What is a hack in crypto?

If you read that “an exchange got hacked,” does that mean Bitcoin’s security was broken? Not necessarily. Think of a bank branch robbery: the fact that someone opened the vault doesn’t mean the entire payment system collapsed.

In an exchange hack, the attacker may gain access to the private keys that control the company’s wallets. With them, they can sign transfers to their own addresses. The blockchain may keep working normally, recording transactions with valid signatures, even though there’s a thief behind them.

Other attacks exploit bugs in smart contracts, meaning programs that run on the blockchain. For example, a mistake in how withdrawals are calculated can allow someone to take out more money than they’re entitled to. There’s also phishing: instead of breaking the code, the attacker tricks the user into revealing secrets or approving a dangerous action.

Why it matters

The security of the network and the security of the service you use are two different things. Crypto on an exchange also depends on the provider’s security safeguards. In a self-custody wallet, protecting the keys falls to you, while using apps adds risks from their code and the permissions you grant them.

We find the question “what exactly was breached?” more useful than the generic headline “crypto got hacked.” The answer determines who is affected and which actions make sense. Confirmed transfers usually can’t be reversed like a card charge, and getting money back isn’t a given.

What to watch out for

Two-factor authentication (2FA) helps protect an account, but it doesn’t fix a vulnerable contract. Likewise, a security audit doesn’t guarantee that an app is invulnerable.

If your seed phrase has been exposed, changing your wallet password isn’t enough. You need a new wallet with a different seed phrase, on a secure device, and to move whatever assets are still available. If an exchange account has been compromised, contact the exchange through its official support channel. Don’t trust strangers promising “crypto recovery” for an upfront fee.