A crypto balance disappears, someone posts a transaction hash, and the word “hack” starts flying around. But that word can describe several very different failures. Someone may have broken into an exchange account, copied a wallet's recovery phrase, tricked its owner into signing a transfer, or found a flaw in a contract holding other people's money.
The difference matters because the fix depends on what went wrong. Changing a password can help with an online account. It does nothing to make a stolen private key secret again. Buying a hardware wallet helps protect keys, but it cannot make an unsafe crypto application safe.
This guide explains those routes without treating every theft as proof that a blockchain was broken. Technical guidance and the examples were checked on October 30, 2026, in UTC. The current Binance investigation is still developing; established wallet mechanics and older, completed incident reports are identified separately.
Start with who controls the money
When you keep crypto on a centralized exchange, the business generally controls the wallets used to hold and move customer assets. Your account shows what the platform owes you. Its internal ledger can record a trade without a separate blockchain transfer for every customer action. A withdrawal is where the exchange sends assets to an outside address.
With an ordinary self-custody wallet, you control the credentials that authorize transactions. The app displays balances and prepares requests; the coins themselves are recorded on their network. Ethereum's account documentation distinguishes accounts controlled by private keys from contract accounts controlled by code.
A private key produces a digital signature. The network checks whether the transaction meets its rules, including whether the authorization is valid. It cannot ask whether a website lied to you about what you were signing. A transaction can pass those checks and still be a theft from its owner's point of view.
Custody also changes who can intervene. An exchange can lock an account or delay withdrawals through its own systems. A wallet developer normally cannot reset an ordinary self-custody account and take control back for you. Some smart accounts have recovery rules, but those depend on the specific account's design.
An account takeover can happen before the blockchain is involved
An attacker who gets into an exchange account may try to change withdrawal destinations, create trading credentials or move funds. They could start with a reused password exposed elsewhere, a fake login page, an infected device, or access to the email account used for recovery.
Two-factor authentication raises the barrier, but the type matters. A code typed into a fake page can be relayed to the real service. Malware can also steal a signed-in session. That can give an attacker access without repeating the same login process you went through earlier. Strong authentication and a clean device address different parts of this problem.
API keys create another route. These credentials let software interact with an exchange account. Their permissions vary: one key might only read balances, while another can place orders or transfer assets. Coinbase Exchange's documentation explicitly says its Transfer permission can bypass two-factor authentication. That is a product-specific example, not a rule for every exchange.
A trading-only key can still cause harm through unwanted orders. Removing withdrawal permission reduces one risk; it does not make the key harmless. For customers, the important question is what each credential is allowed to do after it has been accepted.
A leaked recovery phrase gives away a different kind of control
Many wallets generate a recovery phrase that can recreate the keys for their derived accounts. Someone who copies that phrase may be able to restore those accounts elsewhere. Your original device does not need to be online or in their possession.
Common exposure routes include fake support chats, imitation wallet downloads, screenshots synced to cloud storage and malicious software reading files. A supposed security check that asks you to enter the phrase into a website is especially dangerous. The attacker is asking for recovery access, not simply proof that the wallet belongs to you.
A local wallet password usually protects the copy of the wallet stored on that device. Changing it does not change the underlying keys. Likewise, restoring an exposed phrase on a new hardware wallet recreates the old credentials. It does not remove the attacker's copy.
A phrase-based wallet may contain separately imported private keys as well as accounts derived from its phrase. Those imported accounts can have a different backup requirement. Wallet products also increasingly offer social sign-in or other recovery systems, so users need to understand the actual recovery method they chose rather than assume every app works identically.
Signing can be dangerous even when your keys stay secret
A website can persuade you to authorize something harmful without ever learning your private key. It may describe a button as “claim,” “verify” or “connect,” then present a transaction that transfers assets or grants permission to move them later.
For standard Ethereum ERC-20 tokens, an approval gives a specified spender an allowance. That spender can move the approved token within the allowance's limits. It is not automatically permission to take every kind of asset in your wallet, although an unlimited allowance for a valuable token can still be disastrous.
Some systems use signed messages, permits or broader account permissions. A signature can have consequences even when you pay no network fee at the moment you sign. An attacker or another party may submit it later. A harmless login message and an authorization to spend tokens can look confusingly similar in a rushed interaction.
MetaMask's approval guidance makes another useful distinction: disconnecting a website from your wallet does not revoke an existing onchain allowance. Closing a tab or removing a site's connection therefore may leave a spender's permission in place.
The revealing question is what authority the request grants. Who receives the assets, which token can be spent, how much can move, and how long can the permission last? If the wallet cannot explain the request clearly enough for you to decide, the recognizable logo on the website supplies no missing guarantee.
Exchanges have a larger system to defend
An exchange must protect more than customer passwords. Employees, production systems, software suppliers, signing tools and withdrawal controls all sit around the wallets. An attacker may try to take over one of those systems and make a transfer appear properly authorized.
A hot wallet is available for routine operations. Cold storage keeps signing credentials away from ordinary online use. Businesses can also require multiple approvals, separate duties and restrict the amounts available to online withdrawal systems. These controls can limit damage, but their effectiveness depends on how they are implemented and operated.
Multiple signers help when they make genuinely independent checks. If everyone approves the same misleading display, several signatures can authorize the same harmful transaction. Separating devices, staff responsibilities and verification methods helps reduce that shared point of failure. The number of signatures alone does not tell the whole story.
Apex's ongoing Binance coverage describes the exchange's own preliminary explanations and subsequent discovery of additional breach points. Those statements should not be compressed into a final claim that one employee's laptop explains every transfer. A business can also say it found no evidence of a private-key leak while still investigating unauthorized use of its withdrawal systems.
A legitimate website can deliver compromised software
You can reach the correct domain and still encounter dangerous code if part of the site's software supply chain has been compromised. A developer account, third-party package or distribution service can become the route into an otherwise familiar interface.
Ledger's December 2023 incident report gives a concrete example. An attacker obtained access associated with a former employee and published malicious versions of Ledger Connect Kit, software used by applications to connect to wallets. Some users were then presented with requests that could drain assets if signed.
The company's report said the attacker did not gain access to its hardware-wallet infrastructure or code repositories. The failure involved a distributed software package and harmful requests delivered through applications. That matters because it explains how a person can use a genuine hardware wallet and still authorize a bad transaction.
A trusted device is valuable when its display lets you verify the actual action. Its protection weakens if you approve something you cannot inspect, or rely entirely on a computer's description. The difference is between keeping the key safe and deciding what that key should authorize.
Crypto applications can lose assets held inside their contracts
Lending platforms, trading pools and bridges can hold assets under rules written in smart contracts. A flaw in those rules can expose deposited funds even when customers keep their own wallet keys safe. Contract administrators and upgrade permissions can introduce additional risks.
Some failures involve access controls that allow the wrong party to perform a privileged action. Others involve accounting, interactions between contracts or assumptions about prices supplied by an oracle. An oracle is a system that brings information into a contract, and unreliable inputs can undermine calculations that otherwise run exactly as written.
Bridges add another set of dependencies when moving value between networks. Their security can depend on contracts, validators, signers or other mechanisms specific to that bridge. A familiar token symbol on a new network does not establish that the asset has the same issuer or risk as the original.
Audits help identify problems in the code and scope reviewed at the time. They do not promise that no bug exists, that later changes are safe, or that a stolen administrator credential cannot be abused. Depositing into a protocol creates exposure to that protocol; storing the wallet's key offline does not remove it.
Why the first reports can be confusing
A large transfer is an observation, not a complete explanation. Analysts may identify an address as belonging to an exchange, estimate the assets sent out and compare destinations with earlier thefts. They may update their figures as more networks and wallets are identified.
A gross transfer total, a frozen balance and a company's remaining financial loss measure different things. Some assets may have been moved legitimately, counted at different prices or already included elsewhere. Freezing a token can stop particular transfers under that token's rules; it does not by itself prove the money has been returned to customers.
Attribution needs care too. In February 2025, the FBI publicly attributed the Bybit theft to North Korean activity it calls TraderTraitor. That was an assessment about a specific incident. A later hack still needs its own evidence. Similar methods or an overlapping destination can support an investigation without revealing every person involved.
AI adds another layer of claims. It can help attackers write messages or automate tasks, but a hack happening during the AI boom does not prove an autonomous system carried it out. Look for evidence describing the actual access, authorization and movement of funds before accepting a dramatic explanation.
The first response depends on what was exposed
For a suspected exchange-account takeover, use a trusted device to reach the provider through its established app or bookmarked address. Lock or restrict the account if the provider offers that option, secure the linked email and review sessions and API credentials. Keep a record of what happened before messages or records disappear.
For a harmful token allowance, inspect and revoke the relevant permission through a trusted tool for that network. For an exposed recovery phrase or private key, an ordinary password reset is insufficient: remaining assets may need a genuinely new wallet with new recovery credentials. If an automated sweeper is suspected, repeatedly adding fee money can feed the thief.
Save transaction hashes, receiving addresses, affected networks, dates and the messages that led to the loss. A transaction hash identifies a specific transaction on its network. Record that network too: the same-looking address can exist on several chains, so an address alone may send an investigator to the wrong record. Report through the relevant provider and your local authorities. The FBI's warning about fraudulent recovery companies is a U.S. example of a wider trap: someone who promises guaranteed recovery in exchange for another payment may be trying to take what you have left.