Recommended Free Tools
If a cryptocurrency exchange is hacked, your coins are not automatically returned, permanently lost, or covered by government insurance. The exchange may freeze withdrawals, isolate affected wallets, investigate, and reimburse customers from reserves or limited insurance. If it cannot cover the shortfall or later becomes insolvent, your exchange balance can become a legal claim whose value and priority depend on the custody contract, asset segregation, jurisdiction, and court orders.
A balance displayed in an exchange account is a custodial claim. It is not equivalent to controlling private keys in your own wallet.
As an Amazon Associate I earn from qualifying purchases.
What a breach can actually affect
“A breach” can describe several different incidents, and the consequences differ substantially:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Account or login systems: Attackers may obtain passwords, session tokens, API keys, personal information, or withdrawal permissions without taking the exchange’s entire wallet inventory.
- Hot wallets: Internet-connected wallets may be drained. The exchange can sometimes isolate the affected addresses and keep other wallets operating.
- Cold-storage keys: A compromise of offline-key procedures can expose a larger share of customer assets, although the exchange may still have emergency controls.
- An external custodian: A third party holding assets for the exchange may be hacked, frozen, or become insolvent.
A withdrawal halt is therefore not proof that every customer balance was stolen. Exchanges commonly pause withdrawals and transfers to preserve evidence, stop further movement, rotate keys, and determine which liabilities remain backed.
#1 Best Overall
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
The practical questions are whether the affected assets can be identified, whether customer liabilities are still fully backed, whether the exchange remains solvent, and what its contract and local law provide.
What usually happens after the exchange discovers a hack
1. Withdrawals and transfers may be paused
The platform may disable withdrawals, deposits, internal transfers, trading, or API access. This can affect unaffected balances because allowing movement before wallet controls are secured could help attackers or destroy evidence. A pause may last hours, days, or longer; there is no universal restoration deadline.
2. The exchange investigates and contains the incident
Security teams review login records, wallet transactions, employee access, signing systems, and the addresses that received stolen assets. They may move remaining funds to new wallets, revoke API keys, require password resets, or impose additional identity checks. The exchange should publish an incident notice explaining the incident time, affected assets, withdrawal status, and customer instructions.
3. The company determines the shortfall
An exchange compares on-chain holdings and other reserves with the crypto it owes customers. If reserves cover the stolen amount, it may restore withdrawals and honor balances after containment. If a deficit exists, the company may use operating cash, reserves, insurance, a special recovery fund, or a contractual reimbursement promise. Those sources can be limited by event type, wallet, policy limit, exclusions, and the legal entity named in the policy.
4. Customers may receive a claims process
If the platform cannot immediately make customers whole, it may announce a claims form, proof-of-balance procedure, distribution schedule, or restructuring. Keep the official instructions and your submission records. A claims process does not guarantee full recovery; it establishes how the company and, potentially, a court will determine what each customer is owed.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of cards, no known remote hacks.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide (4.9 App Store, 4.8 Google Play) - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Is cryptocurrency on an exchange insured?
FDIC insurance does not cover crypto assets
The Federal Trade Commission states: “Cryptocurrency held in accounts is not insured by a government like U.S. dollars deposited into an FDIC insured bank account.” FDIC deposit insurance protects qualifying bank deposits, not the value of bitcoin, ether, tokens, or a crypto balance held by an exchange. The FDIC’s July 29, 2022 advisory warned that statements by crypto companies could cause customers to mistakenly believe their money or investments were FDIC insured.
Some platforms use insured banks for cash accounts or payment services. That does not make the crypto itself an FDIC-insured deposit. Check which legal entity holds cash, what product is covered, and whether the insurance applies to your specific account.
SIPC is not a general exchange-hack backstop
In a U.S. Securities and Exchange Commission staff FAQ, the answer to whether SIPC protects customer claims for non-security crypto assets held by a SIPC-member broker-dealer is “No.” SIPC protection is therefore not a general guarantee for cryptocurrency held on an exchange. Whether a particular digital asset is a security and whether a broker-dealer relationship exists are fact-specific questions; ordinary exchange crypto balances should not be treated as SIPC-protected by default.
Private insurance can be narrow
Crime, custody, or specie insurance may cover only named entities, specified wallets, defined events, and stated limits. A policy can exclude employee dishonesty, cyber events, key-management failures, or losses above a sublimit. An exchange may also promise reimbursement contractually without having an unlimited insurance policy. Read the custody terms and incident notice rather than relying on a “protected” or “insured” label.
What if the exchange becomes insolvent?
When an exchange cannot pay all liabilities, your displayed coin balance may become a legal claim instead of a deliverable quantity of coins. The outcome can depend on:
Rank #3
- Quality materials: these steel crypto wallets are made of 304 stainless steel with a melting point of over 2500 Fahrenheit degrees, designed and tested to be preservative, fireproof, waterproof, and impact-resistant, and can serve you for a long time
- Products quantity: you will receive a 2-in-1 set of steel bitcoin wallets with matching lock screws, and 1 piece of metal plate marking pen, which is a matching set to help you protect your codes, passwords, and further importantly, your cryptocurrency
- Functions: with these steel crypto wallets you can record information such as fieldworks passphrase in tandem with the BIP39 word list, and they are also compatible with 12 or 24-word seed in most languages, suitable to store your private cryptocurrency information or for many instances where you may need a private cold storage system
- Suitable size: the cold wallet backups are compatible with BIP39 wallets, can work with most hardware wallets, supports up to 24 mnemonics seed phrases, convenient for you to use in coordination with other crypto seed storage devices and wallets
- Multiple ways of locking: you can use the matching screws to lock up the steel bitcoin wallets; You can also lock them up and hide them in other places if you still feel unsafe; The hole on the bitcoin wallet measures 6 mm/ 0.24 inch in diameter, suitable for hanging
- Whether customer assets were legally segregated from company assets.
- Whether the custody agreement says the customer owns specific assets, a pooled entitlement, or a contractual payment claim.
- Which legal entity held the coins and which country’s insolvency law applies.
- Whether a court orders a particular distribution, sale, or conversion into cash.
- Whether other creditors have priority over customers.
If assets are not recognized as segregated customer property, a customer may rank as a general unsecured creditor. That can mean receiving a pro-rata distribution after higher-priority claims, potentially in cash or a different asset, and potentially for less than the account’s displayed amount. A bankruptcy filing can also lock customers out of accounts while administrators reconcile records. The FTC’s Voyager alert described customers being locked out after bankruptcy and losing money; it also reiterated that FDIC insurance does not cover crypto assets.
Do not assume that an account statement proves you own coins held in a particular wallet. The governing custody agreement, records of segregation, and court orders control the legal result.
Can stolen crypto be traced or frozen?
Public blockchains can make transaction paths visible, but visibility is not the same as recovery. Investigators may follow the receiving addresses, identify services that process deposits, and ask a receiving exchange or other intermediary to freeze funds. Attackers can move assets through multiple addresses, swaps, bridges, privacy-enhancing tools, or jurisdictions, making recovery harder.
Rapid reporting can preserve evidence and improve the chance that an intermediary recognizes a stolen deposit. No regulator, tracing service, or exchange can promise a reversal. A blockchain transaction that has been confirmed generally cannot be canceled by a customer.
Examples show why the headline loss is not the answer
The CFTC record discusses a January 2022 breach involving Crypto.com in which stolen ETH and BTC were valued near $33 million at the time, according to the record’s summary of the incident. The amount reported in a headline does not establish that every customer lost funds or that the platform was insolvent. To understand the customer outcome, ask which wallets and assets were affected, whether liabilities remained fully backed, whether withdrawals were restored, and what reimbursement terms were announced.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
The CFTC record also discusses FTX and Celsius as examples of custody and insolvency risks. Those cases illustrate that a platform can fail as a custodian even when a customer can still see a balance on a screen. The legal treatment of each case depends on its contracts, entities, jurisdiction, and court proceedings; one company’s result is not a universal rule.
The FTC reported more than $1.4 billion in cryptocurrency-scam losses in the prior year in a 2023 Voyager-related press release. That figure measures reported scam losses, not losses from exchange breaches, and should not be used as a recovery rate or breach-loss estimate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do immediately if your exchange is breached
- Reach the exchange safely. Type the known address yourself or use a saved bookmark. Do not use links in unexpected emails, direct messages, or texts. Check that the notice is on the exchange’s verified domain.
- Record the incident details. Save the incident time, affected assets, withdrawal status, claim instructions, support ticket number, and every official update. Capture account balances and open orders if you can do so without interacting with suspicious prompts.
- Secure your email account first. Change its password to a unique one, revoke unknown sessions and app access, and enable an authenticator-based second factor. An attacker who controls email can reset the exchange account.
- Secure the exchange account and API access. Change the exchange password, remove unknown devices, rotate or delete API keys, review withdrawal addresses and account permissions, and disable trading or transfer permissions you do not need.
- Preserve evidence. Export statements, wallet addresses, transaction hashes, screenshots, emails, and support correspondence. Keep original files and timestamps. Do not delete or alter records that investigators may need.
- Respond to identity exposure. If personal information was exposed, obtain your credit reports, place a credit freeze or fraud alert, and use legitimate monitoring or identity-theft insurance offered through the incident response. Report identity misuse through IdentityTheft.gov.
- Report suspected criminal theft. Notify the exchange and report to the FBI’s Internet Crime Complaint Center or local law enforcement. Fast reporting may help an investigation, but no agency can promise that a confirmed blockchain transaction will be reversed.
- Reject recovery scams. Never pay an unsolicited “recovery agent,” tax, unlock fee, or blockchain-tracing fee. The FBI warns that recovery-fraud operators request upfront or additional payments. An exchange freezes an account through its internal controls or legal process, not because a stranger demands money.
Custodial exchange storage versus self-custody
Moving assets to a hardware wallet can reduce exposure to exchange insolvency, withdrawal controls, and exchange-wallet theft. It does not recover coins already stolen, and it transfers responsibility for key security to you.
| Factor | Exchange custody | Self-custody hardware wallet |
|---|---|---|
| Private-key control | The exchange or its custodian controls signing keys; your balance is a contractual claim. | You control the private keys and authorize transactions. |
| Availability | Convenient trading and recovery tools, but withdrawals can be paused or restricted. | Transfers do not depend on an exchange’s withdrawal queue, but you must operate the wallet correctly. |
| Counterparty risk | Exposure to hacking, insolvency, custody contracts, and legal orders. | Less exchange-counterparty exposure, but loss or compromise of your keys can be irreversible. |
| Insurance | Government insurance generally does not cover non-security crypto; private coverage may be limited. | No exchange insurance applies. Your protection depends on your own security and any separate policy. |
| Recovery path | Password and identity recovery may be available, subject to platform controls. | A seed phrase can restore access if stored correctly; losing or exposing it can permanently destroy control. |
| Operational burden | Lower day-to-day complexity. | You must verify device authenticity and addresses, protect the seed phrase, maintain backups, and plan inheritance. |
How to move assets safely
- Buy the device through an authorized channel and inspect packaging and setup instructions.
- Initialize it yourself; never accept a prewritten seed phrase or share the phrase with anyone.
- Write the seed phrase on a durable backup and store it offline in a secure place. Do not photograph or upload it.
- Verify the receiving address on the wallet’s trusted screen, not only on a potentially compromised computer.
- Send a small test transaction before moving a larger balance, then confirm the destination and network.
- Document an inheritance plan without revealing the seed phrase to an untrusted person.
How to evaluate an exchange before keeping funds there
No exchange can eliminate technical or legal risk, but its disclosures can reveal how much uncertainty you are accepting. Review these items before depositing material amounts:
Quick Recap
- Legal entity and jurisdiction: Identify the contracting company, its regulator or registration status, and the law governing the custody agreement.
- Segregation language: Look for a clear explanation of whether customer assets are held separately, how pooled wallets are accounted for, and what happens in insolvency.
- Custody and lending terms: Check whether the platform may rehypothecate, lend, stake, pledge, or convert assets and whether those activities change your claim.
- Proof-of-reserves limits: A snapshot can show selected assets at one time but may not prove complete liabilities, ownership of every wallet, or the absence of hidden obligations.
- Withdrawal controls: Understand address whitelists, waiting periods, identity checks, limits, and the circumstances in which withdrawals may be suspended.
- Insurance disclosures: Identify the insured legal entity, covered wallets and events, policy limits, exclusions, and whether coverage is shared among customers.
- Incident history and communication: Favor clear notices, dated status updates, and a documented support and claims process over vague security marketing.
Questions to ask when reading an incident notice
- Which assets, networks, wallets, and legal entities were affected?
- Was customer personal information or only a wallet-signing system involved?
- Are customer liabilities still fully backed, and how was that determination made?
- Which functions are paused, and what conditions must be met before restoration?
- Will the exchange reimburse customers, and is the promise capped or conditional?
- Is there a claims deadline, and what records must customers submit?
- Which official support channels are valid, and how will the exchange identify legitimate representatives?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
