The pattern repeats with mechanical precision. An exchange grows. Users trust it with their funds. The exchange gets hacked, commits fraud, or simply mismanages the money. Users discover they were never owners — they were unsecured creditors in a bankruptcy proceeding.
This has happened so many times, so consistently, that treating each incident as an isolated event is no longer credible. It is a structural feature of exchange custody. And the total documented losses now exceed $25 billion.
Here is the record.
The Timeline
2014 — Mt. Gox: 850,000 BTC ($450 million)
Mt. Gox once processed 70% of all Bitcoin transactions globally. In February 2014, it revealed that 850,000 BTC had been stolen over several years through security failures that went undetected. The exchange filed for bankruptcy. Creditors waited over ten years for partial repayment. During that decade, Bitcoin's price rose 100x — a loss measured not just in dollars but in opportunity.
2016 — Bitfinex: 119,756 BTC ($72 million)
Hackers exploited a vulnerability in Bitfinex's multisignature wallet system. The exchange's response was unprecedented: it socialized the losses across all users, reducing everyone's balance by 36%, regardless of whether their individual account was compromised. You could have done nothing wrong and still lost more than a third of your holdings.
2019 — QuadrigaCX: $190 million (CAD)
The founder of Canada's largest exchange died — allegedly — while traveling in India. He was the sole holder of the private keys controlling customer funds. The money became permanently inaccessible. Subsequent investigations suggested the funds may have been misappropriated before his death. The case remains one of crypto's strangest and most unsettling stories.
2022 — Celsius Network: $4.7 billion frozen
Celsius marketed itself as a crypto savings account offering yields up to 18%. Behind the marketing, it deployed customer deposits into high-risk DeFi protocols and illiquid positions. When the market turned, it froze withdrawals overnight. Customers became unsecured creditors. The CEO resigned. Bankruptcy proceedings followed.
2022 — FTX / Alameda Research: $8+ billion
The largest fraud in cryptocurrency history. FTX, valued at $32 billion and endorsed by institutional investors, politicians, and celebrities, was using customer deposits to fund speculative trading at its sister company Alameda Research. When the scheme unraveled in November 2022, approximately $8 billion in customer assets was missing. Sam Bankman-Fried was convicted on seven counts of fraud.
Also lost: Voyager Digital (~$1.3 billion), BlockFi (~$1 billion), Genesis (~$3 billion+), Cryptopia (~$16 million), Cred (~$150 million). This list is not complete.
The Common Thread
Every one of these losses shares a single feature: users did not hold their own keys.
When you deposit Bitcoin on an exchange, you transfer ownership of actual Bitcoin (an unspent transaction output on the blockchain, controlled by a private key) in exchange for a database entry on the exchange's servers. That database entry is a promise — an IOU. The exchange promises to give you Bitcoin when you ask for it.
Owning a house is different from owning a note that says someone will give you a house. The first is property. The second is credit exposure. When the counterparty fails, property survives. Credit doesn't.
The blockchain does not recognize exchange databases. It recognizes one thing: a valid signature from the private key that controls a given output. Whoever holds the key holds the Bitcoin. Everything else is a legal claim against an institution — and institutions fail.
Self-Custody in 2026
The "it's too complicated" objection had merit in 2014. It has very little merit today.
Hardware wallets from Coldcard, Trezor, and Bitkey (made by Block) now offer guided setup, clear displays, and robust backup mechanisms. Bitkey was designed specifically for people who have never held Bitcoin before.
Mobile wallets like Phoenix, Blockstream Green, and Blue Wallet provide consumer-grade interfaces for self-custodial Lightning and on-chain wallets. Your keys never leave your device.
Multisig solutions from Unchained and Nunchuk let you require 2-of-3 keys to move funds. You hold two keys; the service holds one. The service cannot move your funds unilaterally, and losing one key doesn't mean losing your Bitcoin.
Setting up a hardware wallet takes about 30 minutes. The security model, once configured, is stronger than any exchange can offer — because it eliminates the counterparty entirely.
The Insurance Illusion
Some exchanges advertise insurance. The details matter more than the marketing.
Exchange insurance typically covers only a fraction of hot wallet assets. It does not cover:
• Unauthorized access to individual accounts
• Exchange insolvency or bankruptcy
• Employee fraud or internal theft
• The gap between insured amount and total custodied assets
When exchanges mention FDIC insurance, they are referring to US dollar deposits held in partner banks — not digital assets. Bitcoin on an exchange is not FDIC insured. The distinction is critical and frequently obscured in marketing materials.
A Practical Path
If you hold Bitcoin on an exchange today, here is a reasonable migration path:
1. Purchase a hardware wallet directly from the manufacturer (never secondhand)
2. Set it up following the manufacturer's guide — generate your seed phrase offline
3. Write the seed phrase on paper. Never photograph it. Never store it digitally
4. Store copies in two separate secure physical locations
5. Transfer a small test amount first to verify the setup works
6. Move your long-term holdings off the exchange in stages
7. Keep only active trading amounts on exchanges
The tools are mature. The process is documented. The $25 billion in losses is the cost of learning a lesson that doesn't need to be learned again.
Bitcoin was designed so that you don't need to trust anyone with your money. Using an exchange voluntarily re-creates the trust dependency that Bitcoin was built to eliminate.
Read more about Bitcoin self-custody at TXID News.
0 Comments