The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Usually, nothing happens automatically to every customer balance. After an exchange breach, the company may pause withdrawals, isolate affected wallets, investigate, and reimburse customers from reserves or limited insurance. If attackers removed assets and the exchange cannot cover the shortfall, withdrawals can remain frozen and customers may receive a bankruptcy claim instead of the same coins. The result depends on what was compromised, whether liabilities are still fully backed, the exchange’s custody contract and jurisdiction, and any court orders.
A balance displayed in an exchange app is a custodial claim. The platform, not you, controls the private keys. That differs from holding cryptocurrency in a wallet for which you control the keys, and it means the exchange’s solvency, operational decisions and legal structure matter when something goes wrong.
What an exchange breach can do to your crypto
A breach can affect three different things: access to your account, confidentiality of your personal information, or the cryptocurrency itself. An attacker might steal login credentials without moving coins, expose identity data, compromise an exchange hot wallet, or obtain keys that control customer assets. A withdrawal halt can therefore be a containment measure; it is not proof that every customer balance was stolen.
The exchange may keep honoring unaffected balances while it blocks transfers from an affected wallet. It may also move assets to new addresses, disable application-programming-interface (API) keys, require password resets, or ask customers to wait for a claims process. If reserves cover the missing amount, the company can eventually restore withdrawals or make customers whole. If reserves do not cover it, distributions can be delayed, reduced, or converted into a legal claim.
#1 Best Overall
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Your app balance is a claim under a contract
When you leave coins on an exchange, the account statement generally records what the platform owes you under its user agreement and custody terms. It does not necessarily identify a specific, segregated coin sitting in your name. Read the agreement for language about title, segregation, rehypothecation, lending, and the governing law. Those provisions can determine whether you can demand the return of particular assets or instead rank as a creditor for their value.
A breach does not have one universal outcome
Possible outcomes include a short interruption with full restoration, a permanent loss of some assets, a negotiated reimbursement, or a court-supervised liquidation. No authoritative source establishes a universal recovery rate or reimbursement deadline for exchange breaches. An incident date and the exchange’s legal entity and jurisdiction are essential when assessing any particular case.
How the final outcome is determined
1. What was breached
- Customer accounts or data systems: Passwords, session tokens, email accounts or identity records may be exposed while the underlying wallets remain intact.
- Hot wallets: Internet-connected wallets are designed for frequent withdrawals and are more exposed to an online compromise. The exchange can often isolate the affected addresses.
- Cold-storage keys: A compromise of offline-key procedures or signing systems can put a larger reserve at risk and may require moving assets and rebuilding key custody.
- An external custodian: If another company holds the keys, its insolvency, security controls and contract with the exchange can become part of your recovery path.
2. Operational containment
Exchanges commonly pause withdrawals and transfers to stop further movement and preserve evidence. Ask whether the pause covers every asset or only named wallets and networks, whether deposits remain credited, and whether the company has published replacement addresses. A verified incident notice should identify the incident time, affected assets, current withdrawal status and the support or claims channel.
3. Reserves, insurance and solvency
The key financial question is whether the exchange still owns enough assets to satisfy customer liabilities. A published reserve snapshot or proof-of-reserves report may not show all liabilities, related-party obligations, encumbrances or the legal segregation of coins, so it is not a guarantee of repayment. Private crime or custody insurance can help only for specified events, wallets, limits and insured entities. A contractual promise to reimburse may also contain exclusions, caps or conditions.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
4. Contract and insolvency law
If the company remains solvent and its terms promise custody of customer assets, it may return equivalent coins. If it enters insolvency, a court can decide whether customer assets are held in trust, segregated from company property, or part of the estate. Customers whose coins are not legally segregated may become general unsecured creditors. Their recovery then depends on the estate’s assets, other creditor priorities, the governing jurisdiction and court-approved distributions. A claim may be paid in cash or another asset rather than the original coin, and its value can change while proceedings continue.
5. What happens on-chain
Blockchain records can show where stolen assets moved, but visibility is not the same as recovery. A receiving service may freeze an address, law enforcement may obtain records, or the attacker may disperse assets through many addresses and services. Rapid notification can improve an investigation, yet no regulator, tracing company or exchange can promise a reversal.
Are exchange-held crypto assets insured?
Not by the standard U.S. government programs that protect bank deposits or securities. The Federal Trade Commission states: “Cryptocurrency held in accounts is not insured by a government like U.S. dollars deposited into an FDIC insured bank account.” The FTC also explains that if a storage company goes out of business or is hacked, the government has no obligation to return the money.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFDIC insurance
FDIC deposit insurance applies to eligible deposits at an insured bank, not to cryptocurrency balances held in an exchange account. In a July 29, 2022 advisory, the FDIC warned that statements by crypto companies could lead customers to mistakenly believe their money or investments were FDIC insured. An exchange may keep cash at an FDIC-insured bank, but that fact does not turn your crypto balance into an insured deposit.
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
SIPC protection
Staff at the U.S. Securities and Exchange Commission answer “No” when asked whether SIPC protects customer claims for non-security crypto assets held by a SIPC-member broker-dealer. SIPC is therefore not a general backstop for an exchange hack. Whether a particular token is treated as a security is a legal question, and ordinary exchange-held cryptocurrency should not be assumed to qualify.
Private coverage
Private policies may cover a defined theft, a defined wallet or a defined custodian up to a stated limit. A risk disclosure filed with the SEC warns of “a partial or total loss of our cryptocurrency in a manner that may not be covered by insurance or the liability provisions of the custody agreements” and notes that custodially held crypto could become part of a custodian’s insolvency estate. Look for the insured legal entity, covered assets, exclusions, limits, deductible and claims procedure rather than relying on a marketing reference to insurance.
What a breach response usually looks like
- Detection: The exchange identifies abnormal logins, withdrawals or wallet activity and records a likely incident window.
- Containment: Withdrawals, transfers and API access may be paused. The company may quarantine addresses and move unaffected reserves.
- Investigation: Security teams and outside investigators trace transactions, determine which systems and assets were touched, and preserve logs.
- Customer notice: The exchange publishes affected assets, account actions, status updates and instructions through its verified domain or app.
- Financial decision: Management determines whether reserves, insurance or a compensation program can cover the shortfall.
- Restoration or claims: Withdrawals resume in stages, or customers receive a claims form and later distributions under a restructuring or bankruptcy process.
For perspective, a January 2022 breach discussed in a Commodity Futures Trading Commission record involved approximately $33 million in ETH and BTC at the value reported at that time. The amount stolen alone did not determine every customer’s eventual result; wallet scope, reserves and the company’s response did.
What to do immediately if your exchange is breached
- Reach the genuine service. Type the exchange’s known address, use a saved bookmark or open its official app. Do not use links in unexpected emails, direct messages or search advertisements.
- Capture the official notice. Record the incident time, named assets and networks, withdrawal status, claim instructions, deadlines and your support-ticket number. Save the notice as a file or screenshot.
- Secure your email first. Change the email password to a unique value, revoke unknown sessions and enable an authenticator-based second factor. Then change the exchange password, revoke all sessions and disable or rotate every API key.
- Preserve account evidence. Export statements, deposit and withdrawal histories, wallet addresses, transaction hashes, screenshots, emails and support correspondence. Keep original files and do not edit or delete forensic evidence.
- Protect your identity. If personal information was exposed, obtain your credit reports, place a credit freeze or fraud alert, and use legitimate monitoring or identity-theft insurance offered by the affected company. Report identity misuse through IdentityTheft.gov.
- Report suspected criminal theft. Notify the exchange and report to the FBI’s Internet Crime Complaint Center or local law enforcement. Fast reporting can support an investigation, but no agency can promise that a blockchain transfer will be reversed.
- Reject recovery scams. Never pay an unsolicited recovery agent, tax, unlock charge or blockchain-tracing fee. The FBI warns that recovery-fraud operators demand upfront or additional payments. Exchanges freeze accounts through their internal controls or legal process, not through a stranger who contacts you privately.
When will you get Bitcoin or another coin back?
There is no standard deadline. First determine whether the exchange says your specific asset and wallet were affected, whether customer liabilities remain fully backed, and whether withdrawals have reopened. A temporary pause with intact reserves is materially different from a deficit followed by insolvency proceedings.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
If the exchange promises reimbursement, read whether it pays the original coin, a cash equivalent or a capped amount, and whether the promise applies to losses caused by the exchange, a customer’s compromised email, market movements or a third-party custodian. Keep every notice because terms and claim instructions can change during an investigation.
If a bankruptcy court is involved, file the required claim by the stated deadline even if you believe the exchange owes you specific coins. The court may later determine asset ownership, priority and valuation. Missing a claims deadline can reduce or eliminate your ability to participate.
Exchange custody versus a hardware wallet
Moving assets to self-custody can reduce exposure to exchange insolvency, withdrawal controls and an exchange-wallet theft. It does not recover coins already stolen and it replaces one set of risks with another: you must protect the seed phrase, verify addresses and device authenticity, maintain backups and plan inheritance. Losing or exposing the seed phrase can permanently lose the funds.
| Question | Exchange custody | Self-custody with a hardware wallet |
|---|---|---|
| Who controls the private keys? | The exchange or its custodian. | You, provided the seed phrase remains secret. |
| Withdrawal availability | Subject to platform controls, maintenance, investigations and legal orders. | Available when you have the device, seed and network access. |
| Counterparty insolvency | Can turn a coin balance into a bankruptcy claim. | No exchange counterparty, but loss of the seed can be final. |
| Recovery path | Support, reimbursement terms, insurance and court claims. | Your backups and inheritance plan; there is no central reset. |
| Insurance | Government programs generally do not insure the crypto; private coverage may be limited. | Usually no automatic government or exchange coverage. |
| Operational convenience | Easy trading, recurring purchases and account recovery. | More responsibility for signing, backups, address verification and updates. |
How to assess an exchange before leaving coins there
- Identify the exact legal entity, headquarters and governing jurisdiction, not just the trading brand.
- Read custody terms for segregation, title, lending or rehypothecation, withdrawal rights and insolvency treatment.
- Check whether insurance names the correct entity and specifies covered wallets, events, limits and exclusions.
- Treat proof-of-reserves as one data point; ask how liabilities, borrowed assets and off-chain claims are addressed.
- Review withdrawal limits, address-whitelisting, multi-factor authentication, API controls and emergency communication procedures.
- Look for a dated incident history and clear notices rather than assurances that provide no scope or remedy.
Common mistakes after a breach
- Assuming a headline theft figure equals the amount every customer lost.
- Assuming a withdrawal pause proves that all balances disappeared.
- Believing an FDIC logo, a bank relationship or a SIPC-member intermediary insures ordinary crypto holdings.
- Sending more money to a person promising to unlock or trace funds.
- Deleting emails, transaction records or screenshots that may establish ownership and timing.
- Moving remaining assets through an unverified link or revealing a seed phrase while trying to recover funds.
Bottom line
An exchange breach can end with restored withdrawals, partial reimbursement or a bankruptcy claim; the headline alone cannot tell you which. Check the affected wallets and assets, the exchange’s reserves and contracts, the applicable jurisdiction and the on-chain status. Secure your email and account, preserve evidence, report quickly and ignore anyone demanding an upfront recovery payment. Self-custody can remove exchange counterparty risk, but it makes you solely responsible for the keys.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
