Author: BigTime

Research Scope: September to November 2026 centralized exchange hacking incidents and institutional exchange exposure management tools | Data verification as of November 9, 2026 | BigTime focuses on market making, liquidity, and trading technology practices.

The data in this article comes from public reports, official disclosures, and third-party data platforms, some of which are media paraphrases and have not been audited, thus do not constitute investment advice.

Core Points

• Within six weeks, Bitget, Binance, and Mercado Bitcoin were hacked in succession, all three promising to cover the losses incurred by the platform. If the promises are kept, users' principal will not be directly harmed. However, as of writing, Mercado Bitcoin has not yet restored withdrawals, and the indemnity promises remain unfulfilled. Several platforms had also paused withdrawals for several days; for institutions, even if the principal is ultimately preserved, the locked funds incur costs during this period.
• Exchange exposure can be managed from three levels: setting balance limits for each exchange based on net asset ratios; through off-exchange settlements, leaving assets with third-party custodians while exchanges only record transaction amounts; and combining verifiable reserve information and regulatory rules to assess risks. Each of these methods has limitations and needs to be used in combination.
• Binance, OKX, Bybit, and Bitget have all integrated one or more custodians, and the off-exchange settlement networks have already covered the major exchanges. However, public information is still insufficient to determine the actual performance of these arrangements during the Binance incident. Institutions need to clarify: if an exchange suspends withdrawals, whether the assets held by the custodian can still be moved, and how settlements will be handled.

In the past six weeks, three exchanges with varying sizes and locations have faced issues. The Binance case is estimated to have resulted in about $6.3 billion in losses, making it the largest recorded cryptocurrency theft. The risk of exchanges being hacked has become unavoidable for institutions.

The decision institutions need to make is how much to deposit with each exchange, how to store it, and whether they can promptly retrieve it after an incident.

Six Weeks, Three Exchange Hacks

Figure: Exchange hacking incidents from September to November 2026 (Source: Bitget official, The Hacker News, The Block, CoinDesk, Bitquery, Binance disclosures; amounts are based on the disclosures or estimates of various parties; compiled by BigTime)

On November 6, the South Korean exchange GOPAX also suspended deposits, regular withdrawals, and trading. The cause was an email: the sender claimed to have hacked the exchange and threatened to launch an attack. GOPAX did not report any actual losses.

The situation for Mercado Bitcoin is even more complex. Bitquery found that after the exchange announced that it had "gained control" of the situation at 12:56 (UTC), the attackers continued clearing user deposit addresses for about four hours.

The Binance incident significantly increased the loss figures for the year. CertiK reported that by the end of October, the cryptocurrency industry losses in 2026 amounted to approximately $9.2 billion, a record high. DefiLlama's statistics indicated about $8.74 billion as of October 31.

According to holder.io, the same period in 2025 saw losses of about $2.51 billion; excluding the Binance incident, the losses in 2026 were about $2.38 billion, approximately 5% lower than the same period in 2025. For reference, Chainalysis indicated that in the period from January to early December 2025, the theft amounts exceeded $3.4 billion.

According to holder.io statistics, as of October, there have been 325 incidents in 2026, while the same period in 2025 recorded 120 incidents. Our judgment is that while the number of incidents has increased, the average amount per incident is declining, and a sufficiently large loss can rewrite the annual data. When managing exposures, institutions need to guard against such low-probability, high-loss shocks that can arrive swiftly.

Beyond Principal, What Costs Must Institutions Bear?

In all three incidents, the platforms promised to bear the losses. Binance reserved over $6.34 billion of company funds, Bitget tapped into its protection fund, and Mercado Bitcoin also stated that users would not be harmed. As long as these promises are fulfilled, institutions can preserve their principal.

The wait for funds to become available incurs a cost of its own. Binance paused withdrawals for about 54 to 56 hours, Bitget took about a week to restore all cryptocurrencies, and as of writing, Mercado Bitcoin has not announced a time for restoration of withdrawals. While the money remains in the account, institutions cannot transfer it to other exchanges for margin requirements, redeem it as planned, or shift positions during price fluctuations.

After Binance resumed withdrawals, funds quickly began flowing out. Data shows that within about 9.5 hours post-resumption on November 1, users withdrew approximately $4.65 billion and deposited about $1.01 billion.

Subsequently, according to Reuters, Binance reported that a cumulative net outflow of approximately $4.72 billion had occurred since the resumption. During the same period, there was also a net outflow for U.S. spot Bitcoin ETFs: Reuters reported about $643 million on October 30; SoSoValue data showed about $1.282 billion for the week from November 2 to 6.

ETF capital flows are influenced by various factors and cannot all be attributed to the hacking incidents, but the risk-averse sentiment reflected in these flows is consistent.

Concerns about custody security among institutions had already risen before this wave of incidents. An institutional survey conducted by Coinbase and EY-Parthenon in January 2026 showed that the percentage of asset owners listing "custody security" as one of the top three concerns rose from 35% in January 2025 to 79%; the percentage among asset managers increased from 36% to 76%.

Among the interviewed institutions that had invested in digital assets, 61% used more than one custodian. This recent series of hacks has transformed existing concerns into issues requiring immediate action.

First Level: Limits, Controlling Each Exchange's Balance by Net Asset Ratio

Start with balance limits. On the night of the Binance incident, two leading market makers quickly disclosed their respective exposures. According to Cointelegraph, Wintermute CEO Evgeny Gaevoy stated that the company's exposure on Binance was less than one-fifth of its net assets; GSR CEO Xin Song claimed that GSR's exposure was less than one-twentieth of its net assets.

Expressing exposure as a net asset ratio shows that institutions had previously considered a question: if this money cannot be withdrawn temporarily, can the company still operate normally? When setting limits, it is necessary to consider both how much capital can be locked and how long it can be maintained.

While setting limits, it is also important to diversify funds. Bloomberg quoted Kaiko data indicating that as of November 3, Binance's spot market share among the top ten exchanges was about 42%, compared to about 48% before the incident; OKX's share increased from approximately 11% the previous week to about 14%. If institutions want to transfer trades within a week, they need to prepare margin and inventories across multiple exchanges regularly.

Limits can restrict the maximum loss at one exchange in the event of an incident, but the money within the limit is still held at the exchange. Institutions requiring large-scale quoting and hedging find it hard to keep their balances too low, hence they also need tools like off-exchange settlements.

Second Level: Off-Exchange Settlement, Keeping Assets Outside Exchanges

Off-exchange settlement separates asset storage and trading: assets are held by third-party custodians, and exchanges grant institutions trading limits based on the custodied assets, settling profits and losses according to an agreed-upon cycle. Since exchanges do not hold this portion of assets normally, theft targeting exchange assets cannot reach them.

Figure: Comparison of major off-exchange settlement solutions (Source: Copper, Ceffu, Binance, BitGo, Fireblocks, OKX official disclosures and Cointelegraph, PR Newswire investigations, compiled by BigTime)

Exchanges are also promoting such arrangements. On November 5, a little over a month after the hacking incident, Bitget launched the "Open Custody Network," integrating collaborations with six custodians announced on October 13: Copper ClearLoop, Cactus Oasis, Fireblocks Off Exchange, OSL MirrorEX, Bitfire PrimeMirror, and Sygnum Protect.

BitGo CEO Mike Belshe stated in the Q3 2026 earnings call, "Only in the crypto market must institutions place assets in various exchanges to utilize trading products and liquidity, exposing these assets to counterparty risk." Off-exchange settlements aim to address this layer of counterparty risk he referred to.

Institutions can also use traditional financial assets as margin. In November 2023, Binance piloted a tripartite custody arrangement with an unnamed bank, allowing them to provide margin using government bonds and other fiat equivalents. The Financial Times reported that BBVA used U.S. treasuries as collateral for some Binance traders' margin.

Starting in November 2025, BlackRock's tokenized fund BUIDL can be used as off-exchange margin for Binance; in February 2026, Franklin Templeton's Benji platform's tokenized currency fund also joined, custody managed by Ceffu. This approach allows the margin to continue to earn interest but increases the complexity of the structure and the number of participating institutions.

Before adopting off-exchange settlements, several restrictions need to be clarified:

1. There is still exchange exposure during the settlement interval. Whether settling every 2 hours, 24 hours, or T+1, profits generated between two settlements remain a receivable against the exchange until settlement.
2. When assets are transferred to the custodian, the risks also shift. Institutions need to assess the custodian's own security measures and legal structure. For example, ClearLoop's trust arrangement does not apply to all connected exchanges.
3. There is still a lack of public verification on how things will unfold under pressure. We cannot find descriptions in public reports explaining how Mirror, MirrorX, or tripartite custodian clients settled during Binance's withdrawal suspension. Institutions need to clarify with exchanges and custodians before signing contracts.

Third Level: Verifiable Reserves and Regulations

Reserve proofs, protection funds, and regulatory requirements can help institutions determine whether exchanges have the capability to bear losses encountered. They provide external constraints, but institutions still need to manage their exposures.

Binance's reserve proof (PoR) snapshot from October 1 shows a BTC reserve rate of 100.35%, ETH of 100.00%, and USDT of 103.88%.

After the hack, Binance completed another reserve proof utilizing zero-knowledge proof as of the snapshot at 00:00 (UTC) on October 31, covering 10 cryptocurrencies, claiming that users' assets have at least 1:1 reserve backing. The specific proportion by cryptocurrency was not seen in public reports.

OKX released its 49th monthly report on November 4, showing reserve rates of 108% for BTC, 101% for ETH, and 106% for USDT. These figures also have limitations.

Critics have pointed out that reserve proofs do not reflect the platform's liabilities; in December 2022, the auditing firm Mazars suspended providing reserve proof services to exchange clients, including Binance.

How much loss can the protection fund bear also needs to be evaluated. CoinDesk reported based on on-chain data that Binance’s approximately $1 billion SAFU fund had swapped out of all stablecoins into about 15,000 BTC by February 2026.

As of October 31, about half of it was involuntarily utilized, leaving approximately 7,500 BTC, equivalent to about $580 million. Binance promised to restore the fund to about $1 billion but did not provide a timeline. SAFU bore part of the losses in this incident, but compared to the total losses of approximately $6.3 billion, the fund’s size remains much smaller, with the main support relying on Binance's corporate funds.

Regarding regulation, requirements for the ratio of cold wallets vary widely across regions:

Figure: Custody requirements for exchanges in some regions (Source: see the source column in the table, part of it is interpretations by law firms or media, not the original regulatory text)

Increasing the proportion of cold wallets can reduce the scale of theft but cannot eliminate risk. In February 2025, Bybit was hacked for approximately $1.46 billion, with the attacker transferring from an Ethereum multi-signature cold wallet. Even if regulatory minimums are met, institutions cannot conclude that assets are necessarily safe based on that.

Checklist: Six Questions for Institutions Managing Exchange Exposures

Figure: Checklist for institutional exchange exposure management (Source: BigTime research compilation)

According to platform commitments and currently disclosed information, there are no public reports showing that institutions suffered direct losses of principle due to exchange hacks in these three incidents. However, whether principal can be preserved depends on whether the exchange has sufficient funds to cover losses, which is not always guaranteed.

When setting exposures, institutions need to account for scenarios where platforms may be unable to cover their losses, estimate how much capital might be lost, and whether remaining funds can support operations.

For changes in liquidity during Binance's withdrawal suspension, see the previous article in this series "Where did liquidity go the night Binance paused withdrawals"; for how market makers are building capital markets in crypto, see "GSR Deep Dive: As a Market Maker, Why Start Building a Crypto Capital Market?".

Risk Warning

The data in this article comes from official disclosures, third-party data platforms, and media reports, with differences in statistical metrics, timing, and cryptocurrency valuation methods; some may originate from single sources or media paraphrases and could be subject to revisions in subsequent disclosures; amounts stolen, frozen, and replenished are estimates from various parties or platform representations and have not been audited.

Industry loss statistics cannot be directly compared due to differing institutional definitions; descriptions of off-exchange settlements, tripartite custodians, and reserve proofs are based on public materials and do not reflect their actual performance under specific pressure scenarios; some regulatory requirements are derived from law firm or media interpretations, with the regulatory original text prevailing.

Data notes: Information on hacks is sourced from official disclosures from Bitget, Binance, Mercado Bitcoin, and reports from The Block, The Hacker News, CoinDesk, Bitquery, Korea JoongAng Daily, and others.

Industry loss statistics come from CertiK, DefiLlama, Chainalysis; fund flow data comes from Binance disclosures, Reuters, and SoSoValue; institutional surveys come from Coinbase and EY-Parthenon; market shares are from Kaiko (as reported by Bloomberg).

Off-exchange settlement and margin arrangements are sourced from official information from Copper, Ceffu, Binance, BitGo, Fireblocks, OKX, and related reports.

Regulatory requirements are from Davis Polk, Axios, Cointelegraph, MiCA textual provisions, and VARA rules manual. The exposure management framework is a BigTime research analysis and does not constitute investment advice.

Disclaimer: This report is produced by BigTime Industry Research and organized based on public materials, it does not constitute investment advice, offer, or revenue commitment; past performance does not represent future results. Reproduction or excerpting is prohibited without written permission.

BigTime Industry Research continues to cover market making, liquidity, and institutional asset markets, with a series of reports to be released.

[Disclaimer] The market has risks, and investments should be made cautiously. This article does not constitute investment advice, and users should consider whether any opinions, views, or conclusions herein align with their specific circumstances. Investing based on this is at one's own risk.