Bitget's hack this week is the latest reminder that an exchange balance is a promise. Here is how that promise played out in four real failures.
It depends on who fails and how. Bitget covered this week's $387.5 million loss from its own fund; FTX customers were repaid in 2022 dollars; Mt. Gox creditors waited a decade; QuadrigaCX's first payout was 13 cents per dollar. On an exchange, your outcome is decided by someone else.
Not financial advice.
When you buy bitcoin on an exchange, the screen shows a balance in your name. What sits behind that number is a promise. The coins live in wallets the exchange controls, pooled with everyone else's, and your account is a line in its database saying how much of that pool it owes you.
Most days the difference does not matter. You press withdraw, the exchange sends coins from its wallet to yours, and the promise is kept. It starts to matter on the day the exchange cannot or will not send them. After that, what happens to your crypto depends on which of four things went wrong. History has an example of each, and one of them happened this week.
On September 24 at 18:31 UTC, coins started leaving Bitget's hot and warm wallets. By the final count, Decrypt reports the loss reached $387.5 million (all figures in this section are US dollars), up from a first estimate of $183 million. About 103 million XRP, worth roughly $157 million, was the single biggest piece.
The attackers did not steal a private key. CEO Gracy Chen told CoinDesk they broke into backend software inside the exchange's wallet system and fed it fake transaction data, so its own approval process signed payouts that looked normal. She compared it to "slipping forged withdrawal slips through a bank's own teller window." Chen has pointed at a North Korean group, based on IP clues, and said that attribution is not confirmed.
For customers, this is the good version of a hack. Bitget says its user protection fund holds more than $464 million, enough to cover the whole loss, and account balances were not touched. Withdrawals were still paused for a security review, with no date to restart. So even in the best case, you could not move your coins for a while, and whether you were made whole came down to one company's reserves and its choice to use them.
FTX stopped withdrawals on November 9, 2022, and filed for bankruptcy two days later with a hole of about $8 billion in its accounts, according to the record of the case. The surprise ending is that customers were eventually expected to recover between 118% and 142% of their claims.
Read the fine print on that number. Claims were fixed at their US dollar value on the filing date, November 11, 2022, near the bottom of that bear market. Someone who held one bitcoin on FTX was owed the dollar value of one bitcoin that day, plus the premium. With bitcoin at about US$84,000 today, getting 142% of a 2022 price is a loss measured in coins. In bankruptcy you stop owning crypto and start owning a claim for money.
Mt. Gox was handling over 70% of the world's bitcoin trades in 2013. It stopped trading on February 24, 2014, and ended up missing about 650,000 bitcoins after it found 200,000 more in an old wallet, per its history. The repayment plan was approved in October 2021, more than seven years later, and the deadline to pay creditors was then pushed back to October 2024.
Creditors who waited did get some bitcoin back. They also spent a decade unable to sell, move or use it, through two full market cycles.
This one is Canadian. QuadrigaCX founder Gerald Cotten died in India on December 9, 2018, and the Vancouver exchange soon admitted it could not reach customer funds. About C$250 million was owed to roughly 115,000 customers, per the case history. The Ontario Securities Commission later concluded that the missing money was not locked behind a lost password. Cotten had opened accounts under fake names, credited himself with balances that did not exist and traded them against his own clients.
The first interim payout, declared in March 2023, was 13 cents per dollar of proven claim. Over four years after the collapse, creditors had recovered a fraction of what they were owed.
| Exchange | What went wrong | What customers got |
|---|---|---|
| Bitget, 2026 | Hack, $387.5M | Covered by a company fund; withdrawals paused |
| FTX, 2022 | About $8B shortfall | 118% to 142% of 2022 dollar value, years later |
| Mt. Gox, 2014 | About 650,000 BTC missing | Partial repayment, a decade later |
| QuadrigaCX, 2019 | Fraud, about C$250M owed | 13 cents per dollar as a first payout |
In all four, the customer's fate was decided by someone else: a company's reserve fund, a bankruptcy court, a trustee. That is the trade you make for convenience on an exchange, and plenty of people make it knowingly, keeping a small trading balance there and the rest elsewhere.
Self-custody means the coins sit at an address you control, so no exchange failure can freeze them. It swaps one risk for others. Lose your keys and there is no support desk. Sign a malicious transaction and nobody reverses it. Smart contract wallets add code risk. The practical question is which risk you would rather manage yourself. Our guide to exchange versus self-custody goes through the trade-offs in more detail.
We built Fonte for people who want their crypto outside an exchange without juggling a seed phrase. Each member's vault is their own smart account on Base. Fonte never holds your money, you can withdraw any time, and every move the strategy makes is on-chain for anyone to check. You open it with a passkey (Face ID or fingerprint) in about 30 seconds, and a 12-word recovery key is mandatory, so losing your phone does not lock you out. It still carries smart contract risk, and we say so. See how a Fonte vault works, and read what non-custodial means first if the term is new.
This is general information, not financial advice.
Only if the exchange chooses to cover the loss and can afford to. Bitget covered its $387.5 million hack in September 2026 from a user protection fund, but withdrawals were paused during the review. Exchanges without that cushion have gone bankrupt, and customers became creditors.
Usually you get a claim, not coins. FTX customers were repaid based on the US dollar value of their crypto on the November 2022 filing date. Mt. Gox creditors waited more than seven years for a repayment plan. QuadrigaCX creditors received 13 cents per dollar as a first payout.
About 115,000 customers were owed roughly C$250 million after founder Gerald Cotten died in December 2018. The Ontario Securities Commission found the exchange had been run as a fraud. The first interim payout, in March 2023, was 13 cents per dollar of proven claim.
It removes exchange failure as a risk, since no company can freeze your coins. It adds others: losing your keys, signing a bad transaction, or a bug in a smart contract wallet. Which is safer depends on which of those risks you can manage.
Disclaimer: This article is general information, not financial, investment, legal or tax advice. Crypto assets are volatile and you can lose money, including your entire deposit. Figures quoted from third parties are as reported by those sources on the date shown and can change. Smart contracts can contain flaws.