Crypto Exchanges: What Protects You, and What Doesn't

Overview

Comparisons of crypto exchanges usually rank fees, listings and liquidity. The variable that matters most is rarely in the table: what happens to your funds when something goes badly wrong.

On 21 February 2025, attackers took roughly $1.5 billion in Ethereum from Bybit — 401,000 ETH redirected during what appeared to be a routine transfer. It is the largest cryptocurrency theft ever recorded, and the FBI attributed it to North Korea's Lazarus Group.

The protection most users assume exists does not. FDIC insurance covers no cryptocurrency of any kind. It applies only to US dollar cash balances held at partner banks, up to $250,000, and from January 2026 US platforms must explicitly label crypto balances as non-deposit products.

Europe's MiCA framework is similarly misunderstood. It is regulation, not insurance — it raises operational standards without creating any government guarantee on crypto holdings. Knowing precisely where those lines fall is more useful than any ranking of exchanges.

The Largest Theft in Crypto History

The Bybit incident reset the scale of what is possible. On 21 February 2025, attackers redirected 401,000 ETH — worth roughly $1.5 billion at the time — from the Dubai-based exchange into wallets under their control.

The FBI attributed the theft to Lazarus Group, the North Korean state-backed operation also responsible for the 2014 Sony Pictures attack. Proceeds from these operations are widely assessed to fund the country's nuclear and ballistic missile programmes.

That attribution changes how the risk should be understood. An exchange holding significant assets is not merely defending against opportunistic criminals. It is a target for a nation-state with dedicated resources, patience, and no meaningful legal exposure — an adversary most commercial security programmes are not designed to withstand.

How the Attack Actually Worked

The mechanism matters because it defeats the intuition that a bigger exchange is a safer one. Bybit's own systems were not breached directly.

The attackers exploited a vulnerability in the user interface source code of Safe Wallet — a free software platform Bybit used in its multi-signature transaction process — most likely combined with phishing and malware to gain access. When the exchange's chief executive reviewed what looked like a routine transfer, the displayed transaction had been altered. He approved what appeared legitimate, and the funds went elsewhere.

Multi-signature approval is supposed to prevent exactly this. It failed because the compromise was at the interface layer: every signer saw a screen showing a transaction that was not the one being signed. The controls worked as designed on information that had already been falsified — a supply chain attack through a third-party tool, not a failure of the exchange's own vault.

Where the Money Went in 48 Hours

Recovery in cryptocurrency is governed by speed, and the attackers were considerably faster than any response could be.

At least $160 million was laundered within the first 48 hours. In the days that followed, the vast majority of the stolen assets moved through crypto mixers — services that obscure the origin and destination of transactions.

This is the practical difference between crypto theft and conventional bank fraud. A wire transfer moves through institutions that can freeze it, reverse it, and are legally obliged to cooperate. A blockchain transaction settles in seconds, irreversibly, and mixers break the chain of custody before investigators can act. Perfect public transparency turns out to be entirely compatible with never getting the money back.

Bybit Closed the Gap in 72 Hours

What happened next is the most creditable part of the episode and deserves stating plainly. Bybit fully closed the ETH shortfall in client assets within 72 hours.

It did so through emergency partnerships with Galaxy Digital, FalconX and Wintermute, alongside support from competing exchanges including Bitget and MEXC, and from DWF Labs. Rival platforms extended assistance to a competitor facing an existential shortfall, on the reasoning that a disorderly collapse would have damaged the entire sector.

The exchange also launched LazarusBounty, a bounty platform aimed specifically at recovering funds stolen by the group. Customers were made whole — but they were made whole because the company had the balance sheet and the relationships to cover a $1.5 billion hole in three days. That is a corporate capability, not a customer protection, and it is not something a depositor can verify in advance.

Why 'Zero Hacks' Is Never a Safe Claim

Exchange marketing frequently advertises flawless security records, and the claim deserves scepticism regardless of which platform makes it.

A clean history describes the past. It says nothing about current architecture, third-party dependencies, or whether a nation-state has taken an interest. Bybit was a major, well-resourced exchange with no comparable prior incident until the day it suffered the largest theft in the sector's history — and the vector was a free third-party tool rather than anything a customer could have assessed.

Security is a property of systems that change constantly, not a permanent attribute earned by surviving so far. An exchange that has never been breached and one that is currently secure are different claims, and only the first can be evidenced.

FDIC Insurance Does Not Cover Crypto

This is the most consequential misunderstanding in retail crypto, and it is worth stating without qualification: FDIC insurance does not cover cryptocurrency. Not Bitcoin, not Ethereum, not any token, at any platform.

MiCA Is Regulation, Not Insurance

European users face a parallel misunderstanding. The Markets in Crypto Assets regulation has brought genuine supervisory standards to EU crypto services, and Coinbase secured its MiCA licence from Luxembourg's CSSF, enabling it to serve all 27 member states.

MiCA establishes operational, governance and disclosure requirements. It does not create a deposit guarantee. The EU's Deposit Guarantee Schemes Directive protects fiat bank deposits up to €100,000, and it does not extend to crypto holdings — including at MiCA-licensed platforms.

If a licensed provider fails, you have stronger legal recourse than at an unregulated offshore venue: defined obligations, a supervisor, and an enforceable framework. What you do not have is an automatic government payout on your tokens. Licensing improves the odds and changes the process; it does not transfer the loss.

What Segregation Actually Gives You

The most meaningful protection to emerge recently is structural rather than insurance-based. Following reforms in 2025, digital assets must be legally segregated from a platform's own operating funds.

This addresses the failure mode behind several historic collapses, where customer assets were commingled with corporate funds and used to cover trading losses or operating costs. Under segregation, if the platform enters bankruptcy, customer holdings are not available to pay company creditors — they remain the customer's legally protected property.

Segregation protects against insolvency and misappropriation. It does not protect against theft: assets stolen from a segregated wallet are just as gone. Combined with published proof-of-reserves reporting, which lets users verify holdings are actually present, it addresses the risk that a platform is lying about what it holds — a different problem from a nation-state taking it.

How to Actually Assess an Exchange

Fee tables and listing counts are the easiest things to compare and the least important. The questions that determine what happens in a bad scenario are harder to find and worth the effort.

Conclusion

The most important fact about crypto exchanges in 2026 is that $1.5 billion left one of the largest of them in a single day, through a compromised third-party interface rather than any failure a customer could have assessed. Bybit's customers were made whole in 72 hours because the company could afford it — which was fortunate rather than guaranteed.

The protections people assume they have mostly do not exist for crypto. FDIC insurance covers dollar cash and no tokens whatsoever. MiCA raises standards without providing a guarantee. What genuinely helps is asset segregation, verifiable proof of reserves, and a supervisor with real enforcement powers — none of which reimburses a theft.

The practical conclusion is unglamorous. Choose platforms on the basis of what happens when things fail rather than on fee schedules, verify what is actually covered rather than trusting the marketing, and keep only what you are actively using in someone else's custody.

This article summarises publicly reported incidents and regulatory rules for general information. It is not investment or financial advice, and it is not a recommendation of any platform. Cryptocurrency carries substantial risk including total loss.

Data Source and Attribution

CSISBybit Incident TimelineWilson Center

Details of the February 2025 Bybit incident — amounts, attack vector, attribution, laundering timeline and recovery — come from FBI statements, published analyses by CSIS, the Wilson Center and Paul Hastings, and Bybit's own incident timeline. Deposit insurance rules and the January 2026 digital signage requirements come from FDIC guidance. MiCA licensing and the scope of the Deposit Guarantee Schemes Directive reflect published European regulatory materials.

FactsFigs reviews, cleans, and cross-checks every source dataset before shaping it into a data story. Each visualization is created and designed in FactsFigs Design Studio — an internal tool developed and owned by FactsFigs — and is the original work of a FactsFigs author, not an AI-generated copy of any existing graphic. Individual assets within a visual may or may not be produced with AI tools, but the design of the visual itself is solely FactsFigs' own.

This content is for information only and is not investment, financial or legal advice, nor an endorsement of any platform. Cryptocurrency involves substantial risk including the total loss of funds.

2026-07-20