Updated Rules checked 2026-10-12
No exchange can honestly be called “safe.” All you can look at is its track record. Of the 13 exchanges this site covers, 7 have had platform wallets drained: Binance, KuCoin, HTX, BingX, XT, Bybit and Bitget, 8 incidents in total. The largest was Bybit’s loss of 401,346 ETH on 2025-02-21 (about USD 1.4 billion to 1.5 billion). The most recent was Bitget on 2026-09-24, with an official final figure of about USD 388 million. After all 8 incidents, the exchanges said the platform would cover user balances or that the hacker had returned the funds.
What hits users more directly is how long withdrawals stay suspended. In Bitget’s 2026 incident, withdrawals for all assets resumed after about 7.5 days. OKX (then called OKEx) was not hacked in 2020, yet it halted withdrawals for about 41 days because a private key holder was cooperating with a police investigation. On the regulatory side, the operating entities of Binance, KuCoin and OKX have all pleaded guilty in the US and paid fines and forfeitures, and regulators in Thailand, the Philippines, India and Japan have issued warnings or blocking orders against several of them.
Below, a summary table covers all 13 exchanges first. Then I work out how many days users waited after each hack and how large the protection funds are, list each exchange’s dated and sourced records, and finish with Taiwan’s FSC list and ways to reduce your risk.
Key points: Of the 13 exchanges this site covers, 7 have had platform wallets drained, 8 incidents in total, and each time the exchange said user balances were unaffected or covered by the platform. On 2026-09-24 about USD 388 million was stolen from Bitget’s hot and warm wallets; withdrawals resumed in batches and were fully restored on 2026-10-02, about 7.5 days in all. OKX halted withdrawals for about 41 days from 2020-10-16 to 2020-11-26 because a private key holder was cooperating with a police investigation, not because of a hack. The operating entities of Binance (2023-11-21, about USD 4.3 billion), KuCoin (2025-01-27, more than USD 297 million) and OKX (2025-02-24, more than USD 504 million) all pleaded guilty in the US. As of the list updated by Taiwan’s Securities and Futures Bureau on 2026-09-29, none of these 13 exchanges is on the anti-money laundering (AML) registration list of Taiwan’s Financial Supervisory Commission (FSC).
The information below was checked against official pages on 2026-10-12 (fact-check date) and is provided for reference.
Safety records of 13 exchanges: who has been hacked, and who has suspended withdrawals?
My inclusion standard: official exchange announcements come first, followed by The Block, CoinDesk, Bloomberg, the US Department of Justice (DOJ) and national regulators’ announcements. Individual users’ account disputes, community rumors and unsourced figures are left out. Where I found no event that meets the standard, the table says “No major public incident found.” For proof of reserves (PoR) I list only the latest snapshot date; for reserve ratios, see exchange proof of reserves compared.
| Exchange | Major security incident | Users compensated? | Withdrawal suspension | Major regulatory record | Protection fund | Latest PoR snapshot |
|---|---|---|---|---|---|---|
| Binance | 2019-05-07, 7,000 BTC | Fully covered by SAFU | 2019, officially estimated at about one week | 2023 US DOJ guilty plea; Japan, India, Philippines, Australia | SAFU 15,000 BTC | 2026-10-01 |
| OKX | No major public incident found | — | 2020, about 41 days | 2025 US DOJ guilty plea; Thailand, Philippines | No separate user protection fund found | September 2026 |
| Bybit | 2025-02-21, 401,346 ETH | Bybit says user assets backed 1:1, gap covered with loans and purchases | Bybit says withdrawals ran as usual | Fine in India; Japan, Thailand, Philippines | No separate user protection fund found | 2026-09-23 |
| Bitget | 2026-09-24, about USD 388 million | Covered by protection fund, balances unaffected | 2026, about 7.5 days | Japan, Philippines | More than USD 300 million (3,705 BTC) | 2026-09-29 |
| MEXC | No major public incident found | — | None found | Japan, India, Philippines | 100 million USDT + 2,000 BTC | 2026-09-10 |
| Gate | No major public incident found | — | None found | India; left Hong Kong in 2024 | Not found | 2026-09-13 |
| BingX | 2024-09-20, amount not disclosed officially | BingX says fully covered | Suspended in 2024, resumption date not found | No major penalty found | More than USD 150 million (Shield Fund), per BingX | 2026-07-15 |
| KuCoin | 2020-09-25, about USD 281 million | 84% recovered, the rest covered by insurance fund | Suspended in 2020, resumed in batches | 2025 US DOJ guilty plea; fine in Canada; Japan, India, Philippines | Current size not found | 2026-09-30 |
| HTX | Two incidents, 2023-09 and 2023-11 | Hacker returned funds / HTX says fully compensated | 2023-11, gradually resumed after about 4 days | India; user agreement bars Taiwan users from derivatives | Not found | 2026-06-01 |
| XT | 2024-11-28, about USD 1.7 million | XT says users unaffected | Suspended in 2024, resumption date not found | Thailand | Not found | 2026-10-07 |
| WEEX | No major public incident found | — | None found | None found | 1,000 BTC, per WEEX | No figures shown on page |
| Pionex | No major public incident found | — | None found | None found | Not found | 2022-12-13 |
| Ourbit | No major public incident found | — | None found | None found | Not found | Not published |
“None found” means that, as of 2026-10-12, I could not find anything that meets the source standard above. It does not mean nothing ever happened. The source for each event is given in each exchange’s section below.
Do users get their money back after an exchange hack? 8 incidents compared
Lined up side by side, the 8 thefts share two things. First, apart from Bybit, where a cold wallet was tampered with during a transfer, the other 7 thefts all hit hot wallets, warm wallets, or, in XT’s case, a “platform wallet” whose type XT did not specify. A hot wallet is the internet-connected wallet an exchange uses for day-to-day withdrawals. Second, each time the exchange said the platform would absorb the loss. The real cost users paid was the time their withdrawals were frozen.
| Date | Exchange | Loss | Wallet hit | How the exchange handled it | Withdrawal suspension |
|---|---|---|---|---|---|
| 2019-05-07 | Binance | 7,000 BTC | BTC hot wallet | Fully covered by SAFU | Officially estimated at about one week |
| 2020-09-25 | KuCoin | About USD 281 million (media estimate) | Hot wallets | 84% recovered; the remaining USD 45.55 million or so covered by the insurance fund | Suspended, then resumed in batches |
| 2023-09-24 | HTX | About 5,000 ETH | Hot wallet | Hacker returned the funds; HTX paid a 250 ETH white-hat bounty | Not found |
| 2023-11-22 | HTX | About USD 30 million, per HTX | Hot wallet (HECO cross-chain bridge also hit) | HTX says fully compensated | Gradually resumed after about 4 days |
| 2024-09-20 | BingX | Not disclosed officially; PeckShield estimated about USD 43 million | Hot wallet | BingX says fully covered | Resumption date not found |
| 2024-11-28 | XT | PeckShield estimated about USD 1.7 million; XT says about 1 million USDT | Platform wallet | XT says users unaffected | Resumption date not found |
| 2025-02-21 | Bybit | 401,346 ETH | ETH multisig cold wallet (during a transfer to a warm wallet) | Replenished ETH with loans, large deposits and purchases | Bybit says withdrawals ran as usual |
| 2026-09-24 | Bitget | About USD 388 million (initially reported as about 351.6 million) | Hot and warm wallets | Covered by the protection fund, which was later topped back up by more than USD 300 million | About 7.5 days |
I calculated the suspension lengths from official timestamps. Bitget detected abnormal outflows at 18:31 (UTC) on 2026-09-24 and reopened BTC withdrawals at 08:00 on 09-28, about 3.5 days later. Other coins, fiat and P2P reopened at 08:00 on 10-02, about 7.5 days in all. OKEx halted withdrawals from 11:00 (Hong Kong time) on 10-16 until 11-26 in 2020, about 41 days. That is the longest suspension in this record, and it had nothing to do with hackers.
Are protection funds big enough? Sizing them in BTC
A protection fund (such as Binance’s SAFU) is money an exchange sets aside itself to deal with extreme events like hacks. I divided the BTC in each protection fund by the user BTC assets shown in the same exchange’s PoR to get a rough size ratio. A protection fund has to cover losses in every coin, so this ratio only helps you gauge its size. It is not a payout cap.
| Exchange | Protection fund | User BTC assets in PoR | Fund BTC ÷ user BTC |
|---|---|---|---|
| Binance | 15,000 BTC (conversion completed 2026-02-12) | 688,572.68 BTC (2026-10-01) | About 2.18% |
| Bitget | 3,705 BTC, shown on the page as more than USD 314 million (updated 2026-10-04) | 20,531.72 BTC (2026-09-29) | About 18.0% |
| MEXC | 100 million USDT + 2,000 BTC (MEXC press release, late September 2026) | 4,106.57 BTC (2026-09-10) | About 48.7% for the BTC portion |
One point stands out: the largest theft on record (Bybit, about USD 1.5 billion) was bigger than Binance’s SAFU of about USD 1 billion. Bybit closed that gap with loans, large deposits and ETH purchases, not with a protection fund. Bitget’s 2026 loss was about USD 388 million; its protection fund was reported at more than USD 464 million at the time, and more than USD 300 million was put back into it on 09-30. Going by these two cases, a protection fund could still absorb a loss on Bitget’s scale. In an extreme event like Bybit’s, it comes down to whether the exchange can raise money from elsewhere.
Is Binance safe? Hack and regulatory record
- 2019-05-07: 7,000 BTC was taken from the BTC hot wallet in a single transaction. Binance announced that it “will use the SAFU fund to cover this incident in full.” Deposits and withdrawals were suspended during the security review, which Binance estimated would take about one week (Binance announcement).
- 2023-11-21: Binance pleaded guilty in the US, with settlements with the Department of Justice, the Treasury and the CFTC totaling about USD 4.3 billion. Founder Changpeng Zhao (CZ) admitted to violating the Bank Secrecy Act, was fined USD 50 million and stepped down as CEO (US DOJ case page). On 2025-10-23 Changpeng Zhao was pardoned by the US president (PBS / AP).
- 2025-05-29: The US Securities and Exchange Commission (SEC), Binance and Changpeng Zhao jointly moved to dismiss the 2023 civil lawsuit, and the case was dismissed with prejudice (SEC release).
- 2026-03-27: Australia’s Federal Court ordered Oztures Trading, the company that runs Binance Australia’s derivatives business, to pay a AUD 10 million penalty for misclassifying 524 retail clients as wholesale clients. It had already compensated clients about AUD 13.1 million (The Block).
- Other regions: Japan’s Financial Services Agency (FSA) issued warnings to Binance for operating without registration on 2018-03-23 and 2021-06-25 (Japan FSA). India’s Financial Intelligence Unit issued non-registration notices to Binance and 8 other offshore platforms on 2023-12-28 and asked for their URLs to be blocked (The Statesman). The Philippines blocked Binance in 2024 (Decrypt).
- Protection fund: On 2026-01-30 Binance announced it would convert SAFU from stablecoins to BTC. The conversion was completed on 2026-02-12, and SAFU holds 15,000 BTC. Binance says it will top the fund back up to USD 1 billion if its value falls below USD 800 million (The Block). The PoR snapshot is taken on the 1st of each month.
Binance’s fees, rebates, proof of reserves and restricted regions are covered in the Binance review.
Is OKX safe? The 2020 withdrawal halt and the 2025 guilty plea
- Security incidents: Under this article’s source standard, no major public incident of platform wallet theft was found (as of 2026-10-12).
- 2020-10-16 to 2020-11-26: From 11:00 (Hong Kong time) on 10-16, OKEx suspended withdrawals of all digital assets because a private key holder was cooperating with a police investigation and could not be reached (Decrypt). On 11-20 it announced that withdrawals would resume before 11-27 and launched a user reward based on holdings and trading volume (The Block). Withdrawals actually resumed on 11-26 (ForkLog).
- May 2024: OKX withdrew its application for a Hong Kong virtual asset trading platform license and stopped offering centralized exchange services to Hong Kong residents from May 31 (The Block).
- 2025-02-24: Aux Cayes FinTech, the entity that operates OKX, pleaded guilty in the US to one count of operating an unlicensed money transmitting business, with a USD 84.4 million fine plus USD 420.3 million in forfeiture, more than USD 504 million in total (US Attorney’s Office for the Southern District of New York).
- 2025: On 2025-05-29 Thailand’s Securities and Exchange Commission announced it would block 5 unlicensed platforms, including OKX, Bybit and XT, from 06-28 (The Block). In August 2025 the Philippine SEC named 10 unregistered platforms, including OKX, Bybit, KuCoin, MEXC and Bitget, and telecom operators then blocked them (Cointelegraph).
OKX’s fees, rebates, proof of reserves and restricted regions are covered in the OKX review.
Is Bybit safe? The USD 1.5 billion theft in 2025
- 2025-02-21: An ETH multisig cold wallet was tampered with during a transfer to a warm wallet, and 401,346 ETH was stolen. On 2025-02-26 the US Federal Bureau of Investigation (FBI) said North Korea was behind the theft of about USD 1.5 billion, activity the FBI calls “TraderTraitor” (FBI IC3 announcement).
- Aftermath: CEO Ben Zhou said client assets remained backed 1:1, and unaffected wallets and withdrawals kept operating normally (Fintech News). Bybit obtained about 447,000 ETH through emergency loans, large deposits and purchases to close the gap, and a later PoR verified by Hacken showed reserve ratios above 100% for its main assets (The Block).
- 2025-01-31: India’s Financial Intelligence Unit fined Bybit INR 92.7 million (9.27 crore) for operating without registration. Bybit suspended its India business from January 12 and resumed on 2025-02-25 after completing registration (Cointelegraph).
- Japan: The FSA issued warnings for operating without registration three times, on 2021-05-28, 2023-03-31 and 2024-11-28 (2024 warning). In February 2025 it asked Apple and Google to remove the Bybit, MEXC, KuCoin, Bitget and LBank apps in Japan (The Defiant). For the 2025 blocks in Thailand and the Philippines, see the OKX section.
Bybit’s fees, rebate options, proof of reserves and restricted regions are covered in the Bybit review.
Is Bitget safe? The 2026-09-24 hot wallet theft
- 2026-09-24: At 18:31 (UTC) Bitget detected abnormal outflows from some hot and warm wallets, involving 12 addresses. The loss was first reported at about USD 351.6 million (CoinDesk) and later confirmed at about USD 388 million. According to Bitget, the attacker used a zero-day vulnerability in a third-party security product to obtain internal credentials, then forged withdrawal instructions to get around risk controls; no private keys were leaked and cold wallets were not affected (Bitget incident page, updated 2026-10-04).
- Impact on users: Bitget said account balances were correct and unaffected, and that the protection fund would cover the loss rather than passing it on to users. Deposits and trading never stopped. Withdrawals resumed in batches: BTC on 09-28, ETH on 09-29, USDT on 09-30, and other coins, fiat and P2P at 08:00 (UTC) on 10-02.
- Protection fund: more than USD 464 million at the time of the incident (The Block, 2026-09-25), and the FAQ on the incident page also gave 5,500 BTC. On 09-28 Bitget pledged to put back at least USD 300 million within a week; on 09-30 it announced that more than USD 300 million had been added, and the incident page shows more than USD 314 million, or 3,705 BTC.
- 2025-04-20: Abnormal trading hit the VOXEL/USDT perpetual contract within about 30 minutes. Bitget restricted suspicious accounts, rolled back the abnormal trades and offered a compensation plan to affected users (The Block).
- Regulation: Japan’s FSA issued warnings on 2023-03-31 and 2024-11-28 and asked for the app to be removed in February 2025; the Philippine SEC named Bitget in August 2025.
Bitget’s fees, rebates, proof of reserves and restricted regions are covered in the Bitget review.
Is MEXC safe?
- Security incidents: No major public incident of platform wallet theft was found (as of 2026-10-12).
- Account freeze dispute: In July 2025 MEXC froze about USD 3.1 million belonging to a trader under its risk control rules. After the case went public, MEXC’s chief strategy officer apologized on 2025-10-31, said the funds had been unfrozen, and said MEXC would set up a fast track for handling account issues (DL News).
- Regulation: Japan’s FSA issued warnings on 2023-03-31 and 2024-11-28 and asked for the app to be removed in February 2025; India’s 2023-12-28 non-registration notice list included MEXC Global; the Philippine SEC named MEXC in August 2025.
- Protection fund: The Guardian Fund was set up in June 2025 with USD 100 million. A MEXC press release from late September 2026 says it now holds 100 million USDT plus 2,000 BTC, with plans to grow it to USD 500 million within two years (MEXC press release).
MEXC’s fees, rebates, proof of reserves and restricted regions are covered in the MEXC review.
Is Gate safe?
- Security incidents: Under this article’s source standard, no major public incident was found (as of 2026-10-12).
- Regulation: India’s 2023-12-28 non-registration notice list included Gate.io. In 2024 Gate.HK withdrew its Hong Kong license application, stopped trading on May 28 and asked users to withdraw their assets by August 28 (Fintech News Hong Kong).
- Protection fund: I could not find an officially published current size.
Gate’s fees, rebates, proof of reserves and restricted regions are covered in the Gate review.
Is BingX safe? The 2024 hot wallet incident
- 2024-09-20: At about 04:00 (Singapore time) BingX detected abnormal network access and suspected an attack on its hot wallet, so it moved assets and suspended withdrawals. BingX said the loss was “minor,” that it would cover it in full and that user assets were safe, but it never published a final figure. Security firm PeckShield estimated about USD 43 million (The Block).
- Regulation: No major penalty found (as of 2026-10-12).
- Protection fund: BingX’s official pages state a Shield Fund of more than USD 150 million, funded by BingX itself. That is BingX’s own figure (BingX Shield Fund, BingX security and trust page). The fund is stated in US dollars and BingX has not published a BTC amount, so it is not in the BTC table above.
BingX’s fees, rebates, proof of reserves and restricted regions are covered in the BingX review.
Is KuCoin safe? The 2020 hack and the 2025 guilty plea
- 2020-09-25: Private keys to several hot wallets were obtained, with losses of about USD 281 million. On 2020-11-11 the CEO announced that 84% had been recovered (The Block). A later update said the remaining 16% or so, about USD 45.55 million, was covered by the insurance fund (Decrypt).
- 2025-01-27: Peken Global, the entity that operates KuCoin, pleaded guilty in the US to one count of operating an unlicensed money transmitting business, with a USD 112.9 million fine plus USD 184.5 million in forfeiture, more than USD 297 million in total, and agreed to exit the US market for at least two years (US Attorney’s Office for the Southern District of New York).
- 2025-09-25: The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) announced that on 2025-07-28 it had imposed a CAD 19.552 million administrative penalty on Peken Global for three violations: failing to register, failing to report large transactions and failing to report suspicious transactions. KuCoin has appealed to the Federal Court (FINTRAC).
- Other regions: Japan’s FSA warning on 2024-11-28 and its February 2025 request to remove the app; India’s 2023-12-28 non-registration notice; named by the Philippine SEC in August 2025.
KuCoin’s fees, rebates, proof of reserves and restricted regions are covered in the KuCoin review.
Is HTX safe? Two thefts in 2023
- 2023-09-24: About 5,000 ETH (about USD 8 million) was taken from a hot wallet. The hacker later returned it, and adviser Justin Sun confirmed that HTX paid a 250 ETH white-hat bounty (The Block).
- 2023-11-22: The HTX hot wallet and the HECO cross-chain bridge were hacked at the same time. HTX said it lost about USD 30 million (South China Morning Post), and the HECO bridge lost a further USD 86.6 million or so (Cointelegraph). HTX suspended deposits and withdrawals and said it would compensate users in full; from 11-26 it gradually reopened BTC, ETH, TRX and USDT deposits and withdrawals (Bloomberg).
- Regulation: India’s 2023-12-28 non-registration notice list included Huobi. For restrictions on Taiwan users, see the FSC section below.
HTX’s fees, rebates, proof of reserves and restricted regions are covered in the HTX review.
Is XT safe? Abnormal wallet outflows in 2024
- 2024-11-28: XT first suspended withdrawals citing “wallet upgrade maintenance,” then admitted that assets had flowed abnormally out of a platform wallet. PeckShield estimated the stolen funds were swapped into 461.58 ETH, about USD 1.7 million. XT’s own account was about 1 million USDT across 12 coins, with no impact on users, and it said its reserves had always stayed at 1.5 times user assets (Cointelegraph). I could not find the date withdrawals resumed.
- Regulation: The 5 platforms Thailand’s SEC announced it would block in 2025 included XT.COM.
XT’s fees, rebates, proof of reserves and restricted regions are covered in the XT review.
Are WEEX, Pionex and Ourbit safe?
Under this article’s source standard, no major public incident was found for these 3 exchanges (as of 2026-10-12), whether hacks, long withdrawal suspensions or major regulatory penalties. No record does not mean you are protected, and the three also differ in transparency:
- WEEX: Its website lists a 1,000 BTC protection fund and claims eight years without an incident (WEEX website). That is WEEX’s own claim. Its PoR page showed no figures when I checked.
- Pionex: Its PoR consists only of a third-party report with a 2022-12-13 snapshot, and I found no newer report.
- Ourbit: It has not published proof of reserves, and I found no officially published protection fund.
The fees and restricted regions of these three are covered in the WEEX review, the Pionex review and the Ourbit review.
Using these exchanges in Taiwan: are they registered with the FSC?
No. As of the list updated by Taiwan’s Securities and Futures Bureau (SFB) on 2026-09-29, 11 businesses have completed AML registration, and none of the 13 offshore exchanges covered on this site is on the AML registration list of Taiwan’s Financial Supervisory Commission (FSC). The list is in the SFB’s section on businesses and persons providing virtual asset services; check the version current on the day before you rely on it.
This bears directly on the question “what happens if an exchange collapses?” When the FSC commented on the FTX collapse on 2022-11-23, it pointed out that offshore trading platforms are not covered by the dispute-handling mechanisms of the Securities and Futures Investors Protection Center or the Financial Ombudsman Institution. FTX filed for US bankruptcy protection on 2022-11-11 (Bloomberg Law). If that happens with an offshore platform, the only route is the proceedings where the platform is based.
HTX also has an explicit restriction on Taiwan users: section 1.2 of the HTX user agreement lists Taiwan among the regions barred from trading derivatives, which means Taiwan users cannot trade HTX futures. The agreement also states that the list of restricted regions may change, and that users will not necessarily be notified.
If an exchange collapses, can you get your money back?
A hack and a collapse are two different things. When an exchange is hacked it is still operating, and in all 8 incidents above the exchange said the platform would absorb the loss, or the hacker returned the funds. When an exchange collapses it can no longer pay, and users become creditors in a bankruptcy or restructuring process; how much they get back, and how long it takes, is decided by the court and the administrator under that process. Both cases below are documented in official or court records:
- Mt. Gox (Japan, 2014): On 2014-02-28 it applied to the Tokyo District Court for civil rehabilitation. The company said at the time that about 850,000 BTC had disappeared (about 750,000 belonging to users and about 100,000 of its own), and on 2014-03-07 it then found about 200,000 BTC in an old wallet (Mt. Gox announcement of 2014-03-20). The proceedings were converted to bankruptcy on 2014-04-24; on 2018-06-22 the court instead ordered civil rehabilitation, and the rehabilitation plan became final on 2021-11-16 (Mt. Gox official announcements page). The rehabilitation trustee did not start repaying some creditors in BTC and BCH until 2024-07-05 (rehabilitation trustee’s announcement of 2024-07-05), more than 10 years after the civil rehabilitation application. Many creditors still haven’t completed the steps to receive payment, and the repayment deadline has been extended to 2026-10-31 (Japan time) (rehabilitation trustee’s announcement of 2025-10-27).
- FTX (2022): It filed for bankruptcy protection in the US on 2022-11-11 (Bloomberg Law). Founder Sam Bankman-Fried was sentenced to 25 years on 2024-03-28; US prosecutors said he stole more than USD 8 billion from customers (US Department of Justice press release). The Delaware bankruptcy court approved the bankruptcy plan on 2024-10-07, under which customers could get back about 119% of their account value as calculated at the November 2022 filing (Banking Dive). The plan took effect on 2025-01-03, and customers have to complete identity verification and tax forms before receiving payment (CryptoSlate); the second distribution, on 2025-05-30, was more than USD 5 billion (The Defiant).
The two cases have three things in common. First, it takes a long time: FTX took more than two years from its bankruptcy filing to the plan taking effect, and Mt. Gox more than 10 years from its civil rehabilitation application to the start of repayments. Second, claims are fixed in value at the filing: FTX’s plan is calculated at November 2022 coin prices (The Defiant), so creditors don’t get any of the price rise since then. Third, you have to complete the claim and payment steps yourself; the Mt. Gox trustee’s 2025-10-27 announcement states that many creditors still haven’t been repaid because they haven’t completed those steps.
When an offshore exchange collapses, the only route open to Taiwan users is the proceedings where the platform is based (see the FSC’s explanation in the previous section), so keep screenshots or exports of your account balances and trade history as you go; you’ll need them to file a claim. Collapses also tend to draw impersonation scams: as recently as 2025-10-29, the Mt. Gox official announcements page was still warning that people were setting up fake websites and sending fake emails in the name of MTGOX or the rehabilitation trustee. These tactics are covered in crypto exchange scam types.
How to reduce exchange risk
The records above show three main risks: the platform gets hacked, withdrawals get suspended, and regulators block the exchange in your region. Here is how to respond to each:
- Don’t keep everything on one exchange: across the 8 thefts, withdrawal suspensions ranged from a few days to more than a week, and OKEx’s in 2020 lasted about 41 days. Spread your funds across two or three exchanges so that if one suspends withdrawals, you can still use the money on another.
- Withdraw coins you’re not trading for now to a wallet you control yourself: almost every exchange theft hit the platform’s hot and warm wallets. Before withdrawing, check the network and the fee; see USDT withdrawal fees compared.
- Turn on account security settings: two-factor authentication, a withdrawal address whitelist and an anti-phishing code. Fake support agents and fake websites that impersonate exchanges are covered in crypto exchange scams.
- Check regularly whether proof of reserves is updated on schedule: a PoR that stops updating, or a page that shows no figures, is a signal in itself. For each exchange’s status, see exchange proof of reserves compared.
- Watch for restrictions in your region: both Thailand and the Philippines announced blocks before enforcing them, and Thailand’s SEC reminded users at the time to deal with their assets before the blocking date. For each exchange’s restricted regions, see exchange restricted countries.
Futures trading carries a separate risk: when you use leverage and the market moves against you, your position may be forcibly liquidated. That has nothing to do with whether the exchange itself is safe.
Update log
- 2026-10-12: First published, covering hacks, withdrawal suspensions, regulatory records and protection funds for 13 exchanges; includes Bitget’s 2026-09-24 incident and the full resumption of withdrawals on 10-02.
- 2026-10-15: Added “If an exchange collapses, can you get your money back?”, covering the bankruptcy and repayment records of Mt. Gox and FTX; added a link to the full review in each exchange’s section.
FAQ
Is Binance safe?
Binance lost 7,000 BTC on 2019-05-07, and the SAFU fund covered it in full. Since then, up to 2026-10-12, I have found no other record of platform wallet theft. On the regulatory side, Binance pleaded guilty in the US on 2023-11-21, with settlements totaling about USD 4.3 billion. SAFU currently holds 15,000 BTC, and the PoR is updated once a month.
Can you still use Bybit after the hack?
Yes. Bybit kept operating after the 2025-02-21 theft, and Bybit says withdrawals were processed as usual. The CEO said client assets remained backed 1:1. Bybit replaced about 447,000 ETH through loans, large deposits and purchases, and a later PoR verified by Hacken showed reserve ratios above 100% for its main assets. The latest PoR snapshot is dated 2026-09-23.
Was Bitget hacked? Can users get their money back?
On 2026-09-24 about USD 388 million was stolen from Bitget’s hot and warm wallets. Bitget says user balances are unaffected and the protection fund is covering the loss. Withdrawals resumed in batches from 09-28 and were fully restored on 10-02; more than USD 300 million was put back into the protection fund on 09-30.
Is OKX safe? Has it ever been hacked?
Under this article’s source standard, no major public incident of platform wallet theft was found for OKX (as of 2026-10-12). Its bigger events were the roughly 41-day withdrawal halt from 2020-10-16 to 11-26, caused by a private key holder cooperating with a police investigation, and the US guilty plea by the entity that operates OKX on 2025-02-24, with fines and forfeiture of more than USD 504 million in total.
Is MEXC safe?
No major public incident of platform wallet theft was found for MEXC (as of 2026-10-12), but it has had an account freeze dispute: in 2025 about USD 3.1 million belonging to a trader was frozen, and MEXC apologized and unfroze the funds on 2025-10-31. Japan’s FSA has twice warned MEXC for operating without registration, and the Philippines also named it in 2025.
If an exchange is hacked, do users lose money?
In all 8 thefts covered in this article, the exchange said the platform would absorb the loss or that the hacker had returned the funds, and user account balances were not reduced. What users actually bore was the withdrawal suspension: a few days at the shortest, and about 7.5 days for Bitget in 2026. But that is past behavior and does not mean the next incident will be handled the same way. Some exchanges have simply collapsed, such as FTX, which filed for bankruptcy protection on 2022-11-11.
If an exchange goes bust, can you get your money back?
It depends on the bankruptcy or liquidation proceedings where the platform is based; Taiwan’s investor protection mechanisms can’t help. When the FSC commented on the FTX collapse in 2022, it pointed out that offshore trading platforms are not covered by the dispute-handling mechanisms of the Securities and Futures Investors Protection Center or the Financial Ombudsman Institution. As of 2026-09-29, none of the 13 offshore exchanges covered on this site is on the FSC’s AML registration list either.
Why do exchanges suspend withdrawals?
The most common reason is a security review after a hack, as with Bitget in 2026, HTX in 2023, and BingX and XT in 2024. Some reasons have nothing to do with hackers: in 2020 OKEx could not sign withdrawals because a private key holder was cooperating with a police investigation. Wallet maintenance or network upgrades for a single coin usually last only a few hours and are not included in this article.
Can a protection fund (SAFU) cover every user?
There is no guarantee. A protection fund is money the exchange sets aside itself, and the exchange decides how large it is and how it is used. Measured in BTC, Binance’s SAFU of 15,000 BTC is about 2.18% of users’ BTC assets. The largest theft on record, Bybit’s at about USD 1.5 billion, was bigger than Binance’s SAFU of about USD 1 billion, and Bybit covered it with loans and purchases.
For each exchange’s reserve ratios, see exchange proof of reserves compared; for scams that impersonate exchanges, see crypto exchange scams and rebate scam warning signs. Referral codes and sign-up steps for each exchange are collected in the crypto exchange referral codes hub, for example the Binance referral code, OKX referral code, Bitget referral code and KuCoin referral code; for Bybit’s rebate option, see Bybit fee rebate. To compare two exchanges, see Binance vs OKX, Binance vs Bybit, Bybit vs Bitget and MEXC vs Gate.