Centralized Exchange Incident Timeline 2014 to 2026: Hacks, Withdrawal Freezes and Collapses, and How Much Users Got Back

Exchange incidents fall roughly into three types: assets stolen by hackers, withdrawals suspended, and collapse. I put together a table of 25 larger centralized exchange incidents from 2014 to 2026 for which records are available. Each row gives the amount lost, what happened, how much users got back, how long it took before they could withdraw their assets again, and source links.

The short version: in most hacks the exchange absorbed the loss. In 17 of the 20 hacks, users were eventually made whole, and the median time for the main assets to resume withdrawals was 8 days. Collapses are a very different story: for the 3 with data, the time from the incident to the first distribution had a median of 1,562 days, and in none of them did users get their original coins back. From the table, whether things turned out well depended mainly on whether the exchange still had money to cover the loss after the incident. That is my observation, not proof of cause and effect.

This article is a summary of information and not investment advice. The amounts in the table are each source’s estimate at the time of the incident, and different sources can differ widely on the same event. “In full” is mostly based on the exchange’s own statements; I could not find third parties confirming every case. Data checked on 12 October 2026; for later developments, go by the sources.

Exchange incident table: 25 incidents from 2014 to 2026

Listed from newest to oldest. “Time to withdraw” is the number of days from the start of the incident until users could first take their assets out (when withdrawals of the main assets resumed, when accounts moved to another platform, or the first distribution in bankruptcy proceedings). Entries marked ※ have figures or dates with some uncertainty, explained below the table.

Date	Exchange	Type	Loss (at the time)	What happened	What users got back	Time to withdraw	Sources
2026-09-24	Bitget	Hack	About US$388 million	A vulnerability in a third-party security product was exploited to forge withdrawal instructions, draining hot and warm wallets	In full: absorbed by the company and its protection fund, user balances not reduced	4 days (BTC 9/28), all coins 8 days (10/2)	Bitget, The Block
2026-07-26	BitMart	Ceased operations	Size of shortfall not disclosed	The company says it has had a balance sheet shortfall since its 2021 hack; a wave of withdrawals hit in 2026	Not yet: the preliminary plan is a pro rata partial payout first, or conversion into compensation tokens	Still restructuring on 10/12 (78 days so far)	Official notice, Preliminary plan
2025-11-27	Upbit (South Korea)	Hack	₩44.5 billion (about US$30 million to US$37 million)	24 assets in a Solana network hot wallet were withdrawn abnormally	In full: Upbit covered it with its own assets	Networks resumed in stages from 1 day; Solana assets 7 days ※	Byline Network, Upbit notice (republished)
2025-02-21	Bybit	Hack	About US$1.4 billion to US$1.5 billion	During a transfer from cold to warm wallet, the multisig wallet’s signing interface was tampered with	In full: ETH replenished through loans, deposits and OTC purchases	0 days (withdrawals never paused), ETH shortfall closed in about 3 days	The Block, CNBC
2025-01-23	Phemex	Hack	More than US$85 million	Hot wallets on about 16 chains were drained	In full ※: the exchange says user funds are safe; I found no announcement that compensation was completed	1 day (ETH, USDT, USDC)	Phemex, SecurityWeek
2024-11-28	XT.COM	Hack	About US$1.7 million ※	Abnormal transfers out of the platform’s own wallet	In full: the stolen funds were the platform’s own assets	1 day	XT.COM post-mortem
2024-09-20	BingX	Hack	About US$43 million to US$52 million	Hot wallet drained	In full ※: BingX says its reserves covered the loss; I found no independent confirmation	1 day (main assets)	The Block, Cointelegraph
2024-07-18	WazirX (India)	Hack, then restructuring	About US$234 million	Multisig wallet compromised, about 45% of the platform’s assets	Partial: after relaunch, about 85% of “rebalanced assets” distributed first, the rest converted into recovery tokens	463 days (relaunched 2025-10-24)	CoinDesk, Cointelegraph, Outlook Money
2024-05-31	DMM Bitcoin (Japan)	Hack, then closure	4,502.9 BTC, about ¥48.2 billion (about US$306 million)	BTC moved out of the company wallet without authorization	In full: the group raised funds to replace customers’ BTC	281 days (accounts moved to SBI VC Trade on 2025-03-08) ※	gamebiz, The Block
2023-11-22	HTX and the HECO bridge	Hack	About US$113 million (about US$26 million from HTX hot wallets, about US$87 million from the bridge)	Private keys of the bridge and several hot wallets leaked	In full ※: HTX pledged full compensation; I found no evidence it was completed	4 days (BTC, ETH, TRX, USDT)	CertiK, Investing.com
2023-11-10	Poloniex	Hack	More than US$100 million	Hot wallet drained; security firms believe a private key leaked	In full ※: Justin Sun pledged full compensation; I found no evidence it was completed	20 days (announced resumption date, in stages)	Cointelegraph, Cointelegraph
2023-09-24	HTX	Hack	5,000 ETH (about US$8 million)	Hot wallet drained; the hacker returned the funds 13 days later	In full: HTX absorbed the loss	No reports of a withdrawal suspension found; excluded from the day counts	The Block
2023-09-12	CoinEx	Hack	About US$70 million	Hot wallet private keys leaked	In full ※: the exchange pledged 100% compensation; I found no independent confirmation	9 days (11 coins including BTC, ETH and USDT)	Cointelegraph
2022-11-08	FTX	Withdrawal freeze, then bankruptcy	About US$8.7 billion owed to customers	Customer and company funds commingled and misappropriated	In full in US dollars: by the fifth distribution on 2026-07-31, most claim classes had received a cumulative 105% or more, small claims under US$50,000 about 120%; but converted at November 2022 coin prices, not in original coins	833 days (first distribution 2025-02-18)	The Block, Finance Magnates, Unchained
2021-12-04	BitMart	Hack	About US$150 million (official figure at the time), nearly US$200 million by security firms’ estimates; about US$319.5 million per the company’s 2026 statement	Private keys stolen, two hot wallets emptied	In full (official statement at the time); in 2026 the company said this loss created a balance sheet shortfall	3 days (ETH and ERC-20)	Bloomberg Law, Cointelegraph
2021-08-19	Liquid (Japan)	Hack	About US$90 million to US$97 million	MPC warm wallet compromised	Outcome not found ※: the exchange said users would not lose money; FTX provided a US$120 million loan	Date of full resumption not found ※	Cointelegraph, CoinDesk
2020-10-16	OKEx (now OKX)	Withdrawal freeze	No asset loss	One private key holder was cooperating with a Chinese police investigation and could not sign withdrawals	In full: no assets were missing	41 days (2020-11-26)	The Block
2020-09-26	KuCoin	Hack	About US$281 million	Hot wallet private keys stolen	In full: about 84% recovered, the rest covered by the insurance fund	11 days (BTC, ETH, USDT); about 58 days for all coins ※	The Block, CriptoNoticias, Decrypt
2019-11-27	Upbit (South Korea)	Hack	342,000 ETH (about US$49.8 million)	ETH hot wallet funds moved to an unknown address	In full: Upbit covered it with its own assets	47 days (ETH deposits and withdrawals resumed) ※	The Block, Finance Magnates
2019-05-07	Binance	Hack	7,000 BTC (about US$40 million)	Hackers obtained users’ API keys and 2FA codes and withdrew from the hot wallet	In full: absorbed by the SAFU fund	8 days (trading and deposits resumed, withdrawals followed) ※	Binance, TechCrunch
2019-01-31	QuadrigaCX (Canada)	Collapse	About C$250 million owed to about 115,000 users	The founder died, and the cold wallets were later found to be empty	Partial: an interim distribution of about 13% announced in 2023	1,562 days (distribution announced 2023-05-12) ※	BetaKit, CoinDesk
2018-09-14	Zaif (Japan)	Hack	¥6.7 billion (about US$60 million), of which about ¥4.5 billion was user assets	Hot wallet server compromised	Partial: for users who agreed to the transfer to Fisco, BTC and BCH compensated in kind, MONA about 60% in kind and 40% in yen ※	About 221 days (scheduled date for deposits and withdrawals to resume) ※	Bitcoin Magazine, CoinPost
2018-01-26	Coincheck (Japan)	Hack	About 523 million XEM, about ¥58 billion (about US$530 million)	XEM was kept in an internet-connected hot wallet	In full in yen: converted at ¥88.549 per XEM	45 days (2018-03-12 compensation paid and withdrawals of main coins resumed)	ITmedia, Toyo Keizai
2016-08-02	Bitfinex	Hack	119,756 BTC (about US$63 million to US$72 million)	Wallets compromised; the method was never fully disclosed	In full in US dollars: all accounts were first reduced by about 36% and issued BFX tokens instead, all redeemed at US$1 by 2017-04-03	Withdrawals resumed after 8 days; all BFX redeemed after 244 days	Bitfinex, CoinDesk
2014-02-07	Mt.Gox (Japan)	Withdrawal freeze, then bankruptcy	About 850,000 BTC (up to about US$474 million at the time)	The company blamed a transaction malleability bug; outsiders suspected fraud or mismanagement	Partial: distributable assets of about 142,000 BTC, 143,000 BCH and ¥69 billion; repayment deadline extended to 2026-10-31	About 3,801 days (repayments in BTC and BCH began in July 2024) ※	Mt.Gox trustee, The Block, PCWorld

※ Notes:

Upbit 2025: the staged resumption dates of 28 November and 1 December come from media summaries; the Solana date is the “scheduled” resumption date in the announcement.
Phemex, BingX, HTX and HECO, Poloniex, CoinEx: each exchange said it absorbed the loss or pledged full compensation, and withdrawals resumed, but I could not find third-party confirmation that every user was made whole.
XT.COM: the official post-mortem gives about 1 million USDT; security firm PeckShield estimated about US$1.7 million.
DMM Bitcoin: crypto withdrawals on DMM never resumed. Customers could only use their assets after they moved to SBI VC Trade. The transfer date comes from the title of an SBI VC Trade announcement and media summaries, and some customers’ transfers were delayed.
Liquid: on 26 August 2021 the exchange said it was “gradually” resuming deposits and withdrawals. I could not find a date for full resumption, so this one is excluded from the day counts, and whether users got their money back is listed as not found.
KuCoin: the roughly 58 days for all coins is estimated from the dates of media reports.
Upbit 2019: LTC, XRP and EOS resumed a week before ETH, but I could not find the exact date, so the table uses the resumption date for the stolen ETH.
Binance: trading and deposits resumed on 15 May; the exchange said withdrawals would resume “shortly after”, and I could not find the exact time.
QuadrigaCX: 13% is an interim distribution, not the final recovery rate; 1,562 days counts to the announcement date, not the date funds were actually paid.
Zaif: the MONA compensation split comes from Japanese media; 221 days is the scheduled resumption date, and I did not confirm the actual date.
Mt.Gox: counted from the halt of BTC withdrawals on 7 February 2014. Repayments started gradually in June and July 2024, so the day count may be off by about 10 days. Whether the 31 October 2026 deadline will be extended again, check the trustee’s website.

How much users got back: most hacks in full, no collapse returned the original coins

I sorted “what users got back” into four categories: if users’ original coins all stayed in their accounts and could all be withdrawn once withdrawals resumed, that counts as “in full”; if they received the full amount or more after conversion into yen or US dollars, that counts separately as “in full in fiat”; getting back only part counts as “partial”; cases still in progress or with no outcome found are listed separately. Applying these rules to the 25 incidents:

Type	Incidents	In full (original coins)	In full in fiat	Partial	Pending or not found
Hacks (including later restructuring or closure)	20	15	2 (Coincheck, Bitfinex)	2 (WazirX, Zaif)	1 (Liquid)
Withdrawal freeze, no asset loss	1	1 (OKEx)	0	0	0
Collapse or ceased operations	4	0	1 (FTX)	2 (Mt.Gox, QuadrigaCX)	1 (BitMart 2026)
Total	25	16	3	4	2

From this table:

In 19 of the 25 incidents, about 76%, users were eventually made whole, though in 3 of them the payout was converted into yen or US dollars rather than the original coins. Counting only full repayment in original coins, it is 16, about 64%.
17 of the 20 hacks ended in full repayment (85%). For 5 of those 17 (Phemex, BingX, HTX and HECO, Poloniex, CoinEx), the only basis for “in full” is the exchange’s own statement. Leave those 5 out and 12 remain (60%).
None of the 4 collapses returned the original coins. FTX users got back 105% or more in US dollar terms, but claims were converted at November 2022 coin prices, so they missed out on any later price gains. Mt.Gox has about 142,000 BTC to distribute, less than a fifth of the 850,000 lost at the time. How claims are filed after an exchange goes bankrupt, and how much FTX and Mt.Gox users finally got back, is covered in What happens when a crypto exchange goes bankrupt.
In every hack with full compensation, the exchange still had money to cover the loss: Binance used its SAFU fund, Bitget and KuCoin used protection or insurance funds, Bybit borrowed and bought ETH, and DMM Bitcoin’s group injected capital. WazirX, whose users did not get everything back, lost about 45% of the platform’s assets, could not cover it and had to restructure. This is an observation I drew from the table, not proof of cause and effect.

The two BitMart rows need to be read together. When it was hacked in 2021, the company said it would compensate in full, and some withdrawals resumed within 3 days, so in this table it counts as in full. But an official announcement on 30 September 2026 explained that the loss had in fact created a balance sheet shortfall, and BitMart ceased operations in July 2026 (official notice). When an exchange says “users are not affected”, outsiders have a hard time verifying it at that moment, so besides the incident itself, look at its proof of reserves afterwards; see “How to check proof of reserves”.

How long until you can withdraw: a median of 8 days for hacks, about 4 years for collapses

The medians below use the “time to withdraw” day counts from the table. Three incidents are excluded: there were no reports of HTX suspending withdrawals in September 2023, I could not find a resumption date for Liquid, and BitMart is still restructuring in 2026. For staged resumptions like Bitget and KuCoin, I used the date withdrawals of the main assets (BTC, ETH, USDT and so on) first resumed.

Group	Incidents	Median	Shortest	Longest
Hacks	18	8 days	0 days (Bybit)	463 days (WazirX)
Of which 2023 or later	11	4 days	0 days (Bybit)	463 days (WazirX)
Of which 2021 or earlier	7	11 days	3 days (BitMart 2021)	221 days (Zaif)
Withdrawal freeze, no asset loss	1	41 days (OKEx)	—	—
Collapses (to first distribution)	3	1,562 days	833 days (FTX)	3,801 days (Mt.Gox)
All	22	10 days	0 days	3,801 days

Key points:

After most hacks, withdrawals resumed within one to two weeks, but of the 18 with data, 10 took more than 7 days. The longest, WazirX and DMM Bitcoin, took 463 and 281 days respectively.
Hacks since 2023 have been resolved faster, with a median of 4 days compared with 11 days for 2021 and earlier. I found no research confirming why. It may be related to exchanges setting up protection funds and keeping a smaller share of assets in hot wallets, but that is my inference.
Collapses are measured in years. The median for the 3 with data is 1,562 days, a little over 4 years, and the first distribution is usually not everything: QuadrigaCX’s interim distribution was only about 13%.
A withdrawal freeze with no losses can still last a long time. OKEx lost no assets in 2020, but because a private key holder could not sign, users could not withdraw for 41 days.

The sample covers larger incidents with traceable sources. Incidents at small exchanges usually go without full reporting, so in reality the share of full compensation may be lower, and waiting times longer, than the table shows. The table is a compilation of 25 incidents, not a complete set of statistics.

How hacks, withdrawal freezes and collapses differ

Hacks: mostly hot wallets or signing processes compromised

Most of the 20 hacks in the table involved hot or warm wallets being drained: leaked private keys (KuCoin, CoinEx, BitMart), compromised servers (Zaif), or tampering with the multisig signing process, as at Bybit and WazirX. Bitget’s 2026 incident involved the exploitation of a vulnerability in a third-party security product to forge withdrawal instructions. Exchanges usually keep only a small portion of their assets in hot wallets, and when the amount stolen is within what the exchange can absorb, users are mostly unaffected.

What you can do yourself is turn on your account’s security settings: passkeys, a withdrawal whitelist and an anti-phishing code; see “Exchange account security settings compared”. These settings only protect your own account from being taken over, though. They cannot stop the exchange itself from being hacked.

Withdrawal freezes: not always an asset loss

A withdrawal freeze is sometimes a precaution after a hack (Bitget and BingX, for example), and sometimes has nothing to do with lost assets. OKEx in 2020 froze because a private key holder was cooperating with an investigation; no assets were missing, but users could not withdraw for 41 days. FTX and Mt.Gox, by contrast, froze withdrawals first and only later confirmed they did not have enough assets to repay. At the moment withdrawals are frozen, users cannot tell which kind it is, which is why the amount you keep on an exchange should stay within what you can afford to lose.

Collapses: misappropriated assets or a shortfall too large

In all 4 collapses, the problem went beyond a hack. FTX misappropriated customer funds; QuadrigaCX’s cold wallets were found empty after its founder died; Mt.Gox lost about 850,000 BTC; BitMart’s shortfall from its hack dragged on for years. Once bankruptcy or restructuring proceedings begin, users’ balances become “claims”, which can only be paid out after a court approves a plan, and the amounts are usually converted at prices as of the filing.

How exchange incidents affect the ratings

Jason Finance’s exchange ratings include an item for “past incidents and how they were handled”, worth 15% of the total score; the scoring rules are in “Exchange rating methodology”. The item starts at 10 points, and the same type of incident costs different points depending on how it was handled: a hack with full compensation for users and no withdrawal pause costs 1 point, full compensation but with a withdrawal pause costs 2, no full compensation costs 5, and a full withdrawal freeze of more than 7 days costs 3.

The numbers in the table show why it is designed this way:

How an incident is handled matters more than its size. About US$1.5 billion was stolen from Bybit, but withdrawals never paused and the shortfall was closed in 3 days. About US$234 million was stolen from WazirX, and users waited 463 days to get back only part. Both were hacks, but the impact on users was very different, so “full compensation or not” carries the biggest difference in points.
A withdrawal pause is a cost in itself. Among the hacks with data, more than half paused withdrawals for over 7 days. Even if users are compensated in full in the end, they cannot touch their assets during that time, so “full compensation with a withdrawal pause” loses 1 point more than “no pause”.
The ratings only count incidents from 2018 onward, and deductions for incidents more than 5 years old are halved, so events like Mt.Gox and Bitfinex in 2016 do not affect current scores. Together with FTX, though, they show the cost of a collapse, and that is the risk the proof of reserves and licence items in the ratings look at.

You can compare each exchange’s current incident record and score in the detail table below:

Data checked: 2026-10-08

Binance 69.8 / 100

Among the deepest BTC and ETH order books zk-SNARK proof of reserves 2023 US guilty plea

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	8	2026-10-01 (monthly): BTC 100.35%, ETH 100%, USDT 103.88%; self-verifiable	2026-10-08
Account security (5%)	10	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	2	2019-05 hack, repaid but withdrawals paused 2021-06 regulator warning 2021-07 other enforcement or fine 2023-11 criminal plea or major fine 2024-02 other enforcement or fine 2024-04 regulator warning 2024-05 other enforcement or fine 2024-06 other enforcement or fine	source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8
Track record & transparency (5%)	8	operating since 2017; terms name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	6.8	Abu Dhabi FSRA licence, Dubai VARA licence, Bahrain CBB licence, Japan FSA registration (Binance Japan) Restricted regions (TW/HK/SG/MY): HK, SG, MY	source 1 source 2 source 3 source 4 source 5
Volume & depth (20%)	9.1	BTC/USDT about 23.8M USD, ETH/USDT about 17.9M USD	2026-10-08
Fees (10%)	4	Spot 0.1%, futures 0.05%; a 20% trading fee discount	2026-10-08
Transfer networks (5%)	10	Cheapest BEP20 0.01 USDT; 7 common networks supported	2026-10-08
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-09

Gate 66.4 / 100

EU MiCA, Dubai VARA, Japan and other licences Publishes only an overall reserve ratio

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	5	2026-09-13 (monthly): overall 117% (no per-asset figures); self-verifiable	2026-10-08
Account security (5%)	10	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	8	2021-12 other enforcement or fine 2025-04 regulator warning 2026-05 regulator warning	source 1 source 2 source 3
Track record & transparency (5%)	8	operating since 2013; terms do not name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	6.5	EU MiCA (Malta MFSA), Dubai VARA licence, Japan FSA registration (Gate Japan), Bahamas SCB licence, Gibraltar GFSC licence, Australia AUSTRAC registration, Cyprus CySEC investment firm licence Restricted regions (TW/HK/SG/MY): HK, SG, MY	source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8
Volume & depth (20%)	8.6	BTC/USDT about 24.4M USD, ETH/USDT about 9.4M USD	2026-10-08
Fees (10%)	4	Spot 0.1%, futures 0.05%; a 20% trading fee discount	2026-10-08
Transfer networks (5%)	0	Data incomplete, scored 0
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-10

OKX 63.6 / 100

Monthly zk-STARK proof of reserves Auto Earn on idle VIP trading balances EU MiCA and Dubai VARA licences

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	7	2026-09-08 (monthly): BTC 109%, ETH 101%, USDT 105%; self-verifiable	2026-10-08
Account security (5%)	10	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	2.5	2020-10 withdrawals halted 2025-02 criminal plea or major fine 2025-04 other enforcement or fine 2025-06 regulator warning 2026-09 other enforcement or fine	source 1 source 2 source 3 source 4 source 5
Track record & transparency (5%)	8	operating since 2017; terms name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	5.5	EU MiCA (Malta MFSA), Dubai VARA licence, Singapore MAS licence, Australia AUSTRAC registration Restricted regions (TW/HK/SG/MY): HK, MY	source 1 source 2 source 3 source 4 source 5
Volume & depth (20%)	7.5	BTC/USDT about 15.3M USD, ETH/USDT about 8.9M USD	2026-10-08
Fees (10%)	4	Spot 0.1%, futures 0.05%; a 20% trading fee discount	2026-10-08
Transfer networks (5%)	9	Cheapest Arbitrum 0.0033 USDT; 6 common networks supported	2026-10-08
Earn (5%)	10	flexible, redeem anytime, daily rate, auto earn, platform fee disclosed	2026-10-07

Bitget 63.5 / 100

Disclosed protection fund BTC reserve ratio 142% Sept 2026 hack covered by its protection fund

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	8	2026-09-29 (monthly): BTC 142%, ETH 110%, USDT 107%; self-verifiable	2026-10-08
Account security (5%)	8	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes	2026-10-08
Incidents (15%)	7	2023-03 regulator warning 2026-09 hack, repaid but withdrawals paused	source 1 source 2
Track record & transparency (5%)	8	operating since 2018; terms name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	2	El Salvador CNAD licence, South Africa FSCA licence, Mauritius FSC licence, Australia AUSTRAC registration, Argentina CNV registration Restricted regions (TW/HK/SG/MY): HK, SG, MY	source 1 source 2 source 3 source 4 source 5 source 6
Volume & depth (20%)	6.4	BTC/USDT about 10.6M USD, ETH/USDT about 5.7M USD	2026-10-08
Fees (10%)	3.2	Spot 0.1%, futures 0.06%; a 20% trading fee discount	2026-10-08
Transfer networks (5%)	10	Cheapest BEP20 0.01 USDT; 7 common networks supported	2026-10-08
Earn (5%)	10	flexible, redeem anytime, daily rate, auto earn, platform fee disclosed	2026-10-10

BingX 59 / 100

BTC reserve ratio 146% 2024 hack, pledged to cover losses

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	8	2026-09-15 (monthly): BTC 146.52%, ETH 128.32%, USDT 122.17%; self-verifiable	2026-10-08
Account security (5%)	10	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-09
Incidents (15%)	6	2023-12 regulator warning 2024-09 hack, repaid but withdrawals paused	source 1 source 2
Track record & transparency (5%)	6	operating since 2018; terms name the operating company; leader not disclosed	2026-10-08
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): HK, SG	source 1
Volume & depth (20%)	8.5	BTC/USDT about 19.1M USD, ETH/USDT about 16.1M USD	2026-10-08
Fees (10%)	6.5	Spot 0.1%, futures 0.05%; a 45% trading fee discount	2026-10-08
Transfer networks (5%)	0	Data incomplete, scored 0
Earn (5%)	5	flexible, daily rate	2026-10-09

Bybit 58.2 / 100

Hacken-verified monthly proof of reserves 2025 hack: users made whole, withdrawals stayed open EU MiCA authorisation

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	9	2026-09-23 (monthly): BTC 104%, ETH 103%, USDT 110%; self-verifiable, third party: Hacken	2026-10-08
Account security (5%)	10	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	6	2022-06 other enforcement or fine 2022-05 regulator warning 2025-01 other enforcement or fine 2025-02 hack, fully repaid	source 1 source 2 source 3 source 4
Track record & transparency (5%)	6	operating since 2018; terms do not name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	4	EU MiCA (Austria FMA), UAE SCA licence, India FIU registration Restricted regions (TW/HK/SG/MY): HK, SG	source 1 source 2 source 3 source 4
Volume & depth (20%)	5.6	BTC/USDT about 8.2M USD, ETH/USDT about 4.1M USD	2026-10-08
Fees (10%)	1.5	Spot 0.1%, futures 0.055%	2026-10-08
Transfer networks (5%)	0	Data incomplete, scored 0
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-13

Ourbit 55.7 / 100

0% spot fees Reserves verified per asset No verified licence

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	5	2026-10-01 (irregular): BTC 110.31%, ETH 108.76%, USDT 102.56%; self-verifiable	2026-10-08
Account security (5%)	6	withdrawal whitelist, anti-phishing code, withdrawal lock after security changes	2026-10-09
Incidents (15%)	6	2026-05 regulator warning	source 1
Track record & transparency (5%)	2	founding year not verified; terms name the operating company; leader not disclosed	2026-10-08
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): SG	source 1
Volume & depth (20%)	7.1	BTC/USDT about 12.7M USD, ETH/USDT about 8.5M USD	2026-10-08
Fees (10%)	9	Spot 0%, futures 0.04%; a 50% trading fee discount	2026-10-08
Transfer networks (5%)	10	Cheapest BEP20 0.01 USDT; 7 common networks supported	2026-10-09
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-10

MEXC 55.6 / 100

0% spot maker fee Hacken-verified proof of reserves No verified licence

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	9	2026-09-10 (monthly): BTC 297%, ETH 111%, USDT 119%; self-verifiable, third party: Hacken	2026-10-08
Account security (5%)	8	passkey or hardware key, withdrawal whitelist, anti-phishing code, withdrawal lock after security changes	2026-10-08
Incidents (15%)	6	2023-03 regulator warning 2022-09 regulator warning 2023-10 regulator warning 2024-03 regulator warning 2025-09 regulator warning 2026-03 regulator warning 2026-05 other enforcement or fine	source 1 source 2 source 3 source 4 source 5 source 6 source 7
Track record & transparency (5%)	6	operating since 2018; terms do not name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): HK, SG, MY	source 1
Volume & depth (20%)	1.6	BTC/USDT about 2.1M USD, ETH/USDT about n/a USD	2026-10-08
Fees (10%)	9	Spot 0.05%, futures 0.01%; a 20% trading fee discount	2026-10-13
Transfer networks (5%)	10	Cheapest Polygon 0.0065 USDT; 7 common networks supported	2026-10-08
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-10

WEEX 54 / 100

Deep BTC/USDT order book Licences not verifiable on registers

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	4	Not published; self-verifiable	2026-10-08
Account security (5%)	6	withdrawal whitelist, anti-phishing code, withdrawal lock after security changes	2026-10-08
Incidents (15%)	6	2023-06 regulator warning 2024-12 other enforcement or fine 2025-03 other enforcement or fine	source 1 source 2 source 3
Track record & transparency (5%)	4	operating since 2018; terms do not name the operating company; leader not disclosed	2026-10-08
Licences & regions (15%)	0.5	US FinCEN money services business (MSB) registration Restricted regions (TW/HK/SG/MY): HK, SG	source 1 source 2
Volume & depth (20%)	8.6	BTC/USDT about 18M USD, ETH/USDT about 20.5M USD	2026-10-08
Fees (10%)	5.5	Spot 0.1%, futures 0.08%; a trading fee discount of 60% on futures and 35% on spot	2026-10-08
Transfer networks (5%)	10	Cheapest TON 0.1 USDT; 7 common networks supported	2026-10-08
Earn (5%)	7	flexible, redeem anytime, auto earn	2026-10-09

Pionex 53.8 / 100

0.05% spot fee Latest third-party reserve report from 2022

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	3	2022-12-13 (irregular): BTC 117.6%, ETH 110%, USDT 90.02%; self-verifiable	2026-10-09
Account security (5%)	8	passkey or hardware key, withdrawal whitelist, withdrawal lock after security changes, bug bounty	2026-10-09
Incidents (15%)	6	2025-04 regulator warning 2025-05 other enforcement or fine	source 1 source 2
Track record & transparency (5%)	6	operating since 2019; terms name the operating company; leader not disclosed	2026-10-08
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): HK, SG	source 1
Volume & depth (20%)	9.1	BTC/USDT about 25.9M USD, ETH/USDT about 14.7M USD	2026-10-10
Fees (10%)	5.6	Spot 0.05%, futures 0.05%; a 15% trading fee discount	2026-10-09
Transfer networks (5%)	9	Cheapest Arbitrum 0.13 USDT; 6 common networks supported	2026-10-08
Earn (5%)	7	flexible, redeem anytime, daily rate	2026-10-10

KuCoin 49.5 / 100

EU MiCA authorisation (Austria FMA still bars commencement of business) 2025 US guilty plea

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	5	2026-09-30 (irregular): BTC 109%, ETH 117%, USDT 110%; self-verifiable	2026-10-08
Account security (5%)	8	passkey or hardware key, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	2	2020-09 hack, repaid but withdrawals paused 2021-10 regulator warning 2022-06 other enforcement or fine 2023-12 other enforcement or fine 2024-11 regulator warning 2025-01 criminal plea or major fine 2025-02 regulator warning 2025-09 other enforcement or fine 2026-02 other enforcement or fine 2026-03 regulator warning 2026-03 other enforcement or fine 2026-06 other enforcement or fine	source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 source 9 source 10 source 11 source 12
Track record & transparency (5%)	6	operating since 2017; terms do not name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	2.5	EU MiCA (Austria FMA), Australia AUSTRAC registration Restricted regions (TW/HK/SG/MY): HK, SG, MY	source 1 source 2 source 3
Volume & depth (20%)	4.3	BTC/USDT about 5.8M USD, ETH/USDT about 2.2M USD	2026-10-08
Fees (10%)	7.6	Spot 0.1%, futures 0.06%; a 60% trading fee discount	2026-10-09
Transfer networks (5%)	10	Cheapest TON 0.5 USDT; 7 common networks supported	2026-10-08
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-09

XT.COM 47.9 / 100

2024 hack covered by platform funds Dubai and Seychelles regulators say it is unlicensed

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	5	2026-10-07 (irregular): BTC 112.67%, ETH 111.19%, USDT 112.73%; self-verifiable	2026-10-08
Account security (5%)	8	passkey or hardware key, anti-phishing code, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	4	2022-08 other enforcement or fine 2023-09 other enforcement or fine 2024-11 hack, repaid but withdrawals paused 2024-11 regulator warning 2025-03 other enforcement or fine 2025-03 regulator warning 2026-04 regulator warning	source 1 source 2 source 3 source 4 source 5 source 6 source 7
Track record & transparency (5%)	4	operating since 2018; terms do not name the operating company; leader not disclosed	2026-10-09
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): SG	source 1
Volume & depth (20%)	6.4	BTC/USDT about 11.8M USD, ETH/USDT about 4.4M USD	2026-10-10
Fees (10%)	3.6	Spot 0.2%, futures 0.06%; a trading fee discount of 60% on futures and 35% on spot	2026-10-08
Transfer networks (5%)	10	Cheapest Polygon 0.02 USDT; 7 common networks supported	2026-10-08
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-10

Bitfinex 45.1 / 100

Zero trading fees USDT/USD dollar market Wallet addresses only, no full PoR

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	0	Not published	2026-10-08
Account security (5%)	8	passkey or hardware key, withdrawal whitelist, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	7	2019-04 other enforcement or fine 2021-02 other enforcement or fine 2021-10 other enforcement or fine 2023-10 regulator warning	source 1 source 2 source 3 source 4
Track record & transparency (5%)	10	operating since 2012; terms name the operating company; leader disclosed	2026-10-08
Licences & regions (15%)	0.5	El Salvador CNAD digital asset service provider (DASP) licence Restricted regions (TW/HK/SG/MY): —	source 1 source 2
Volume & depth (20%)	4.4	BTC/USDT about 6.7M USD, ETH/USDT about 1.8M USD	2026-10-08
Fees (10%)	10	Spot 0%, futures 0%; a 6% trading fee discount	2026-10-08
Transfer networks (5%)	9	Cheapest TRC20 0 USDT; 6 common networks supported	2026-10-08
Earn (5%)	3	daily rate, platform fee disclosed	2026-10-10

HTX 41.6 / 100

Under UK and EU sanctions USDT alone at 67% reserves Under UK and EU sanctions since 2026

Item	Score (0–10)	Data behind it	Source
Security & reserves (20%)	5	2026-09-01 (monthly): BTC 104%, ETH 102%, USDT 67%; self-verifiable	2026-10-08
Account security (5%)	8	passkey or hardware key, withdrawal whitelist, withdrawal lock after security changes, bug bounty	2026-10-08
Incidents (15%)	4	2022-06 other enforcement or fine 2023-09 hack, fully repaid 2023-11 hack, repaid but withdrawals paused 2025-10 other enforcement or fine 2026-05 other enforcement or fine 2026-07 other enforcement or fine	source 1 source 2 source 3 source 4 source 5 source 6
Track record & transparency (5%)	0	Data incomplete, scored 0
Licences & regions (15%)	0	None found Restricted regions (TW/HK/SG/MY): HK, SG	source 1
Volume & depth (20%)	6.6	BTC/USDT about 9.9M USD, ETH/USDT about 8M USD	2026-10-08
Fees (10%)	0	Spot 0.2%, futures 0.06%	2026-10-08
Transfer networks (5%)	8	Cheapest BEP20 0.01 USDT; 5 common networks supported	2026-10-08
Earn (5%)	9	flexible, redeem anytime, daily rate, auto earn	2026-10-10

How to manage assets you keep on exchanges

Across these 25 incidents, users mostly got their assets back, but the wait ranged from 0 days to 10 years, and in none of the collapses did users get their original coins back. Other articles on this site make the same points:

Keep on an exchange only what you need for trading and can afford to lose. Keep long-term holdings in a cold wallet where you hold the private keys yourself; for the checks to run after buying a cold wallet, see “Ledger theft incident”.
Spread across different exchanges. Most hacks in the table affected only one exchange. If your assets are spread out, you still have somewhere to go when one exchange freezes withdrawals.
After an incident, look at how it is handled, not just the announcement: whether the exchange disclosed the amount lost, whether it has a protection fund, when withdrawals resume, and whether its later proof of reserves gets back to 100% or more. For the criteria to look at when choosing an exchange, see “How to choose a crypto exchange”.

FAQ

If an exchange is hacked, do users get their money back?

Mostly yes, but it depends on whether the exchange can absorb the loss. Of the 20 hacks covered in this article, users were eventually made whole in 17 (Coincheck and Bitfinex in yen or US dollars), WazirX and Zaif users got back only part, and I could not find the full outcome for Liquid.

When an exchange collapses, how long do users usually wait to get money back?

Years. For Mt.Gox, QuadrigaCX and FTX, the time from the incident to the first distribution was about 3,801, 1,562 and 833 days respectively, a median of 1,562 days, or a little over 4 years. BitMart announced it would cease operations on 26 July 2026 and was still restructuring on 12 October.

How long does it usually take for an exchange to resume withdrawals?

Across the 18 hacks in this article with data, the median time for the main assets to resume withdrawals was 8 days. The fastest was Bybit, which never paused; the slowest was WazirX, which stayed frozen for 463 days. For the 11 hacks since 2023, the median was 4 days.

How much did FTX users get back?

Measured in US dollar value at the November 2022 bankruptcy filing, by the fifth distribution in July 2026 most claim classes had received a cumulative 105% or more, and small claims under US$50,000 about 120%. But claims were converted into dollars at the coin prices of that time; users did not get their original coins back.

Where do Mt.Gox repayments stand?

The Mt.Gox bankruptcy trustee began repaying in BTC and BCH in July 2024, and the deadline has been extended to 31 October 2026. The trustee has about 142,000 BTC available to distribute, far less than the roughly 850,000 BTC lost at the time.

If an exchange has had an incident, does that mean I should not use it?

Not necessarily. An exchange that had an incident but compensated users in full and quickly resumed withdrawals carries very different risk from one whose users never got their money back. Jason Finance's exchange ratings include past incidents and how they were handled as one item, worth 15%, and incidents where users were fully compensated lose fewer points than those where they were not.