Historical Exchange Incidents

What happened

During a promotional reward distribution, an input error treated Korean-won reward amounts as BTC and credited 620,000 BTC across 695 customer accounts. Bithumb restricted affected trading and withdrawals within 35 minutes, but sales of miscredited balances temporarily distorted its BTC market and contributed to losses for other traders.

Reserve and customer-asset evidence

The credits existed on Bithumb's internal ledger rather than as 620,000 BTC transferred on-chain. Bithumb said customer assets were not lost, reported restoring asset-account consistency, and began compensation for users affected by the resulting market disruption.

What happened

Upbit detected unauthorized transfers of Solana-network assets to external wallets beginning at 04:42 KST on November 27, 2025. The confirmed loss was revised to ₩44.5 billion. South Korea's Financial Supervisory Service later opened a formal sanctions process concerning the incident; public reporting also raised questions about disclosure timing.

Reserve and customer-asset evidence

Upbit said it would cover the full loss with company assets so customers would not bear the loss. It suspended digital-asset deposits and withdrawals, moved assets to cold wallets, and conducted a broader wallet-security review.

What happened

A server-side compromise affected an internal operational account and resulted in a treasury loss. The event is useful for comparing initial disclosure timing with later evidence about customer-asset segregation and withdrawal performance.

Reserve and customer-asset evidence

CoinDCX said the affected account was used for liquidity provisioning, customer wallets were segregated and unaffected, and treasury reserves absorbed the loss. It reported processing all withdrawal requests.

What happened

A threat actor obtained customer-account information and internal documentation after support personnel improperly accessed data, then demanded a $20 million payment. Coinbase disclosed the event in an SEC filing.

Reserve and customer-asset evidence

Coinbase estimated remediation and voluntary reimbursement costs; the event was a customer-data and social-engineering incident rather than a reserve shortfall.

What happened

Abnormal VOXELUSDT futures volume and price movements triggered account restrictions and rollback of selected trades. Bitget subsequently announced support for affected traders.

Reserve and customer-asset evidence

Bitget said other users and platform funds remained unaffected; the response focused on trade rollback and compensation.

What happened

Attackers manipulated a Safe multisignature signing workflow and removed ETH-related assets from a Bybit cold wallet. Bybit continued processing withdrawals, obtained replacement liquidity, and published forensic and reserve updates.

Reserve and customer-asset evidence

An updated third-party PoR reported in-scope assets backed above 100% after Bybit restored its ETH coverage within approximately 72 hours.

What happened

Phemex detected unusual activity across several hot wallets and temporarily suspended withdrawals. Its timeline documented containment and staged restoration, making it useful for response-transparency analysis.

Reserve and customer-asset evidence

Phemex suspended withdrawals, moved to inspect and rebuild wallet infrastructure, and said cold wallets and customer funds remained secure. Public estimates placed the hot-wallet loss above $69 million.

What happened

Attackers compromised a multisignature wallet used under a third-party custody arrangement. WazirX stopped withdrawals and later reversed post-halt trades while pursuing a creditor restructuring plan.

Reserve and customer-asset evidence

The loss represented a material share of platform assets and led to prolonged withdrawal restrictions and court-supervised restructuring rather than immediate 1:1 reimbursement.

What happened

Security researchers exploited a deposit-crediting vulnerability and withdrew approximately $3 million, leading to a public dispute over bug-bounty conduct. CertiK later said the funds were returned.

Reserve and customer-asset evidence

Kraken stated that no client assets were affected or at risk and that the exploited funds came from its treasury.

What happened

An exploit allowed abnormal issuance of PLX tokens that were deposited and sold on Bitget. The exchange suspended the pair and pursued a resolution for affected users.

Reserve and customer-asset evidence

The compromised smart contract belonged to the PLEXUS project, not Bitget's core exchange custody system. Bitget announced its own compensation plan.

What happened

Customer bitcoin was transmitted outside DMM Bitcoin without authorization. The exchange later chose to discontinue operations and transfer customer accounts and assets to another group platform.

Reserve and customer-asset evidence

DMM Bitcoin said group companies would fund full compensation. Japan's regulator later found material weaknesses in system-risk management and incident response and issued a business-improvement order.

What happened

A hot-wallet compromise led Poloniex to suspend deposits and withdrawals. The record remains relevant because the exchange's public solvency assurances were not paired with detailed, independently verified reserve evidence at the time.

Reserve and customer-asset evidence

Poloniex said operating revenue could cover the losses and promised full reimbursement, but its initial notice did not provide a complete loss figure or independent post-event reserve verification.

What happened

CoinEx detected abnormal withdrawals from several hot wallets used for temporary custody of user assets. It published an evolving response timeline and wallet information.

Reserve and customer-asset evidence

CoinEx suspended deposits and withdrawals, moved remaining assets to new addresses, and said its user-asset security fund would cover affected customer assets.

What happened

Collateral for some Binance-issued tokens was held in a wallet that also contained other assets. The event affected reserve-wallet clarity but did not by itself establish insolvency or misuse of customer assets.

Reserve and customer-asset evidence

Binance described the shared wallet placement as an operational or labeling error and said assets were being moved to dedicated collateral wallets.

What happened

Mazars stopped providing crypto Proof-of-Reserves work and removed Binance's published report. The discontinuity reduced external assurance but did not establish missing reserves or insolvency.

Reserve and customer-asset evidence

The engagement covered agreed-upon procedures and was narrower than a full financial-statement audit.

What happened

Crypto.com published a Mazars agreed-upon-procedures PoR report shortly before Mazars discontinued crypto PoR work. This records a loss of ongoing external verification, not a failed reserve test.

Reserve and customer-asset evidence

The December snapshot reported 1:1 backing for in-scope balances, but the verifier subsequently stopped crypto PoR engagements.

What happened

KuCoin was among the crypto exchanges affected by Mazars' decision to stop Proof-of-Reserves work. This is an external-verification discontinuity rather than evidence of insolvency.

Reserve and customer-asset evidence

The external-verification relationship ended when Mazars paused all crypto PoR engagements.

What happened

FTX collapsed after an undisclosed diversion of customer funds to Alameda Research, preferential platform treatment for Alameda, and public assurances that conflicted with the exchange's actual financial condition. It is a benchmark transparency and liability-disclosure failure.

Reserve and customer-asset evidence

FTX paused customer withdrawals and filed for bankruptcy without sufficient readily available assets to honor customer claims. Court proceedings later established misuse of customer deposits and concealed exposure to Alameda Research.

What happened

BTC, ETH, and USDC were stolen from a Deribit hot wallet. The exchange published a detailed timeline, identified unaffected asset pools, and described custody changes made after the event.

Reserve and customer-asset evidence

Deribit said company reserves covered the loss and that client assets, cold storage, and its insurance fund were unaffected. Withdrawals resumed after approximately one day.

What happened

Unauthorized transactions bypassed two-factor authentication on 483 customer accounts, resulting in withdrawals of BTC, ETH, and other funds.

Reserve and customer-asset evidence

Crypto.com said all affected customers were fully reimbursed after withdrawals were paused for approximately 14 hours.

What happened

Unauthorized transfers affected hot wallets across Ethereum, Polygon, BNB Chain, Litecoin, and Bitcoin Cash. AscendEX publicly discussed the estimated loss and its intended customer coverage.

Reserve and customer-asset evidence

AscendEX said cold wallets were unaffected and promised to reimburse impacted users in full from its own balance sheet.

What happened

NYDFS found that Coinbase reported a cyber event to the U.S. Secret Service in May 2021 but did not report it to NYDFS until September despite a 72-hour reporting requirement.

Reserve and customer-asset evidence

Not a reserve-loss finding; the issue was failure to meet a required disclosure deadline.

What happened

Attackers used separately obtained credentials and exploited a flaw in Coinbase's SMS account-recovery process to access customer accounts and remove funds.

Reserve and customer-asset evidence

Coinbase reported reimbursing affected customers approximately $25.1 million.

What happened

OKX suspended withdrawals because a private-key holder was unavailable during an investigation. The limited initial explanation and extended loss of customer access make this both an operational and disclosure event.

Reserve and customer-asset evidence

OKX said assets remained safe, but it did not publish post-event reserve verification comparable to modern PoR evidence.

What happened

Bitcoin and multiple tokens were removed from KuCoin hot wallets after private keys were compromised. Deposits and withdrawals were suspended while wallets and security systems were replaced.

Reserve and customer-asset evidence

KuCoin said affected users would be covered by the exchange and its insurance fund and later reported substantial asset recovery.

What happened

An unauthorized transfer removed 342,000 ETH from Upbit's hot wallet. The incident is useful for evaluating immediate disclosure, withdrawal continuity, and exchange-funded reimbursement.

Reserve and customer-asset evidence

Upbit said it would cover the loss from its own reserves, moved remaining hot-wallet assets into cold storage, and temporarily halted deposits and withdrawals.

What happened

Attackers obtained credentials including API keys and two-factor authentication data and withdrew 7,000 BTC from one hot wallet. Binance temporarily suspended deposits and withdrawals.

Reserve and customer-asset evidence

Binance said the affected wallet held about 2% of its BTC and that its SAFU fund would cover the loss.

What happened

Quadriga claimed customer funds were liquid and withdrawable while its founder used client assets for operating expenses, personal spending, and speculative trading. The resulting shortfall brought down the platform.

Reserve and customer-asset evidence

The Ontario Securities Commission found C$215 million owed to clients against only C$46 million recovered or identified. It found inadequate records, no asset segregation, and extensive misuse of client assets.

What happened

An Ethereum Classic chain reorganization affected deposits processed by Gate. This was an external network-consensus attack rather than a compromise of Gate's core custody infrastructure.

Reserve and customer-asset evidence

Gate reported that approximately $100,000 of ETC was returned and increased ETC confirmation requirements.

What happened

Private keys were used to transfer multiple cryptocurrencies from Cryptopia without authorization. The exchange's subsequent liquidation created a significant customer-asset ownership and recovery case.

Reserve and customer-asset evidence

Court records estimate that 9%–14% of Cryptopia's cryptocurrency was stolen. The exchange briefly resumed operations before entering liquidation, and distributions remain part of a prolonged claims process.

What happened

Attackers compromised third-party StatCounter analytics code and targeted Gate.io users' Bitcoin withdrawal flow. The malicious code was identified and removed, with no confirmed customer loss reported.

Reserve and customer-asset evidence

No customer-asset shortfall was publicly identified.

What happened

Malicious code injected through a chat feature caused abnormal RLC/USDT orders. Gate rolled back the affected 15-minute trading window and repaired the vulnerability.

Reserve and customer-asset evidence

Gate said suspicious accounts were frozen, no funds were lost from the platform, and affected users would be compensated.

What happened

Attackers transferred customer NEM from a Coincheck hot wallet. The scale of the loss and the custody controls identified afterward made the event a major test of reimbursement capacity and regulatory transparency.

Reserve and customer-asset evidence

Coincheck announced reimbursement for affected customers. Japan's FSA conducted an onsite inspection and required improvements to security and operational controls.

What happened

A compromise of Bitfinex's multisignature custody arrangement resulted in the theft of nearly 120,000 BTC. The exchange halted operations and implemented a recovery-token structure to address the resulting customer-asset deficit.

Reserve and customer-asset evidence

Bitfinex socialized losses across customer balances and issued BFX recovery tokens, which it later reported as fully redeemed. The event is a major example of post-loss recapitalization rather than immediate 1:1 reimbursement.

What happened

Attackers stole bitcoin from an operational hot wallet. Bitstamp suspended service and warned customers not to deposit to previously issued addresses while it investigated and rebuilt the platform.

Reserve and customer-asset evidence

Bitstamp said customer balances would be honored in full and relaunched after rebuilding its systems.

What happened

Mt. Gox halted withdrawals and ceased operations before filing for bankruptcy. The prolonged, previously undetected loss and the gap between customer claims and recoverable assets made the collapse a defining custody and transparency failure.

Reserve and customer-asset evidence

Mt. Gox initially reported 850,000 BTC missing, later located 200,000 BTC, and entered bankruptcy and civil rehabilitation. Creditor repayments began more than a decade after the collapse.