Crypto exchange hacks: How to stay safe and protect your investments | Personal Finance

A spate of hacks at cryptocurrency exchanges has put the safety of investor holdings under scrutiny. Binance recently suffered a $6.3 billion breach, while India’s CoinDCX lost $16 million to hackers in October 2026. Several other international exchanges have also reported losses. Investors choosing a platform must scrutinise its security features and its capacity to replace stolen assets.

 

Why exchanges are vulnerable

 Cryptocurrency exchanges concentrate vast pools of digital assets in centralised systems, making them attractive targets for hackers. “They control investors’ assets and private keys, allowing a single security failure to expose billions of dollars,” says Tushar Gulati, associate partner, Dentons Link Legal.

  

Their complex codebases sometimes contain vulnerabilities. Their employees’ devices are subject to sophisticated malware attacks. “Stolen employee credentials, compromised software, approvals for malicious transactions, and weaknesses in third-party infrastructure can give attackers control of transaction authorisation systems,” says Vikram Subburaj, chief executive officer (CEO), Giottus.com.

 

Other vulnerabilities include poor private-key management in hot wallets, insider threats, and weak access controls.

 

Once attackers gain the authority to approve transactions, they can move hundreds of millions of dollars before an exchange can intervene. “Validly authorised blockchain transactions generally cannot be reversed, making recovery difficult,” says Subburaj.

 

Who bears the loss

 A hack may deplete an exchange’s own assets or those held on behalf of customers. “Who ultimately pays depends on the exchange’s ability to replace assets, its contractual obligations, and customers’ legal rights,” says Subburaj.

 

An adequately capitalised exchange may absorb the loss. If those resources fall short, the burden may get passed on to customers.

 “Severe capital deficits can force exchanges to freeze withdrawals, implement token write-downs,” says Abhishek Kumar, Securities and Exchange Board of India (Sebi)-registered investment adviser and founder, SahajMoney.com. In extreme cases, an exchange may become insolvent, leaving customers to pursue recovery as creditors.

 

The extent of insurance coverage and the exchange’s desire to protect its brand reputation also influences what customers receive.

 

Scant protection

 In September 2026, the Ministry of Finance warned that crypto products remain unregulated and investors would have no regulatory recourse for losses.

 

“Most crypto exchanges are unregulated, creating counterparty risk through the absence of regulatory oversight and risk management,” says Kumar.

 

Domestic crypto regulation primarily focuses on anti-money laundering compliance rather than investor compensation.

 

“Without mandatory statutory deposit insurance or clear bankruptcy protection laws, users depend largely on the exchange’s voluntary goodwill and financial health,” says Kumar.

 Investors must bear in mind that a marketing statement is not equivalent to a legally enforceable guarantee. Enforceability depends on the customer agreement, applicable law, and the entity responsible for honouring.

 

Act after a hack

 After an exchange hack, immediately download account statements, transaction histories and withdrawal records to document your holdings.

 Check the exchange’s official announcements to establish whether your assets are affected. If withdrawals remain open, consider reducing your exposure. Ignore anyone promising priority withdrawals or fund recovery, and never pay for such services.

 If your assets are inaccessible, obtain written confirmation of your balances and the exchange’s proposed recovery process, then lodge a formal claim.

 “Report any loss to the National Cyber Crime Reporting portal,” says Raheel Patel, partner, Gandhi Law Associates.

 Broad liability exclusions in customer agreements can make recovery difficult. “Misrepresentation of security arrangements, failure to honour contractual commitments or negligence may give customers grounds for legal action,” says Gulati.

 

“Depending on the facts, investors may pursue contractual claims or civil proceedings for breach of contract, negligence or misrepresentation, and explore consumer complaints where legally maintainable,” adds Gulati.

 

 Check custody and insurance

 Investors should look beyond brand reputation, trading volumes and celebrity endorsements when selecting an exchange. “Check whether the exchange undertakes to reimburse losses caused by a breach of its own infrastructure,” says Subburaj. Patel suggests using only registered and reputable platforms.

 

Seek evidence that the exchange segregates customer assets from company funds. Establish whether the exchange can lend, pledge or otherwise use customer assets. “Check whether most holdings are maintained in cold storage,” says Gulati.

 

Verify that a genuine insurance policy covers cryptocurrency theft. Check coverage limits and exclusions. Establish whether compensation after a security breach is a clear written commitment or entirely discretionary. Published reimbursement policies should identify eligible losses, funding sources and claims procedures.

 

Limit exchange holdings

 Keep an amount on the exchange that reflects your trading frequency and how much money you need for transactions. Review custody decisions as your portfolio grows.

 

“Long-term holdings, or amounts exceeding what investors can afford to lose, should be moved periodically to their own wallets,” says Patel.

 

Use a reputable hardware wallet purchased directly from the manufacturer or an authorised seller. Set it up independently and generate a fresh recovery phrase on the device. Never use a wallet supplied with a preprinted recovery phrase.

 

Write the recovery phrase on paper and keep it offline in two secure places, away from the device. “Never photograph it, upload it to cloud storage or disclose it to anyone claiming to provide technical support,” says Subburaj.

 

Confirm that the receiving wallet supports the cryptocurrency and selected blockchain network. An incompatible network can make recovery difficult. Transfer a small amount first and confirm its arrival and accessibility before moving the remaining holdings.

  

The writer is a Mumbai-based independent journalist