Last updated: October 31, 2026 · By Sanket Goyal
So what happens if a crypto exchange gets hacked? Usually one of four things: the exchange covers the loss from its own reserves, it freezes withdrawals for a while and then covers it, it shares the loss with users through a “haircut”, or it collapses and users end up as creditors in a slow legal process. Which one you get depends almost entirely on how much money the exchange has set aside, not on anything you did.
That last part stings a bit. If your coins sit on an exchange, you’re trusting a company, not a blockchain. This guide explains what really goes on after a hack, your odds of getting the money back, and the exact steps I’d take in the first 24 hours.
Why exchanges get hacked in the first place
An exchange is basically a giant shared wallet. When you “hold” crypto there, you don’t hold private keys. The exchange does. Your account balance is just a number in its database saying how much it owes you.
To let people withdraw quickly, exchanges keep part of their coins in hot wallets, which are connected to the internet. The bigger share usually sits in cold storage, kept offline. Attackers go after the hot side, or after the people and systems that can move money out of cold storage.
Common ways in:
- Stolen employee access. A phishing email, a fake job offer or a malware-laced file lands on the right laptop.
- Bugs in wallet or bridge software. A tiny flaw in code that signs transactions can be enough.
- Compromised third-party tools. Exchanges rely on outside vendors, and a weak link there can open the door.
- Insider help. Rare, but it happens.
Notice what’s missing from that list? You. In most big exchange hacks, users did nothing wrong. That’s exactly why the question of who pays matters so much.
What happens if a crypto exchange gets hacked: the 4 outcomes
Every hack is messy, but the endings tend to fall into the same four buckets.
1. The exchange covers everything
Large exchanges often keep a reserve or a user protection fund for exactly this. If the stolen amount is smaller than that cushion, they absorb it and your balance never changes. You might not even notice, apart from a scary headline and a short pause.
2. Withdrawals freeze, then get covered
This is the most common pattern I’ve seen. The exchange pauses deposits and withdrawals for hours, days or sometimes weeks while it traces the attack, patches the hole and counts what’s left. Then it reopens and honors balances. Annoying. Stressful. But you get your coins.
3. A “haircut” or partial payback
If the hole is too big to fill, the exchange may spread the loss across users. You might get back a percentage now, plus some kind of IOU token or credit that promises the rest later if the company recovers. Whether that promise is ever kept depends on the business surviving.
4. The exchange goes under
Worst case. The company can’t cover the loss, files for insolvency, and a court-supervised process decides who gets what. In practice that can take years, and customers often end up behind other creditors in the queue. Some people get a fraction back. Some get very little.
Honestly, the gap between outcome 2 and outcome 4 is mostly about one thing: how healthy the exchange’s balance sheet was before the hack.
Do you get your crypto back?
Short answer: maybe, and it’s rarely guaranteed.
Here’s the uncomfortable part. Crypto on an exchange doesn’t enjoy the safety nets people assume it does. In the US, deposit insurance (FDIC) covers bank deposits, not crypto assets, and the investor protection fund for brokerages (SIPC) generally doesn’t cover crypto that isn’t a registered security. US regulators have repeatedly warned that crypto platforms are not federally insured.
In India, crypto exchanges (called virtual digital asset service providers) must register with the Financial Intelligence Unit (FIU-IND) under anti-money-laundering law. That’s about tracking money, though, not about protecting your balance. There’s no deposit insurance for crypto here either.
So what decides it?
- The exchange’s reserves and whether it publishes regular proof that it holds customer assets.
- How much was stolen compared with what’s left.
- Recovery efforts. Sometimes stolen funds get frozen when they touch other platforms, and a slice comes back. Don’t plan around it.
- The exchange’s own terms of service, which spell out what happens in a loss event. Most people never read them.
| Protection | United States | India |
|---|---|---|
| Bank-style deposit insurance for crypto | No (FDIC covers bank deposits only) | No |
| Brokerage protection fund | Generally no for crypto that isn’t a registered security | Not applicable |
| Who regulates exchanges | Mix of federal and state rules, still evolving | FIU-IND registration under anti-money-laundering law |
| Where to report fraud | FBI’s Internet Crime Complaint Center (IC3) | Cyber helpline 1930 or the national cybercrime portal |
| Tax on crypto gains | Taxed as property, ask a tax pro about theft losses | Flat 30% plus cess, 1% TDS, losses can’t be set off |
Your exchange got hacked: what to do in the first 24 hours
Picture a small bakery owner in Pune who keeps her savings in crypto on one app. She wakes up to a news alert and a dozen panicked messages in a group chat. What she does next matters more than the hack itself.
- Go to official channels only. Type the exchange’s web address yourself or open its official app. Ignore links in DMs, search ads and anyone calling “from support”. Scammers flood every hack with fake help desks within hours.
- Screenshot and export everything. Balances, open orders, deposit and withdrawal history. If there’s ever a claims process, records you saved yourself are gold.
- Lock down your account. Change to a unique password, switch two-factor login to an authenticator app instead of SMS, and turn on the withdrawal address allowlist if the exchange offers one. Even if the hack wasn’t about your account, stolen data sometimes surfaces later.
- Don’t panic-trade. Selling in a crash or rushing coins into an app you just discovered is how people lose twice.
- Ignore anyone offering “recovery”. People who promise to get your crypto back for an upfront fee are running a scam. Every single time.
If money actually left your personal account, report it. In India, call 1930 or file on the national cybercrime portal. In the US, file a report with the FBI’s IC3. Keep the complaint number.
How to protect yourself before the next hack
You can’t stop a company from getting breached. You can limit how much of your money is exposed when it does.
Keep only what you trade on the exchange
My rule of thumb: the exchange is a shop, not a safe. Keep there what you plan to trade in the near future. The rest belongs in a wallet where you hold the keys.
Pick your wallet type honestly
- Software wallet (an app on your phone or computer): you control the keys, it’s free and handy, but it’s only as safe as your device.
- Hardware wallet (a small offline device): best for long-term holdings. Less convenient, and you must guard both the device and its recovery phrase.
Picture a retired teacher who bought a little crypto years ago and never trades. For him, an exchange account adds risk with zero benefit. A hardware wallet and a recovery phrase written on paper, stored somewhere safe at home, is the calmer setup.
Write down your seed phrase, offline
Your recovery (seed) phrase is the wallet. Anyone who has it owns your coins. Never type it into a website, never photograph it, never share it with “support”. Real support will never ask.
Harden the account you do keep
- Use app-based two-factor login, not SMS. SIM swap attacks still catch people out, and I’ve covered how to prevent SIM swapping on Android and iPhone in detail.
- Turn on withdrawal address allowlisting and login alerts.
- Use a separate email address for financial accounts if you can.
Check the exchange before you trust it
Look for regular proof-of-reserves reports, clear terms about loss events, and a track record of how it handled past incidents. In India, check that it’s registered with FIU-IND. If an exchange is vague about any of this, that’s your answer.
Spreading money across a couple of platforms also helps. The same thinking applied when people had to look for Paytm Payments Bank alternatives: never let one company hold everything.
What about taxes after a hack?
Messy, and I won’t pretend otherwise. In India, crypto gains are taxed at a flat 30% plus cess, 1% TDS is cut on transfers, and crypto losses can’t be set off against other income or carried forward. Don’t count on any tax relief for stolen coins. In the US, crypto is treated as property, and the rules for deducting theft losses are narrow. Either way, keep your records and talk to a chartered accountant or tax professional before you file.
The bottom line
A hack at your exchange doesn’t automatically mean your money is gone. Most of the time, a big exchange either covers the loss or pays out after a freeze. But “most of the time” isn’t a plan. The real fix happens before the hack: keep only trading money on the exchange, hold the rest in a wallet you control, and lock down your logins.
If you’re new to app-based money and want to understand how safe other wallets are, my guide on whether FamPay is safe walks through the same kind of checks for a different type of app.
FAQ
Is my crypto insured if an exchange is hacked?
Usually not by any government scheme. FDIC deposit insurance doesn’t cover crypto, SIPC generally doesn’t either, and India has no deposit insurance for crypto. Some exchanges run their own protection funds, but those are company promises, not guarantees.
How long do exchanges freeze withdrawals after a hack?
It varies from a few hours to several weeks. Smaller incidents often reopen within days. Larger ones take longer while the exchange audits its wallets and patches the flaw.
Can stolen crypto be recovered?
Sometimes, partly. Blockchain transactions are public, so investigators can follow the money and some platforms freeze stolen funds when they show up. Full recovery is rare, so treat any recovered amount as a bonus.
Should I withdraw my crypto right after hearing about a hack?
Only through the official app or website, and only if withdrawals are open. Many people get scammed by fake withdrawal links in the hours after a hack. If you do move coins, send them to a wallet you control and test with a small amount first.
Is a hardware wallet safer than keeping crypto on an exchange?
For long-term holdings, yes, because you hold the keys offline and an exchange breach can’t touch them. The trade-off is responsibility: lose the device and your recovery phrase, and nobody can help you.
