The short answer: in most exchange hacks since 2022, withdrawals came back within two weeks, and the customers were made whole out of the exchange's own reserves. Of the five completed pauses logged below, four ended within 12 days. The exception is the one everyone should know about, because it shows what happens when an exchange cannot cover the hole: WazirX kept withdrawals shut for 463 days, and its users took part of their money back as recovery tokens instead of coins.

This page exists because of Bitget. On September 24, 2026, Bitget detected unauthorized transfers out of its hot and warm wallets, first estimated at $351.6 million and later revised to $387.5 million, and paused every customer withdrawal. Since then the same questions have been arriving from people in every time zone: when will I be able to withdraw, is my balance still there, has an exchange ever come back from something this size. Those questions have real answers, and they are in the history.

This is a tracker, not a news story. We add every major hack of a centralized exchange as it happens, and we update each row when the reopening date or the compensation outcome changes. Last full check: September 26, 2026. The full log is published as a free dataset at /data/hacks.json.

One disclosure. We run CoinVast, a swap service that does not hold customer balances. That gives us a reason to write about custodial risk, so weigh our conclusions with that in mind. We have tried to describe every exchange here fairly, and several of them handled their worst week better than most people would expect.

Exchange hacks by the numbers

  • $387.5 million: Bitget's revised loss on September 24, 2026, the largest exchange theft of the year so far.
  • 4 of 5: completed withdrawal pauses in this log that ended within 12 days.
  • 463 days: how long WazirX kept crypto withdrawals shut after its July 2024 hack.
  • Under 12 hours: how long Bybit took to clear every pending withdrawal after losing about $1.5 billion in February 2025, without ever pausing.
  • 6 of the 9 hacks logged here have been linked to North Korean groups by investigators or analysts.

The hack log, newest first

Every row carries a date and a public source. Amounts are the figures reported at the time and some were revised later; where a figure or a date could not be verified, the cell says so instead of guessing.

Date Exchange Stolen Withdrawals Back after Were users made whole?
September 24, 2026 Bitget $387.5 million (first reported $351.6 million) All paused Scheduled: BTC from September 28, fiat and remaining tokens by October 2 Bitget says its $464 million User Protection Fund covers affected balances
November 27, 2025 Upbit About $36 million in Solana tokens Solana network paused, then all deposits and withdrawals for checks 4 days for most assets (December 1); 7 days for Solana assets (December 4) Yes, covered from corporate reserves
August 14, 2025 BtcTurk About $48 million from hot wallets Crypto deposits and withdrawals paused, trading continued Reopened; exact date not published in the sources we checked The exchange said user assets were not affected
June 18, 2025 Nobitex About $90 million, sent to addresses nobody controls All paused 12 days (from June 30), in phases, verified users only Not stated in the sources we checked
February 21, 2025 Bybit About $1.5 billion in ETH Never paused Every pending withdrawal processed in under 12 hours Yes, reserves stayed above liabilities
January 23, 2025 Phemex Over $85 million across 16 chains Paused 1 day for the first assets (January 24), all services by February Not stated in the sources we checked
July 18, 2024 WazirX About $234.9 million All paused 463 days (October 24, 2025) Partly: about 85% of approved claims paid, the rest in recovery tokens
May 31, 2024 DMM Bitcoin About $305 million (4,502.9 BTC) Restricted, yen withdrawals delayed The exchange closed; accounts moved to SBI VC Trade around March 2025 Accounts and assets were transferred in full
September 12, 2023 CoinEx About $70 million from hot wallets All deposits and withdrawals paused 9 days (September 21) Yes, the exchange pledged 100% compensation

Two things stand out when you read the table top to bottom. First, how an exchange behaves in the first 48 hours says more about the outcome than the size of the loss. Bybit lost more than every other exchange in the table combined and never stopped paying out, while WazirX lost less than a sixth of that and froze for over a year. Second, the pause is almost always about the wallet system, not the money. An exchange that has just been robbed cannot safely send anything until it knows how the attacker got in, so even a fully solvent exchange stops withdrawals for days.

How long withdrawals really stay paused

Sort the completed pauses by length and a clear pattern appears.

Length of pause Hacks in this log What it usually means
No pause Bybit Enough reserves to absorb the loss, and the compromised wallet was isolated immediately
1 to 4 days Phemex, Upbit (most assets) Hot wallet compromise, cold storage untouched, keys rotated and wallets rebuilt
5 to 14 days Upbit (Solana assets), CoinEx, Nobitex A full rebuild of the deposit system, new addresses for every user, phased reopening
Months or more WazirX The loss is larger than the exchange can cover, and a court process decides who gets what

The first reopening is rarely the whole reopening. Phemex brought back Ethereum withdrawals the day after its hack, Bitcoin the day after that, and the rest over the following weeks. Upbit reopened most assets on December 1, 2025 but held the Solana network, where the theft happened, until December 4. Bitget has published the same kind of staggered schedule, starting with Bitcoin on September 28 and finishing with fiat and the remaining tokens on October 2. If your coin sits on the chain that was hit, expect to be near the back of the queue.

What happens in the days after a hack

Knowing the usual sequence makes the silence easier to sit through, and it tells you which announcements actually matter.

Day 0: the pause

Monitoring spots transfers the exchange did not authorize, and withdrawals stop, sometimes deposits too. Trading often keeps running, which confuses people: you can still see and trade your balance, you just cannot move it off the platform. That is normal and it is not a sign the balance is fake.

Days 1 to 3: the size and the story

The exchange publishes a first loss estimate, which usually grows as more transactions are found. Bitget's went from $351.6 million to $387.5 million, and Phemex's from about $70 million to over $85 million. Blockchain analysts trace where the funds went and investigators name a likely culprit. This is also when the exchange says whether customer balances are covered, which is the single most important sentence in any hack announcement.

Days 3 to 14: rebuild and reopen

Old deposit addresses are retired, new wallets are generated, and withdrawals return chain by chain. Upbit deleted every existing deposit address after its hack, and Nobitex warned that coins sent to an old address could be lost for good. If your exchange has been hacked, never send a deposit to an address you saved before the hack. Always copy a fresh one from the exchange after it reopens.

After that: compensation

A solvent exchange quietly covers the loss from its own funds or an insurance style reserve, and most users never notice a difference in their balance. An exchange that cannot cover it enters a legal process: WazirX went through a restructuring scheme approved by Singapore's High Court, and its users waited more than a year.

Is my money safe if my exchange was hacked?

Usually, yes, but there is one question that decides it: can the exchange cover the loss from its own money? Three signals answer that question early.

  1. The exchange names a fund or reserve and says it covers user balances. Bitget pointed to a $464 million User Protection Fund, Upbit said the loss would come from corporate reserves, and CoinEx promised 100% compensation. That is the best sign you can get.
  2. Independent proof of reserves is published after the hack. After Bybit's theft, an outside audit confirmed its reserves still exceeded what it owed customers.
  3. Withdrawals reopen on a published, dated schedule. A schedule with dates is a commitment. Open ended wording like "until further notice" for weeks at a time is the warning sign, because it usually means the exchange is working out whether it can pay.

The warning signs are the reverse: a loss figure that keeps climbing with no statement about coverage, talk of "socializing" losses across all users, a restructuring or court process, or a token offered in place of your coins. WazirX showed every one of these.

What to do right now if your exchange was hacked

Step 1: Do not panic sell the balance you cannot withdraw

If trading is still open, selling at a loss inside the exchange does not get your money out any faster. The pause applies to the proceeds too.

Step 2: Check announcements only on the official channels

Hacks attract fake support accounts and fake refund forms within hours. Nobody from a real exchange will ask for your password, your two factor code or a fee to release a withdrawal. Read updates on the exchange's own website and verified accounts, and ignore direct messages.

Step 3: Retire your saved deposit addresses

Delete any deposit address you stored before the hack from your wallets and address books, and use only a freshly generated one after reopening.

Step 4: Withdraw in order once your coin reopens

Expect a queue in the first hours and possibly higher fees. Move what you want to keep into a wallet you control, starting with the largest balance.

Step 5: Keep your own record

Screenshot your balances and open orders now, and keep them. If the case turns into a claims process, as it did for WazirX, a dated record of what you held makes your claim straightforward.

Why hacks keep happening, and how to take yourself out of the blast radius

Almost every row in this log is a hot wallet: the online wallet an exchange uses to pay withdrawals quickly. Attackers do not need to break the blockchain; they need one signing key, one compromised laptop at a wallet provider, or one flaw in the software that approves transactions. The DMM Bitcoin theft started with a compromised employee at a wallet company called Ginco. Bitget has said its attackers exploited a flaw in its backend wallet systems to spoof transaction approvals rather than stealing private keys.

The only complete defense is not to leave coins where someone else holds the keys. A balance sitting in an exchange account is a claim against that exchange, and a hack turns that claim into a wait. That is a large part of why we built CoinVast the way we did: a swap is one payment in and one payment out, we hold no account balances, and your coins go straight to the address you choose. There is no customer balance sitting in a hot wallet for anyone to pause. If you need to move between assets, a BTC to XMR swap or any of our other pairs finishes with the coins in your own wallet.

To be fair to the exchanges, a custodial platform is still the right tool for some things, such as active trading and fiat on ramps. The practical rule is simple: trade there, but do not store there. Keep on the exchange only what you are about to use, and hold the rest in a wallet you control.

Frequently asked questions

When will Bitget withdrawals reopen?

Bitget has published a staggered schedule that starts with Bitcoin on September 28, 2026 and finishes with fiat and the remaining tokens on October 2. The company has said its $464 million User Protection Fund covers affected user balances. We will update this row as each stage actually reopens, because a published schedule and a completed reopening are not the same thing.

How long do exchanges pause withdrawals after a hack?

In this log, four of the five completed pauses ended within 12 days: Phemex reopened its first assets after 1 day, Upbit after 4, CoinEx after 9 and Nobitex after 12. The exception was WazirX, which stayed shut for 463 days because the loss was too large for it to cover. Bybit never paused at all.

Is my money gone if my exchange gets hacked?

Usually not. In most hacks here the thieves took the exchange's own hot wallet funds, and the exchange covered customer balances from its reserves or a protection fund. The risk is real when an exchange cannot absorb the loss, as with WazirX, where users recovered about 85% of approved claims directly and the rest as recovery tokens.

Why do exchanges stop withdrawals after a hack?

Because the system that signs withdrawals may be compromised, and every transfer sent before the hole is found could go to the attacker. The exchange has to find how the attacker got in, move remaining funds to safety, rebuild its wallets and issue new deposit addresses before it can pay anyone safely.

Which exchange hack was the biggest?

Among the hacks in this log, Bybit's February 2025 theft of about $1.5 billion in ETH is by far the largest, and it was attributed by the FBI to North Korea's Lazarus Group. Bitget's $387.5 million loss in September 2026 is the largest of 2026 so far.

Can I still trade while withdrawals are paused?

Often yes. Bitget, BtcTurk and several others kept trading running during their pauses. Trading moves your balance between assets inside the exchange, but it does not get anything out of the exchange, so it does not reduce your exposure.

How can I avoid being caught in an exchange hack?

Keep only what you are actively trading on an exchange, and hold the rest in a wallet where you control the keys. When you need to switch between coins, a non custodial swap that sends the result straight to your own address avoids leaving a balance on any platform.

Cite this data

This tracker is built to be quoted, so here is everything a writer, researcher or AI tool needs to do it properly.

  • Stable page URL: https://coinvast.io/articles/exchange-hack-tracker-2026
  • Machine readable dataset: /data/hacks.json, with one record per hack, the amounts, the pause and reopening dates, the compensation outcome and a source link for each row. CORS is open, so you can pull it straight into a chart or a notebook.
  • Last full check: September 26, 2026. The page and the JSON update together.
  • Suggested citation: CoinVast, "Exchange Hack Tracker 2026: How Long Withdrawals Stay Paused," coinvast.io, September 26, 2026.

Sources and method

A hack enters this log when a centralized exchange confirms a theft from its own wallets and a public source records the date and the size. We use the exchanges' own announcements, reporting from established outlets and published security analyses, all read in September 2026: CNBC and Crypto Briefing on Bitget; Bitget's published reopening schedule; Upbit's notices on the December 1 and December 4 reopenings; CoinDesk and Turkish press on BtcTurk; The Block and Finance Magnates on Nobitex; Bybit's own incident timeline and the FBI attribution; Phemex's incident timeline; Decrypt and Singapore court reporting on WazirX; CoinDesk and the FBI on DMM Bitcoin; Cointelegraph and Halborn on CoinEx. Days paused are counted from the day of the hack to the first reopening. If you can document a hack that belongs here, or a correction to a row, write to [email protected] and we will check it.

The other trackers

A hack is one of several ways a custodial platform can put your balance out of reach, and we keep a page for each.