Major cryptocurrency exchanges remain structurally vulnerable to catastrophic theft despite stronger cybersecurity and regulatory controls

What's this about?

People disagree about whether big crypto exchanges can still suffer one huge theft, even with better safety, rules, and open reports.

What supporters say

• Multi-key wallets need many approvals, but one bad or fake approval can still let thieves take funds.
• Recent attacks still caused huge losses, including about $1.5 billion from Bybit and hundreds of millions elsewhere.
• Following rules does not prove that an exchange can stop every attack or protect every key.
• One exchange holds money for many people, so one weak spot can hurt many users at once.

What critics say

• New rules and open money reports are getting better, which may help find risks and stop some theft.
• Total crypto theft fell in 2023, though this drop alone gives only a weak clue about future danger.

How to read this

The number of points on each side does not show who is right; the strength of each point’s proof matters more.

The bottom line

The evidence still shows that one exchange failure could cause enormous losses.

Both sides have points, but the case for lasting danger has stronger proof than the case against it.

The claim is not that every cryptocurrency exchange is equally unsafe, or that theft rises every year. It is that stronger cybersecurity, regulation and transparency have not eliminated the possibility of a single exchange failure causing enormous losses.

The case for

Recent attacks show that improved controls have not closed the door to catastrophic theft. The FBI attributed about $1.5 billion stolen from Bybit to North Korean actors. Bybit said the assets were held in an Ethereum cold wallet, a form of storage intended to reduce exposure. DMM Bitcoin reported losses of about $305 million, while WazirX reported more than $230 million stolen. 1

The Bybit case is especially significant because cold storage did not prevent an exceptionally large compromise. These incidents show that a single custody system can expose hundreds of millions—or billions—of dollars at once (see Figure 2). The damage can also continue after the initial breach, as stolen funds move through a complex network that makes tracking and recovery difficult (see Figure 3).

Centralized custody remains a built-in concentration risk. Exchanges hold large amounts of customer money while controlling the systems that authorize transfers and withdrawals. That makes the exchange a high-impact target: a weakness in one signing process, wallet, employee account or outside technology provider can affect many customers simultaneously.

Layered safeguards also have limits. WazirX said more than $230 million was taken from a multisignature wallet that involved a third-party custody and infrastructure arrangement. Multisignature systems can require several approvals, but they cannot guarantee that every apparently authorized transaction is legitimate. Proof-of-reserves reports may show some assets, yet research finds that many do not fully verify liabilities or assets held elsewhere. These tools offer useful information, but they do not guarantee protection from stolen keys, insider abuse, malicious approvals or failures at outsourced providers. 3

Regulation improves governance and accountability, but compliance is not the same as technical resilience. European rules under MiCA, anti-money-laundering guidance from the Financial Action Task Force and U.S. Securities and Exchange Commission custody requirements all strengthen oversight and customer-protection expectations. But they do not prove that key compromise or malicious transaction authorization has been made impossible, especially across exchanges operating under different standards. 4

The case against

There is meaningful evidence that stronger defenses have reduced losses overall. Chainalysis estimated that funds stolen from crypto platforms fell by more than half in 2023, while a Reuters estimate put total theft at about $1.7 billion, roughly 54% below the previous year. That decline is consistent with better security, changed market conditions, or both. 5

Formal regulation and transparency systems also provide real reasons to expect better resilience. MiCA, FATF guidance and SEC materials impose stronger obligations on providers, while proof-of-solvency reporting can make financial weakness easier to spot before it becomes a customer crisis. These measures can reduce opacity and improve supervision. But proof of solvency is not proof of cyber-resilience. 6

The broader trend remains difficult to interpret. Chainalysis reported that cryptocurrency theft rose about 21% in 2024, to $2.2 billion, while hacking incidents increased from 282 to 303. Annual totals combine small thefts with rare, enormous events, so they cannot by themselves show whether the chance of one catastrophic exchange failure is rising or falling (see Figure 1).

The evidence also cannot precisely measure how much particular controls have reduced risk. Available theft figures cover cryptocurrency broadly, not exchanges alone. Incident records may be incomplete, loss estimates may vary, and exchange statements may omit operational details. There is no reliable exchange-by-exchange estimate of catastrophic-loss probability before and after specific cybersecurity or regulatory measures were introduced.

The bottom line

The evidence moderately supports the claim, but not because theft has risen consistently or because regulation has failed universally. The strongest evidence comes from documented, high-value breaches and the concentration of customer assets in exchange-controlled custody systems.

Stronger controls have probably reduced ordinary and aggregate losses and improved transparency. However, they have not demonstrated that exchanges can no longer suffer a catastrophic compromise. The conclusion is therefore conditional: the frequency of some losses may be lower, while the possibility of an extreme, concentrated failure remains unresolved.