BigTime｜After Consecutive Exchange Hacks, How Should Institutions Manage Their “Exchange Exposure”?
Author: BigTime
Scope of Research: Centralized Exchange Hacks from September to November 2026 and Institutional Exchange Exposure Management Tools | Data Verified until 2026-11-09 | Produced by BigTime, grounded in market making, liquidity, and trading technology practice.
Data in this article are sourced from public reports, official disclosures, and third-party data platforms. Some figures are based on media summaries, have not been audited, and do not constitute investment advice.
Key Takeaways
Within six weeks, Bitget, Binance, and Mercado Bitcoin were hacked in succession, with all three platforms promising to cover the losses. If these promises are fulfilled, user principal will not be directly affected. However, Mercado Bitcoin has not yet restored withdrawals as of press time, and its compensation promise remains pending. Several platforms suspended withdrawals for days. For institutions, even if the principal is ultimately safe, locked capital incurs an opportunity cost.
Exchange exposure can be managed across three layers: setting balance caps at each exchange as a percentage of net assets; using off-exchange settlement to keep assets with third-party custodians while exchanges only record trading limits; and assessing risk alongside verifiable reserve information and regulatory rules. Each method has limitations and should be used in combination.
Binance, OKX, Bybit, and Bitget have all integrated one or more custodians, and off-exchange settlement networks now cover major exchanges. However, public information is still insufficient to evaluate how these arrangements performed during the Binance incident. Before adopting them, institutions need to clarify: once an exchange suspends withdrawals, whether assets held by the custodian remain accessible, and how settlements would be processed.
Over the past six weeks, three exchanges of varying sizes and regions have faced consecutive security incidents. Binance estimates its losses at approximately $6.3 billion, marking the largest recorded cryptocurrency theft. Institutions can no longer ignore the risk of exchange hacks.
The critical question for institutions is determining how much capital to allocate to each exchange, how to store it, and whether it can be retrieved promptly in the event of an incident.
Six Weeks, Three Exchange Hacks
Figure: Exchange Hacks from September to November 2026 (Source: Official statements from Bitget, The Hacker News, The Block, CoinDesk, Bitquery, Binance disclosure; amounts based on figures disclosed or estimated by parties; compiled by BigTime)
On November 6, Korean exchange GOPAX also suspended deposits, standard withdrawals, and trading. This followed an email claiming the sender had breached the exchange and threatening further attacks. GOPAX reported no actual losses.
The situation at Mercado Bitcoin was more complicated. According to Bitquery, after the exchange announced at 12:56 UTC that the situation was "under control," attackers continued draining user deposit addresses for approximately four hours.
This Binance incident significantly elevated the annual loss figure. CertiK reported that as of late October, crypto industry losses for 2026 reached approximately $9.2 billion, setting a record. DefiLlama's data through October 31 stands at roughly $8.74 billion.
Separately, holder.io statistics show approximately $2.51 billion for the same period in 2025. Excluding the Binance incident, 2026 losses stand at around $2.38 billion, which is roughly 5% lower than the 2025 period. For reference, Chainalysis data indicates over $3.4 billion was stolen between January and early December 2025.
According to holder.io, there were 325 incidents as of October 2026, compared to 120 in the same period of 2025. Our assessment is that while incident frequency is rising, average loss size per incident is decreasing, though a single massive breach can rewrite annual totals. When managing exposure, institutions must guard against precisely this type of low-probability, high-impact, rapid-occurrence shock.
Beyond Principal: What Other Costs Do Institutions Bear?
In all three cases, platforms pledged to absorb the losses internally. Binance set aside over $6.34 billion in corporate funds, Bitget utilized its protection fund, and Mercado Bitcoin stated users would not bear losses. As long as these commitments are honored, institutional principal remains secure.
Waiting for funds to become usable carries its own cost. Binance suspended withdrawals for approximately 54 to 56 hours, Bitget took nearly a week to restore all assets, and Mercado Bitcoin had not announced a withdrawal restoration timeline as of press time. Although funds remained on the books, institutions could not transfer them to other exchanges to meet margin calls, execute planned redemptions, or rebalance positions amid price volatility.
Following Binance's withdrawal restoration, capital quickly began outflowing. Data shows that within the first ~9.5 hours after resumption on November 1, user withdrawals totaled approximately $4.65 billion, while deposits amounted to ~$1.01 billion.
Subsequently, Reuters reported that Binance cited a cumulative net outflow of approximately $4.72 billion since resumption. During the same period, US spot Bitcoin ETFs also experienced net outflows: Reuters reported ~$643 million on October 30; SoSoValue data showed a weekly net outflow of ~$1.282 billion from November 2 to 6.
ETF capital flows are influenced by multiple factors and cannot be solely attributed to the hack, but the observed movements consistently reflect risk-off sentiment.
Concerns over custody security among institutions had already risen prior to this wave of incidents. A January 2026 institutional survey by Coinbase and EY-Parthenon revealed that the share of asset owners listing "custody security" among their top three concerns jumped from 35% in January 2025 to 79%; for asset managers, it rose from 36% to 76%.
Among surveyed institutions holding digital assets, 61% utilize more than one custodian. This chain of hacks transformed underlying concerns into urgent operational priorities.
Layer One: Balance Caps, Controlling Per-Exchange Balances as a Percentage of Net Assets
Start with balance caps. On the night of the Binance incident, two leading market makers quickly disclosed their respective exposures. According to Cointelegraph, Wintermute CEO Evgeny Gaevoy stated the company's exposure to Binance was less than one-fifth of net assets; GSR CEO Xin Song indicated GSR's exposure was under one-twentieth of net assets.
Expressing exposure as a percentage of net assets reveals that institutions pre-assessed a critical question: whether the company could maintain normal operations if these funds were temporarily inaccessible. When setting caps, both the maximum lockable amount and duration must be considered simultaneously.
While setting limits, capital diversification is essential. Bloomberg, citing Kaiko data, noted that over the seven days leading up to November 3, Binance's spot trading share among the top ten exchanges was approximately 42%, down from ~48% before the incident; OKX rose from ~11% to ~14%. For institutions aiming to roll over trades within a week, maintaining adequate margin and inventory across multiple exchanges is necessary during normal operations.
Caps limit potential losses per exchange incident, but funds within the limit remain hosted on the exchange. Institutions requiring large-scale quoting and hedging find it difficult to minimize balances, necessitating tools like off-exchange settlement.
Layer Two: Off-Exchange Settlement, Keeping Assets Outside the Exchange
Off-Exchange Settlement decouples asset custody from trading: assets are held by a third-party custodian, the exchange grants trading credit limits based on custodied assets, and P&L is settled on agreed cycles. Since the exchange does not typically hold these assets, theft targeting exchange-hosted assets cannot reach them.
Figure: Comparison of Major Off-Exchange Settlement Solutions (Source: Official disclosures from Copper, Ceffu, Binance, BitGo, Fireblocks, OKX, plus reports from Cointelegraph, PR Newswire, etc.; compiled by BigTime)
Exchanges are also promoting such arrangements. On November 5, over a month after the hack, Bitget launched the "Open Custody Network," integrating six previously announced custodian partnerships released on October 13: Copper ClearLoop, Cactus Oasis, Fireblocks Off Exchange, OSL MirrorEX, Bitfire PrimeMirror, and Sygnum Protect.
Mike Belshe, CEO of BitGo, stated during the Q3 2026 earnings call: "In the crypto market alone, institutions are forced to host assets directly on exchanges to access trading products and liquidity, exposing them to the exchange's counterparty risk." Off-exchange settlement aims to resolve precisely this layer of counterparty risk he described.
Institutions can also use traditional financial assets as collateral. In November 2023, Binance piloted a tri-party custody arrangement with an unnamed bank, allowing T-bills and other fiat equivalents as margin. UK Financial Times reported that BBVA holds margin for certain Binance traders in the form of US Treasury bonds.
Starting November 2025, BlackRock's tokenized fund BUIDL became eligible as off-exchange margin for Binance; in February 2026, Franklin Templeton's Benji platform tokenized money market funds joined, custodied by Ceffu. This approach allows collateral to continue earning yield but increases structural complexity and the number of participating entities.
Before adopting off-exchange settlement, several constraints must be clarified:
Residual exchange exposure exists between settlement intervals. Regardless of whether settling every 2 hours, 24 hours, or T+1, profits generated between settlements remain uncollateralized claims against the exchange until settlement occurs.
Risk transfers when assets move to the custodian. Institutions must evaluate the custodian's internal security measures and legal structure. For example, ClearLoop's trust arrangement may not apply to all integrated exchanges.
Lack of public stress-testing verification. We found no public documentation explaining how Mirror, MirrorX, or tri-party custody clients settled during Binance's withdrawal suspension. Institutions must clarify these mechanisms with exchanges and custodians before signing agreements.
Layer Three: Verifiable Reserves and Regulatory Rules
Proof of Reserves, protection funds, and regulatory requirements help institutions assess an exchange's capacity to absorb losses. These provide external safeguards, but institutions must still proactively manage their own exposure.
Binance's Proof of Reserves (PoR) snapshot dated October 1 showed a BTC reserve ratio of 100.35%, ETH at 100.00%, and USDT at 103.88%.
Following the hack, Binance completed a zero-knowledge proof PoR based on a snapshot taken at 00:00 UTC on October 31, covering 10 assets, and claimed user assets have at least a 1:1 reserve backing. No public reports detailed the breakdown ratios for each asset.
OKX released its 49th monthly report on November 4, showing reserve ratios of 108% for BTC, 101% for ETH, and 106% for USDT. These metrics also have inherent limitations.
Critics have long pointed out that PoR does not reflect platform liabilities. In December 2022, auditor Mazars paused PoR services for exchange clients including Binance.
The loss-absorption capacity of protection funds requires case-by-case analysis. According to CoinDesk's on-chain data reporting, Binance's ~$1 billion SAFU fund had fully converted from stablecoins to approximately 15,000 BTC by February 2026.
As of October 31, roughly half had been utilized, leaving ~7,500 BTC (approximately $580 million). Binance committed to restoring the fund to ~$1 billion but provided no timeline. While SAFU absorbed a portion of the losses, its scale remains dwarfed by the ~$6.3 billion total hit, meaning the primary safety net relies on Binance's corporate capital.
Regarding regulation, requirements for cold wallet ratios vary significantly across jurisdictions:
Figure: Exchange Custody Requirements in Select Regions (Source: See column references in table; some interpretations are from law firms or media, not original regulatory texts)
Increasing cold wallet ratios can reduce hack magnitude but cannot eliminate risk entirely. In February 2025, ~$1.46 billion was stolen from Bybit; the attacker drained a multi-signature Ethereum cold wallet. Even meeting regulatory baselines does not guarantee absolute asset security.
Checklist: Six Questions for Institutions Managing Exchange Exposure
Figure: Institutional Exchange Exposure Checklist (Source: BigTime Research Compilation)
Based on platform commitments and currently disclosed information, no public reports indicate direct principal losses for institutions due to exchange hacks in these three incidents. However, principal preservation depends on whether exchanges possess sufficient capital to absorb losses—a guarantee not always assured.
When setting exposure limits, institutions must factor in scenarios where platforms lack sufficient capital to absorb losses, estimating potential fund destruction and whether remaining capital can sustain operations.
For liquidity shifts during Binance's withdrawal suspension, see our previous article in this series: Where Did Liquidity Go the Night Binance Halted Withdrawals?; for market makers building crypto capital markets, refer to GSR Deep Research: Why Did a Market Maker Start Building a Crypto Capital Market?.
Risk Disclosure
Data in this article originates from official disclosures, third-party data platforms, and media reports. Differences exist in statistical methodologies, timing, and currency pricing conventions. Some figures rely on single sources or media summaries and may be updated upon future disclosures. Stolen amounts, freeze statuses, and replenishment progress are estimates or platform self-reports, unverified by audit.
Industry loss statistics cannot be directly compared due to differing firm methodologies. Descriptions of off-exchange settlement, tri-party custody, and Proof of Reserves are based on public records and do not reflect actual performance under specific stress scenarios. Regulatory requirements include interpretations from law firms or media; original regulatory texts take precedence.
Data Sources: Hacking incident information is sourced from official disclosures by Bitget, Binance, and Mercado Bitcoin, plus reports from The Block, The Hacker News, CoinDesk, Bitquery, Korea JoongAng Daily, etc.
Industry loss statistics: CertiK, DefiLlama, Chainalysis. Capital flow data: Binance disclosures, Reuters, SoSoValue. Institutional surveys: Coinbase, EY-Parthenon. Market share data: Kaiko (reported via Bloomberg).
Off-exchange settlement and collateral arrangements: Copper, Ceffu, Binance, BitGo, Fireblocks, OKX official materials, and related reports.
Regulatory requirements: Davis Polk, Axios, Cointelegraph, MiCA provisions, and VARA Rulebook. The exposure management framework constitutes BigTime research analysis and does not constitute investment advice.
Disclaimer: This report is produced by BigTime Industry Research, compiled from public information, and does not constitute investment advice, solicitation, or return guarantees. Past performance does not predict future results. No reproduction or excerpting without written permission.
BigTime Industry Research continues to cover market making, liquidity, and institutional asset markets, with sequential reports publishing regularly.
[Disclaimer] Markets carry risk; invest cautiously. This article does not constitute investment advice. Users should consider whether any opinions, viewpoints, or conclusions herein align with their specific circumstances. Investment decisions are made at the user's sole responsibility.