Two exchanges can lose a fortune in the same month and still reach opposite endings. The deciding factor is not how much was taken, but whether the loss was a security event or a solvency event. That distinction, more than any headline figure, determines whether a depositor ever gets their money back.
When Binance disclosed a hot-wallet breach on October 29, 2026, it put the damage at roughly $6.3 billion by its own estimate, the largest exchange theft on record, and said it would cover the loss. The pattern is not new. In February 2025 the FBI attributed a theft of about $1.5 billion from Bybit to North Korean actors it calls TraderTraitor, and Bybit refilled the missing assets within three days. In September 2026 Bitget reported a final figure near $388 million after a flaw in a third-party security product let attackers forge withdrawals; the exchange stated that private keys were not compromised, that cold wallets were unaffected, and that its protection fund would cover the loss. In each case the platform stayed open and paid, or pledged to pay.
A collapse is a different failure. Mt. Gox stopped honoring withdrawals in 2014 and entered civil rehabilitation; its trustee has now pushed the repayment deadline out to October 31, 2027, more than a decade after the failure. FTX absorbed a roughly $477 million SIM-swap theft on the same night it filed for bankruptcy, and its customers were repaid through a court plan rather than a company promise. The gap between these outcomes is not luck. It is the balance sheet behind the platform.
That gap changes what a depositor should actually check. A hack is a test of whether an exchange can absorb a loss without touching customer funds, through segregated reserves, an insurance or protection fund, or its own equity. A collapse is a test of whether the exchange’s obligations exceed its assets, a solvency question that no security claim can answer. Exchanges that survived major thefts generally had the capital to make depositors whole. Exchanges that failed generally did not, whatever their security promises. The label matters because it sets expectations: a breach is bad news that a solvent firm can survive, while insolvency is a permanent condition no patch can fix.
For a customer, the practical questions follow directly. Does the exchange keep customer assets separate from its own, or does it commingle them? Does it publish reserves and maintain a protection fund, or ask for trust in the brand alone? And what has it done after a real incident: kept its promise, or opened a years-long repayment queue? The same pattern repeats across every major incident on record: solvent platforms reopen and repay, while insolvent ones enter a court process that stretches for years. A platform you can recover from after a theft is a security risk. A platform that cannot pay what it owes is a different category entirely.
Source: BTC-Pulse.