Crypto Exchange Security: How Exchanges Protect Funds

By the Guardian team Updated November 2026 6 min read

Quick answer. Exchanges keep most customer assets in offline cold wallets and pass withdrawals through limits, allowlists and multi-person approval. To judge one, check its regulator, cold share, proof of reserves with liabilities, phishing-resistant login and past incidents.

Watch: Crypto Exchange Security: How Exchanges Protect Funds 1:48

Video transcript

The biggest exchange hacks did not break cryptography. They went through people, devices and signing systems.

A fake recruiter, a mismatched signing screen, malicious wallet code and engineers' devices. Those were the published ways into DMM Bitcoin, WazirX, Bybit and Binance.

Most assets sit offline in cold wallets. Hong Kong expects 98 percent, Singapore at least 90. Yet Bybit's loss came from its cold wallet.

Every theft ends as a signed transaction, so guard the path: allowlists, limits, delays for new addresses, multi-person approval and readable signing details.

Binance says its attacker started transactions outside the normal withdrawal process. So ask what can bypass the policy.

Insiders and vendors are doors too, as Coinbase and DMM Bitcoin found. For logins, Hong Kong expects phishing-resistant methods like passkeys.

Proof of reserves helps, but PCAOB staff warned these reports are not audits and likely miss liabilities. Look for verifiable liabilities and independent assurance.

To judge an exchange, ask about its regulator, cold share and reserves. Then check login options, testing and how losses are covered.

Guardian's offchain team, led by Carlos Polop, pentests web apps, APIs, cloud and threshold signers. Our MDR team responds around the clock, with a 15-minute SLA on critical alerts.

Read the full guide, or talk to Guardian about testing your exchange the way attackers do.

Crypto exchange security comes down to four questions. Where are the keys, what can make them sign, who can reach that, and are the assets really there?

The largest losses turn on the middle two. In October 2026, about $6.36 billion left Binance wallets, per TRM Labs, after attackers reached a wallet signing service, Binance says.

This guide covers the controls for exchange operators, and how institutions and users can judge them. Each section points to a deeper guide.

Why Exchanges Still Get Hacked

The largest exchange losses did not break cryptography. They went through people, devices and the systems that approve signatures.

Exchange	Date	Loss	Path in, as published
DMM Bitcoin	May 2024	4,502.9 BTC, about $308M	Fake recruiter hit a wallet vendor's employee; a transaction request was likely altered
WazirX	Jul 2024	Over $230M	WazirX says what signers saw did not match what they signed
Bybit	Feb 2025	About $1.5B	Malicious Safe{Wallet} code disguised a cold wallet transfer
Binance	Oct 2026	About $6.36B	Binance says engineers' devices led to a wallet signing service

The FBI attributes DMM Bitcoin, Bybit and Binance to North Korea's TraderTraitor group.

WazirX and its wallet provider, Liminal, each say the compromise did not start on their side. WazirX cites a Mandiant probe; Liminal cites a Grant Thornton review.

Japan's FSA said in April 2026 that the safe management of cryptoassets "cannot be ensured only by the use of cold wallets." It points to social engineering and attacks through outsourcees.

Hot, Warm and Cold Wallets

Exchanges tier customer assets by how fast they can move:

Hot: online keys that pay out withdrawals, often automatically.
Warm: online keys behind approvals, used to refill hot wallets.
Cold: offline keys holding most customer assets.

Regulators set the cold share. Hong Kong's SFC expects 98% of client virtual assets in cold storage, and Singapore's MAS at least 90%.

Cold storage narrows the target; it does not remove it. Bybit's loss came from its Ethereum cold wallet during a scheduled transfer.

The SFC says recent overseas incidents point to vulnerabilities "regardless of the custody solutions used," such as HSMs, MPC and multisig.

The SFC also expects compensation cover for 50% of client assets in cold storage and 100% in hot and other storage.

Withdrawals and Signing

Every theft ends as a signed transaction. The controls that matter most sit between a withdrawal request and the signer:

Withdrawals only to allowlisted addresses the client owns.
Size and velocity limits per user, asset and wallet.
A delay for new addresses and a hold for unusual requests.
No single person able to authorize and send a transfer.
Destinations that cannot change after approval.
Signers who see every detail in readable form.
Onchain balances reconciled with the ledger in real time.

Most come straight from custody rules in Hong Kong, Singapore and Japan.

One question cuts across all of them: can anything reach the signer without passing the policy? Binance says its attacker started transactions "outside the normal withdrawal process."

Our guide to exchange withdrawal security controls walks the pipeline step by step, with the rule behind each control.

Insiders and Account Takeover

Insiders and vendors

Insiders already hold access. In May 2025, Coinbase said a threat actor appeared to have paid "multiple contractors or employees working in support roles outside the United States" for customer data.

Coinbase said passwords and private keys were not compromised, and estimated costs at about $180 million to $400 million.

Vendors count too. DMM Bitcoin's attackers came in through an employee of Ginco, a wallet software company, according to the FBI.

Our insider threat program template covers access tiers, dual control and offboarding.

Account takeover

Customers are the other way in. In January 2022, Crypto.com said "transactions were being approved without the 2FA authentication control being inputted by the user."

TechCrunch reported over $34 million taken from 483 users.

Hong Kong's SFC does not consider one-time passwords phishing resistant. Its July 2026 circular expects phishing-resistant methods, such as passkeys or bound devices, for login and device binding by July 8, 2027 at the latest.

It also expects alerts on new devices and surveillance of withdrawals. If a firm lacks adequate measures to prevent, detect and stop large-scale unauthorized transactions after a hack, the SFC will hold it accountable for client losses.

Proof of Reserves and Solvency

The baseline is simple. Hong Kong and New York both expect a platform to hold the same assets, in the same amount, as it owes clients.

Proof of reserves is how an exchange shows it. Binance, for example, publishes a Merkle tree of customer balances each user can check, and says zk-SNARK proofs show no account has a negative net balance.

It has limits. PCAOB staff warned in March 2023 that proof of reserve reports are not audits and cover "a particular moment in time."

They likely do not address liabilities, the staff said, and give no assurance on internal controls.

Supervisors are raising the cadence. After an erroneous payout at Bithumb, Korea's FSC said in April 2026 that major exchanges will reconcile ledgers with wallets every five minutes, with monthly external verification.

Solvency also means absorbing a loss. Binance says SAFU and company funds cover its October 2026 losses, and it had replenished 98% of impacted token assets by October 31.

How to Judge an Exchange

Institutions and careful users can ask these questions. Operators should be able to answer them with evidence.

Ask	A strong answer
Who licenses it for custody?	A named regulator with custody rules, such as the SFC or NYDFS
How much sits in cold storage?	A disclosed share, in line with 90% to 98% rules
Does proof of reserves cover liabilities?	Regular snapshots, with balances you can verify
Can funds go to a new address at once?	Allowlists, with a delay for new addresses
What login does it offer?	Passkeys or security keys, not SMS codes alone
How is it tested?	Recent pentests, and a bug bounty with safe harbor
What happened last time?	A published incident report, and losses covered
How are losses covered?	A fund, insurance or guarantee with stated terms

For operators, our exchange pentesting guide lists the tests, and our bug bounty benchmark compares the top exchanges' programs.

And plan the first hour before you need it, with our incident response plan.

How Guardian Helps

Guardian's fintech security work attacks "the flows that authenticate users, authorize actions and approve withdrawals, function by function."

The offchain team is led by Carlos Polop, Head of Offchain Services and co-founder of HackTricks. It pentests web apps, APIs, cloud and the threshold signers behind wallets.

With Managed Security, Shield watches every internet-facing surface, and a 24/7 MDR team responds with a 15-minute SLA on Critical alerts.

A trust center then turns that work into one page your partners, banks and auditors can read.

Frequently Asked Questions

How do crypto exchanges protect customer funds?

Most assets sit in offline cold wallets: Hong Kong's SFC expects 98% and Singapore's MAS at least 90%. Withdrawals pass limits, allowlists and multi-person approval before signing, and onchain balances are reconciled with the ledger.

Why do crypto exchanges still get hacked?

Attackers go around the cold wallet: through engineers' devices, wallet vendors and the screens signers trust. The DMM Bitcoin, Bybit and Binance losses came through people and signing systems, not broken cryptography.

Is proof of reserves enough to trust an exchange?

No. PCAOB staff warned that proof of reserve reports are not audits, cover one moment in time and likely do not address liabilities. Look for liabilities you can verify, regular snapshots and independent assurance on controls.

How safe are crypto exchanges?

It varies by exchange. Check its regulator, cold storage share, proof of reserves, login options, testing and incident record. Even well-run exchanges get hacked, so how losses are covered matters too.

Sources

Test your exchange the way attackers do

Guardian pentests the logins, APIs, cloud accounts and signing paths that stand between an attacker and your customers' funds.

Talk to Guardian Explore fintech security