Photo: Michael Förtsch on Unsplash
Why crypto exchanges keep getting hacked
In short: Crypto exchanges hold large amounts of instantly transferable value, so they attract skilled attackers, especially groups linked to North Korea. Chainalysis estimated at least $2 billion of the $3.4 billion stolen in 2025 was taken by North Korean hackers. Attacks increasingly target people and suppliers rather than code. For users, the lesson is to limit what you keep on any exchange.
Why exchanges are such attractive targets
- Huge balances in one place: exchanges hold assets for millions of customers.
- Fast and final: once crypto is moved, it cannot be reversed like a bank transfer. Attackers can move billions in minutes.
- Online by design: to process withdrawals quickly, exchanges keep part of their funds in "hot" wallets connected to the internet. See The Binance hack explained.
- Global and fast-moving: stolen funds can be swapped between coins and services across borders before anyone can freeze them.
Who is behind the biggest thefts
Blockchain analysis firm Chainalysis estimated that more than $3.4 billion in crypto was stolen in 2025, and that North Korean hackers took at least $2.02 billion of it, their worst year on record. A single attack on the exchange Bybit in February 2025 accounted for about $1.5 billion. In October 2026, analysis firms linked the reported $6.3 billion Binance theft to the same country's TraderTraitor group. Researchers and governments say the stolen money helps fund the North Korean state.
How attacks are changing
Chainalysis noted that attacks are becoming fewer but larger. Rather than finding bugs in code, attackers increasingly go after people and suppliers:
- Stealing keys that control large wallets.
- Social engineering: posing as recruiters, investors or IT workers to get malware onto staff laptops.
- Fake remote workers hired into crypto and tech companies. Our note on social engineering explains the tactics.
- Supply chain attacks on software or services an exchange relies on, as in the Bybit case. See Software supply chain attacks.
Can the money be recovered?
Partly, sometimes. Because most blockchains are public, investigators can follow stolen funds and ask exchanges and token issuers to freeze them. In the Binance case, about $3 billion was reported frozen. But attackers launder funds through mixing services, bridges between blockchains and loosely regulated platforms, and much is never recovered.
What it means for you
- Do not keep more on an exchange than you need for trading.
- Protect your account with a passkey or authenticator app and a withdrawal allow-list.
- Understand the protections: crypto on an exchange is usually not covered by deposit guarantee schemes, and an exchange's promise to cover losses depends on its finances.
- Beware of recovery scams after every major hack. Nobody can recover your funds for an upfront fee.
Tip: If you move crypto to your own wallet, the recovery phrase becomes your responsibility. Write it down on paper, store it safely and never type it into a website or share it with anyone.
Exchanges are improving defences
Large exchanges have responded by keeping more funds in cold storage, requiring several people to approve big transfers, monitoring withdrawals for unusual patterns and working with analysis firms to freeze stolen funds quickly. These measures limit losses but cannot remove the risk entirely, because some funds must stay online for withdrawals to work.
Key takeaways
- Exchanges hold huge, instantly transferable balances, making them prime targets.
- Chainalysis estimated North Korean hackers took at least $2 billion of $3.4 billion stolen in 2025.
- Attacks increasingly target staff, keys and suppliers rather than code.
- Keep only what you need on exchanges, use strong sign-in and ignore recovery offers.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.