Exchange Hacks and Who Got Repaid: 12 Cases from Mt. Gox to Bitget

Looking back at 12 exchange incidents from 2014 to 2026 that have official statements or mainstream press coverage, outcomes fall into three groups. The platform absorbed the loss and users were untouched (Binance 2019, KuCoin 2020, Bybit 2025, Bitget 2026 and others). Users took a haircut first and were made up later (Bitfinex 2016 cut every account by about 36%; WazirX 2024 repaid about 85.5% up front). Or the exchange went into bankruptcy, claims were fixed in dollars, and people waited years (Mt. Gox, FTX). The size of the theft mattered less than whether the platform had enough of its own capital or a protection fund, and whether only hot wallets were hit.

"User funds are unaffected" after a hack only holds if the platform has the money to cover it and chooses to. Below, each incident in order: the loss, the cause, what users finally got back and how long it took, followed by a 10,000 USDT example under each kind of outcome (sources checked 2026-10-17).

Quick answer

• Platform covered it in full: Binance used its SAFU fund for 7,000 BTC in 2019; Bybit lost about 1.5 billion US dollars of ETH in 2025 and closed the gap within 72 hours; Bitget lost about 388 million US dollars in 2026, covered by its Protection Fund with user balances unaffected.
• Haircut, then made whole or partly whole: Bitfinex cut all accounts by about 36% in 2016 and issued BFX tokens, all redeemed by April 2017. WazirX's plan, sanctioned by a Singapore court, repaid about 85.5% first and the rest in recovery tokens.
• Bankruptcy and long waits: Mt. Gox lost about 850,000 BTC in 2014 and its final repayment deadline was pushed to 2026-10-31. FTX claims were valued in dollars as of the November 2022 petition date.
• The common thread: withdrawals almost always stop first, for days in the best case and years in the worst.

12 incidents at a glance

Sources: Mt. Gox Decrypt, The Block; Bitfinex The Block; Coincheck Bloomberg; Binance announcement; KuCoin Decrypt; FTX Cointelegraph; HTX Cointelegraph; DMM Bitcoin The Block; WazirX Cointelegraph, MediaNama; BingX The Block; Bybit press release, The Register (FBI attribution); Bitget official incident update, phased withdrawal resumption, Protection Fund replenished. Checked 2026-10-17. Dollar figures are mostly at prices at the time and vary slightly between outlets. The table only includes incidents we could tie to an official statement or mainstream report; an exchange missing from it does not mean nothing happened there.

Patterns across the 12

• Hot wallets are where it usually happens: Binance, Bitfinex, KuCoin, BingX and Bitget all lost hot or warm wallet funds. Binance's 2019 notice says the hot wallet held about 2% of its BTC. Cold wallet breaches are rarer; Bybit 2025 is the exception, and the attack went through the signing interface.
• Who pays decides your outcome: platforms with large reserves or protection funds (Binance SAFU, Bitget's Protection Fund) usually leave users untouched. Bybit filled its gap with loans and support from large holders. When the platform can't pay, you get a haircut (Bitfinex, WazirX) or bankruptcy (Mt. Gox, FTX).
• Withdrawals always stop: even when users are made whole, withdrawals pause first. Bitget's USDT withdrawals were down from 9-24 to 9-30 this time, about six days; Binance estimated a week in 2019.
• Bankruptcy is priced in fiat: FTX claims were valued in dollars as of the November 2022 petition date, so later price moves did nothing for creditors.

You can't control whether an exchange gets hacked, only how much you have sitting on it that day.

A worked example: 10,000 USDT on an exchange that gets hit

The same 10,000 USDT comes back untouched within a week in the best case, and takes years in the worst, with no access to it in the meantime. That's why many long-term holders keep trading money on exchanges and move the rest to a wallet they control.

What this has to do with rebates

An exchange's automatic rebate goes back into your exchange account, sitting next to your trading funds, and gets frozen with them if something goes wrong. Fee Otter's extra rebate is settled daily and, on request, paid as on-chain USDT on BEP20 to an address you bound yourself, minimum 1 USDT, with the 0.015 USDT network fee paid by you, and every payout is visible on BscScan. Withdrawing your rebate regularly means it doesn't have to share the platform risk your trading funds carry. For whether a rebate platform itself is safe, see is a crypto fee rebate safe.

How to lose less when an exchange is hit

1. Keep only what you trade with: move idle assets to a wallet you control. Network fees are in the USDT withdrawal fee comparison.
2. Check proof of reserves: a reserve ratio shows whether there was enough at the snapshot. It isn't deposit insurance, but it helps rule out obviously short platforms. See the crypto exchange proof of reserves comparison.
3. Spread across two or three exchanges: if one pauses withdrawals, the others still work.
4. Know the protection fund and the official channels: first-hand news comes from official announcements, not screenshots on social media.
5. Bind the rebate before you trade: register with a referral code and bind your UID on the Fee Otter rebate platform; rebates only count trades after binding (Gate's code is FEEOTTER). On BingX, registering with the code gets you 45% automatically, all paid by BingX, with no UID binding needed.

To trade cheaper and have your rebate land in your own wallet on a regular basis, register with our referral codes and bind Fee Otter now. Rebate rates by exchange are in the 2026 exchange rebate rate comparison, and settlement in how fee rebates are settled.

Service regions

How users are repaid after an incident can depend on local regulation. In Japan, Coincheck and DMM Bitcoin were licensed operators that repaid from their own funds or moved accounts to another firm; WazirX went through a Singapore court scheme; FTX was handled in US bankruptcy court. Before using an offshore exchange, check that your region is within its service area; see crypto exchange licenses by country.

Risks

A platform that paid in full last time won't necessarily do so next time. Protection funds and SAFU are set up and run by the platforms themselves, which decide their size and use; they are not government deposit insurance. This article collects public records. It is not a guarantee or rating of any exchange's safety. Only keep money on an exchange that you can afford to lose.

FAQ

If an exchange is hacked, is my money gone?

It depends on whether the platform can and will cover it. Of the 12 incidents, Binance 2019, KuCoin 2020, Bybit 2025 and Bitget 2026, among others, were absorbed by the platform with user balances unaffected; Bitfinex 2016 and WazirX 2024 cut balances first and made them up later; Mt. Gox and FTX went through bankruptcy.

How long until withdrawals reopen?

Bitget's ran from 9-24 to a phased full reopening on 10-02 in 2026, with USDT back on 9-30. Binance estimated a week in 2019. Bankruptcy cases take years.

Is a protection fund the same as a futures insurance fund?

No. The futures insurance fund absorbs liquidation shortfalls. A protection fund or SAFU is a separate reserve the platform keeps for events like thefts.

Can proof of reserves prevent a hack?

No. It only shows whether assets were sufficient at the snapshot; the Bybit 2025 and Bitget 2026 incidents both happened between snapshots.

Can my rebate disappear if the exchange is hit?

The exchange's automatic rebate sits in your exchange account and follows whatever happens to that account. Extra rebate you've already withdrawn from Fee Otter to your wallet over BEP20 isn't affected by the exchange.

Incident details in this article are compiled from exchange announcements and mainstream press, checked 2026-10-17; dollar amounts are mostly at prices at the time, and the original sources prevail. This article is for information only, is not a rating of any exchange, and is not investment advice.