple cryptocurrencies and blockchain networks. A long list of affected tokens does not necessarily mean that every asset was attacked through a separate vulnerability.
For exchanges, important safeguards include limiting the amount of cryptocurrency held in operational wallets, restricting access to signing credentials, monitoring unusual outflows and maintaining a tested emergency plan.
Lesson for customers: Look for clear information about how an exchange protects its online wallets, detects unusual transactions and intends to cover losses that cannot be recovered.
#H2> 6. Poloniex — November 2023 🔍
Incident date: 10 November 2023
Approximate reported value: US$120–132 million
#H3> What happened?
On 10 November 2023, suspicious outflows were detected from Poloniex wallets across multiple blockchain networks, including Ethereum, Tron and Bitcoin.
Initial estimates exceeded US$100 million. Subsequent blockchain-security analyses placed the loss at approximately US$120–132 million, depending on the assets counted and the valuation method.
CertiK’s analysis dated 15 November 2023 estimated the loss at approximately US$132 million.
Technical source: CertiK — Blockchain security research.
#H3> What was the suspected attack method?
The transaction pattern was consistent with a compromise of wallet private keys or the authority used to sign withdrawals.
An attacker who gains that authority may be able to initiate valid-looking blockchain transactions without exploiting a flaw in the blockchain’s underlying consensus mechanism.
The public information supports describing this as a wallet compromise. It does not establish every detail of the initial intrusion with certainty.
That distinction is important. Investigators may be able to trace cryptocurrency after it leaves a wallet without knowing precisely how the attacker first gained access.
#H3> What happened to the stolen assets?
Blockchain investigators traced transfers through numerous destination addresses as assets moved between wallets and services.
Tracing can help exchanges and investigators identify suspicious funds. However, tracing is not the same as recovery.
Cryptocurrency can be moved across networks, exchanged for other assets or transferred through services operating in different jurisdictions.
Poloniex acknowledged the incident, reported freezing some associated assets and promised to reimburse affected users. It also announced the phased restoration of services.
The available announcements cited here do not establish a complete, independently verified recovery total or the exact date and amount of every customer’s reimbursement.
#H3> What does the case teach us?
Restoring trading services is only one part of incident response. A company must also secure compromised systems, preserve evidence, identify suspicious addresses and communicate what is known about recovery.
Lesson for customers: After an exchange breach, look beyond the announcement that services have resumed. Seek specific information about the amount affected, the status of withdrawals, the source of compensation and the progress of asset recovery.
#H2> 7. WazirX — July 2024 🧩
Incident date: 18 July 2024
Approximate reported value: More than US$230 million; approximately US$235 million in Elliptic’s analysis.
#H3> What happened?
Indian cryptocurrency exchange WazirX disclosed a cyberattack involving one of its multisignature wallets on 18 July 2024.
The exchange initially reported that more than US$230 million in digital assets had been stolen. Blockchain analytics firm Elliptic estimated the value at approximately US$235 million.
A multisignature, or multisig, wallet requires multiple authorised signatures to approve a transaction. The arrangement is intended to prevent one compromised key from being sufficient to move funds.
But multisig is not a magic shield. The surrounding custody system, transaction interface, signing devices and approval process must also be secure.
Sources: WazirX — Official website; Elliptic — Blockchain analytics.
#H3> The custody and transaction-approval problem
WazirX said the affected wallet used Liminal’s digital-asset custody and wallet infrastructure. The incident raised questions about how transactions were displayed and validated, how signing authority was protected, and where the compromise occurred.
WazirX and Liminal publicly disputed aspects of responsibility. Their respective accounts should be treated as statements from the parties involved, rather than as independently established findings.
The broader lesson is that a signer must verify the transaction being authorised, not merely recognise a familiar interface or assume that multiple signatures make every transaction safe.
A familiar-looking screen can be reassuring, but the important question is what the screen is actually asking you to approve.
#H3> Investigation and attribution
Elliptic’s analysis identified more than 200 affected assets and traced the movement of cryptocurrency after the theft.
In January 2025, the United States and South Korea formally attributed the WazirX theft to the Democratic People’s Republic of Korea, commonly known as North Korea, in a joint statement.
That official attribution is stronger evidence than unsupported online speculation. Nevertheless, a specific named-group attribution should not be added unless the source establishes it.
WazirX contacted exchanges and law-enforcement agencies, sought to freeze associated addresses and announced a bounty for information that might assist recovery. These measures can complicate an attacker’s attempts to move or convert assets, but they do not guarantee that funds will be returned.
#H3> From a security incident to restructuring
The theft created a substantial gap between the assets available to WazirX and the claims against the platform. As a result, the consequences extended beyond the temporary suspension of services.
In August 2024, Zettai Pte Ltd, the Singapore entity involved in the restructuring, applied to the Singapore High Court for a moratorium to facilitate a scheme of arrangement.
A moratorium is a legal pause that can give a company time to develop a restructuring proposal while restricting certain creditor actions.
The process continued into 2025. The Singapore High Court sanctioned the scheme, with modifications, on 13 October 2025. WazirX announced that the scheme became effective on 15 October 2025.
The scheme established a framework for creditor distributions and potential additional recoveries. WazirX also described Recovery Tokens intended to represent a pro-rata interest in eligible future recoveries under the scheme.
These arrangements should not be interpreted as an unconditional promise that all missing cryptocurrency will be restored at its original value.
A milestone is worth recognising, but it should not automatically be mistaken for the finish line for every customer.
#H3> What can customers learn?
WazirX demonstrates how a wallet-security failure can develop into a lengthy legal and financial process. The eventual customer outcome depends not only on the technical investigation but also on the assets available, the legal structure and the terms of the restructuring.
Lesson for customers: Understand which legal entity holds your assets, how custody and transaction approval work, and whether any proposed recovery depends on future asset tracing or business performance.
#H2> 8. DMM Bitcoin — May 2024 🕵️
Incident date: 31 May 2024
Approximate reported value: US$308 million
Official attribution announced: 23 December 2024
#H3> What happened?
Japan-based DMM Bitcoin announced that 4,502.9 BTC had been transferred out without authorisation. The Bitcoin was worth approximately US$308 million at the time.
The subsequent investigation by the FBI, the U.S. Department of Defense Cyber Crime Center and Japan’s National Police Agency attributed the theft to North Korean cyber actors associated with activity tracked as TraderTraitor.
The official announcement described a targeted social-engineering operation involving an employee of Ginco, a Japanese company providing enterprise cryptocurrency wallet software.
Primary source: FBI — Official announcement, 23 December 2024.
#H3> How did the attack work?
According to the authorities’ account, the operation began in late March 2024, when an attacker posing as a recruiter contacted a Ginco employee.
The attacker sent a link to a malicious Python script presented as a pre-employment test. The employee, who had access to Ginco’s wallet-management system, copied the code to a personal GitHub page and was subsequently compromised.
The attackers later used session-cookie information to impersonate the employee and gain access to Ginco’s communications system.
In late May, they likely manipulated a legitimate transaction request made by a DMM employee, resulting in the transfer of 4,502.9 BTC to attacker-controlled wallets.
A session cookie helps maintain an authenticated online session. If an attacker steals a valid cookie, the attacker may be able to impersonate an authenticated user without entering the user’s password through the normal login process.
This was therefore not simply a case of an exchange storing a private key carelessly. The official account described a wider attack involving social engineering, a compromised employee and a trusted wallet-service provider.
#H3> Why is the official attribution significant?
The joint FBI, DC3 and Japanese National Police Agency announcement connected the theft to North Korean cyber actors associated with TraderTraitor.
This attribution matters because it was made through an official investigative announcement rather than speculation based solely on blockchain movements.
It also demonstrates that attackers may target people and service providers who have access to cryptocurrency systems, rather than attacking the exchange directly.
#H3> Customer compensation and business consequences
DMM Bitcoin announced that it would secure resources from group companies to compensate customers.
In December 2024, DMM Bitcoin and SBI VC Trade announced arrangements for customer accounts and assets to be transferred to SBI VC Trade. The transfer took place on 8 March 2025, and DMM Bitcoin’s service ended on that date.
See the SBI VC Trade transfer information.
The transfer provided a route for customer accounts and assets to continue under another service provider. It should not be confused with recovery of the original 4,502.9 BTC.
The public transfer announcement establishes the customer-account transition, not that the stolen Bitcoin was recovered in full.
#H3> What can we learn?
DMM Bitcoin highlights the importance of protecting employees, contractors and external technology providers. A legitimate transaction can be manipulated if an attacker compromises a trusted person or service involved in the approval process.
Lesson for customers: Exchange security extends beyond passwords and wallet keys. The people, vendors and systems involved in authorising transactions are part of the security boundary too.
#H2> 🔎 What These Eight Incidents Reveal
The eight cases differ in their technical details, financial consequences and recovery outcomes. Nevertheless, several important lessons emerge.
#H3> 1. Private-key security remains fundamental
KuCoin, BitMart, CoinEx and Poloniex demonstrate the consequences of losing control over wallet-signing authority.
A private key is not simply a password that can be reset. It is a cryptographic credential used to authorise transactions.
Once a transaction has been confirmed on a blockchain, an exchange generally cannot reverse it merely by asking the network to undo the transfer.
Exchanges therefore need layered safeguards, including restricted access to keys, secure signing environments, transaction limits, monitoring and emergency procedures.
#H3> 2. Multisignature protection is not a complete security strategy
WazirX illustrates why requiring multiple signatures does not eliminate every risk.
If the custody system, transaction-approval interface or signing process is compromised, a multisig arrangement may still fail to prevent an unauthorised transfer.
Security depends on what signers actually verify, how their signing environments are protected and whether the transaction details presented to them accurately reflect what they are authorising.
#H3> 3. Employees and service providers can become attack paths
DMM Bitcoin is particularly instructive because the official investigation described a social-engineering attack involving an employee of a wallet-service provider.
This is why security programmes must cover employees, contractors and external technology providers. Phishing resistance, restricted permissions, secure development environments and independent transaction verification all play a role.
The person who opens a malicious link may not be the person who ultimately loses cryptocurrency, but their compromised access can become a route into a much larger system.
#H3> 4. Recovery is not the same as reimbursement
These terms describe different outcomes.
Asset recovery: Stolen cryptocurrency is retrieved, frozen or made available through a legitimate recovery process.
Customer reimbursement: An exchange or another party provides replacement value to affected customers.
Creditor distribution: Assets are distributed through a bankruptcy or restructuring process under its applicable rules.
Business recovery: The exchange resumes or continues operations after an incident.
Full recovery: The relevant losses have been completely restored or satisfied under the stated definition. This requires supporting evidence.
An exchange may resume operations without recovering all stolen assets. It may reimburse customers without retrieving the original cryptocurrency. Alternatively, a company may enter restructuring years after an incident because the financial consequences have weakened its position.
When reading an exchange’s announcement, ask which outcome has actually occurred. The word recovered should not be used as a general synonym for reimbursed.
Recovery can be complicated, and every case has its own story. The paperwork, unfortunately, rarely comes with a magic wand. ☕🙂
#H3> 5. Financial transparency matters as much as technical security
The later developments involving BitMart and WazirX show why the initial theft amount is only part of the story.
Customers also need to understand the company’s ability to absorb losses, the legal entity responsible for their claims, the assets available to satisfy those claims and whether repayment depends on future recoveries.
A statement that customer funds are safe is not a substitute for verifiable financial information.
#H3> 6. A blockchain transaction does not tell the whole story
Blockchain records are valuable evidence. They can show when assets moved, which addresses received them and how funds travelled afterwards.
But tracing a transaction does not automatically identify the person controlling an address, establish the attacker’s motive or prove that funds have been recovered.
Investigators may need additional evidence from service providers, devices, communications, financial records and law-enforcement inquiries.
That is why an exchange’s first estimate, a blockchain analyst’s assessment and a later legal finding may describe different aspects of the same incident.
#H2> ☕ Practical Lessons for Everyday Cryptocurrency Users
No exchange can guarantee that it will never suffer a cyberattack. Customers can, however, reduce their exposure and make more informed decisions.
#H3> 1. Secure your exchange account
Use a unique password and enable strong multifactor authentication. Secure the email account associated with your exchange, review account notifications and never approve unexpected login or verification requests.
Where available, consider withdrawal-address allowlisting and additional approval controls. Understand their limitations rather than assuming that any single feature provides complete protection.
#H3> 2. Understand custodial risk
When an exchange controls the private keys, you depend on its security, governance and ability to meet its obligations.
An account balance displayed on a website is not the same as personally controlling the associated private keys. That does not automatically make every exchange unsafe; it means that custody introduces a different set of risks.
#H3> 3. Research security and financial disclosures
Review an exchange’s incident history, custody arrangements, withdrawal policies and available financial disclosures.
Proof-of-reserves reports may provide useful information, but proof of reserves alone does not establish that all liabilities are covered or that every asset is accessible when customers request withdrawals.
Read the scope and limitations of the evidence rather than relying on a headline or a badge. The label may be reassuring, but the details tell you what has actually been checked.
#H3> 4. Consider where long-term holdings should be kept
Depending on your needs and technical ability, self-custody may reduce dependence on an exchange.
However, self-custody transfers responsibility for private keys, seed phrases, backups and transaction approvals to you.
Losing a recovery phrase or authorising a malicious transaction can create a different kind of problem.
The right approach depends on your circumstances, knowledge and ability to manage those responsibilities. Convenience and control involve trade-offs.
#H3> 5. Read the recovery terms after an incident
When an exchange announces a breach, look for answers to these questions:
How much cryptocurrency was affected, and how was the estimate calculated?
Which systems, wallets or accounts were involved?
Have withdrawals been suspended, and what is the latest service status?
What has the investigation established, and what remains uncertain?
Has cryptocurrency actually been recovered, or has the company merely promised compensation?
Which legal entity is responsible for customer claims?
Are repayments completed, proposed or dependent on future recoveries?
These questions help separate confirmed developments from reassuring language that may not yet have a clear financial outcome.
A headline may fit on one line; a recovery process rarely does.
#H2> 📝 Conclusion — Look Beyond the Headline Loss
The eight incidents examined here show that cryptocurrency exchange thefts are not one uniform category of failure.
Some involved compromised private keys. Others involved unauthorised customer-account withdrawals, a compromised multisignature-wallet process or an attack against an employee connected to an external wallet-service provider.
Their consequences varied just as widely.
Crypto.com reported reimbursing affected accounts.
KuCoin continued operating after its breach and undertook recovery efforts.
FTX’s post-collapse transfers became part of a much larger bankruptcy process. WazirX moved into a court-supervised restructuring,
while DMM Bitcoin transferred customer accounts and assets to another provider.
BitMart’s subsequent financial difficulties demonstrate how the consequences of a security incident can persist for years.
The amount initially stolen does not tell the whole story. We must also consider what investigators established, how much was recovered, who ultimately bore the financial loss and what happened to customers afterwards.
For everyday cryptocurrency users, the central lesson is straightforward: digital-asset security depends on more than cryptography. It also depends on people, operational systems, financial resources, governance and the legal arrangements surrounding the assets.
A little knowledge can make a meaningful difference. Understand who controls your cryptocurrency, learn how that custody arrangement works and read the details when an incident occurs.
And perhaps the most useful habit of all? When an exchange announces that everything is resolved, take a moment to ask what resolved actually means. Your morning coffee can wait another minute.
#H2> 📚 CryptoMatters Editorial Approach
CryptoMatters aims to explain cryptocurrency security and digital-asset risks in a friendly, accessible and research-based manner.
This article draws on exchange announcements, official investigative statements, blockchain-security research and other publicly available reporting. Company statements are identified as such and are not automatically treated as independent confirmation. Reported losses, asset recovery, customer reimbursement and creditor distributions are distinguished wherever relevant.
The eight incidents were selected for their educational value and are not an exhaustive catalogue of every exchange hack between 2020 and 2024. Estimates may vary with asset prices, valuation dates and the evidence available. Where a complete recovery outcome cannot be established from the sources cited, the article does not claim that recovery is complete.
The purpose is education and informed decision-making, not financial or legal advice, and not the promotion of any particular cryptocurrency exchange or custody product.
#H2> 📌 Editorial Note — Research Scope and Cutoff Date
Historical incident period: 1 January 2020–31 December 2024.
Research cutoff: 16 October 2026.
This article reviews eight selected cryptocurrency exchange thefts or unauthorised-transfer incidents during the stated historical period and includes subsequent developments where relevant to customer impact and recovery.
Dollar figures are approximate reported estimates unless a source establishes a more precise measure. An estimate of cryptocurrency taken is not necessarily the final unrecovered loss or the amount ultimately borne by customers.
Company announcements, investigative findings and legal outcomes are distinguished according to the evidence available.
Restructuring proposals and compensation commitments are not described as completed distributions unless the available sources support that conclusion. Information may change as investigations, recovery efforts and legal proceedings develop. This article is not a forensic audit or a legal opinion.
#H2> 🔗 Sources and Further Reading
The following sources provide starting points for examining the incidents and their later developments. Official announcements are prioritised where available, with independent technical analysis and reporting used to add context.
KuCoin — Official website and incident announcements
KuCoin
Exchange statements and subsequent incident updates concerning the September 2020 breach.
U.S. Department of Justice — KuCoin regulatory case, 27 January 2025
Read the DOJ announcement.
Provides context for the separate U.S. regulatory case, which should not be conflated with the 2020 theft
BitMart — Initial indicative proposal and roadmap, 30 September 2026
Read BitMart’s proposal.
Describes the company’s proposed recovery and restructuring alternatives as of the publication cutoff.
Crypto.com — January 2022 incident reporting
TechCrunch coverage.
Reports the incident’s disclosed asset quantities, affected users and stated reimbursement outcome.
FTX — U.S. Department of Justice, 13 December 2022
Read the DOJ announcement.
Provides legal context for the criminal allegations associated with FTX’s collapse. It should be read separately from evidence concerning individual post-collapse transfers.
CoinEx — Official website and incident updates
CoinEx
Exchange statements concerning the September 2023 incident, preliminary cause, containment and service restoration.
Poloniex — CertiK security research
CertiK
Technical research and blockchain analysis concerning the November 2023 wallet outflows.
WazirX — Exchange announcements and restructuring information
WazirX
Exchange statements concerning the July 2024 breach and subsequent customer and restructuring developments.
Elliptic — Blockchain analytics
Elliptic
Technical analysis relevant to the WazirX incident and tracing of affected assets.
FBI, DC3 and Japan’s National Police Agency — DMM Bitcoin theft, 23 December 2024
Read the official investigative announcement.
Details the reported social-engineering attack, compromised wallet-service employee and official attribution.
SBI VC Trade — DMM Bitcoin customer-account and asset transfer
Read the transfer information.
Documents the transition of customer accounts and assets to SBI VC Trade in March 2025.
WazirX — Scheme of Arrangement
WazirX official website
Consult the company’s published restructuring announcements for the scheme’s court sanction, effective date and creditor-distribution framework.
BitMart — Official announcement archive
Read BitMart’s announcements.
Provides the company’s subsequent operational, restructuring and restitution announcements.
Source links are provided as research starting points. Where a link leads to a general official website rather than a specific archived incident notice, readers should consult the site’s announcement or support section for the relevant dated statement.
#H2> 📌 Disclaimer
This article is published by CryptoMatters for general informational and educational purposes only. It does not constitute financial, investment, tax, legal, or other professional advice. Cryptocurrency exchange failures, bankruptcy proceedings, asset recovery processes, and applicable laws can change over time and vary by jurisdiction. Readers should consult qualified professionals for advice relating to their individual circumstances.
While we make reasonable efforts to provide accurate and up-to-date information, CryptoMatters does not guarantee that all information is complete or free from error. Readers are responsible for their own decisions and actions. For further details, please read our CryptoMatters Disclaimer.
— CryptoMatters ☕
— CryptoMatters
I write about the often-confusing world of crypto, making it easier to understand through practical insights for everyday users. I believe protecting your digital assets shouldn’t require you to understand all the technology behind them.