Navigating the Shifting Sands: Crypto Exchange Security in 2026

Navigating the shifting sands: crypto exchange security in 2026

If you hold any crypto on an exchange, the single most useful thing you can do this year is understand how exchanges actually fail, and what part of that failure is within your control. The headlines tend to focus on eye-watering loss figures. The more important story is mundane: most damage comes from a handful of repeatable weaknesses, and most of them have known defences.

This guide takes a calm, evidence-led approach. We will look at what the largest recorded exchange theft of the modern era teaches us, how regulators are tightening the rules, what "proof of reserves" really proves (and does not), and a clear, prioritised checklist you can act on today. No price predictions, no scare tactics, no promises that any setup is "risk-free", because none is.

The 2026 threat picture, in plain English

Crypto exchanges sit at the intersection of three risk surfaces at once: software, money, and people. A bank-grade attacker only needs one of those to break.

Here is how the main categories tend to play out:

• Operational and signing compromises. Attackers target the systems and staff that authorise large transfers, rather than brute-forcing the blockchain itself.
• Social engineering. Phishing, fake "support" agents, and impersonation aimed at users and employees. This remains one of the most effective attack types because it bypasses technology entirely.
• Smart contract and integration risk. As exchanges bolt on staking, lending, and DeFi features, a bug in one component can freeze withdrawals or expose funds.
• Solvency and custody risk. The exchange itself becomes the point of failure if it mismanages, lends out, or simply loses customer assets. This is distinct from being "hacked".
• Regulatory and access risk. An exchange operating illegally in your jurisdiction can be blocked, delisted from app stores, or wound down, stranding users mid-trade.

The thread connecting all of these: when you leave coins on an exchange, you are trusting that company's people, code, and balance sheet at the same time. That is not automatically a bad trade. It is just one you should make consciously.

What the Bybit hack actually teaches us

In February 2025, the exchange Bybit suffered a theft of roughly $1.5 billion in Ethereum, widely described as the largest single crypto heist on record. The U.S. FBI attributed the attack to North Korea's Lazarus Group, according to Bloomberg's reporting on the incident and subsequent analysis by the Center for Strategic and International Studies (CSIS).

The mechanism matters more than the number. According to a technical analysis published by NCC Group, attackers did not crack Bybit's blockchain. They compromised the infrastructure around a multi-signature wallet interface, manipulating what the human signers saw so that they approved a malicious transaction believing it was routine. The cryptography worked exactly as designed. The people were deceived.

There are three durable lessons here, and none of them require you to be a security engineer:

1. The weak point is usually the approval process, not the math. "Multi-sig" and "cold storage" are only as strong as the screens and humans confirming each transfer.
2. Scale does not equal safety. A very large, well-funded exchange was the target precisely because it was large. Size is not a security guarantee.
3. Recovery is not the same as prevention. Bybit reportedly closed the gap in customer balances within days through external support. Most users will never get that backstop. Plan as if you would not.

If a top-tier exchange with a serious security team can be tricked at the signing layer, the honest conclusion is humility: no exchange is 100% secure, and your own custody decisions are part of the risk equation.

Regulation is tightening, and it changes your shortlist

For UK readers in particular, the regulatory picture moved meaningfully in 2025 and 2026, and it directly affects which platforms are safe to use.

• Since 8 October 2023, any crypto financial promotion aimed at UK consumers must be approved by an FCA-authorised person or come from a registered cryptoasset business. Breaching this is a criminal offence under the financial promotions regime.
• In February 2026, the FCA announced High Court enforcement action against the offshore exchange HTX (Huobi) for illegally promoting cryptoasset services to UK consumers, its first such court action against an offshore crypto firm. The regulator requested app-store removals and the blocking of UK-facing social accounts, and placed HTX on its Warning List. This is documented in the FCA's own press release and summarised by law firm Hogan Lovells.
• A broader authorisation regime is on the way. Reporting on the UK cryptoasset timeline indicates the FCA expects to open its authorisation application window in late 2026, moving toward full authorisation of exchanges, custody, staking, and lending in the years that follow.

The practical takeaway: check the register before you check the features. If a platform aggressively markets to UK users but is not FCA-registered, that is a meaningful warning sign, not a technicality. Our companion guide to the best crypto exchange in the UK for 2026 walks through how to verify registration and what "regulated" actually covers.

Proof of reserves: useful, but not a clean bill of health

"Proof of reserves" (PoR) has become a standard marketing line since 2022. It is genuinely useful, and it is also widely misunderstood. Knowing its limits is part of being a careful user.

A typical PoR uses a Merkle tree: every customer balance is hashed and combined into a single root value, so the exchange can prove it holds assets covering the included balances, and you can independently check that your own balance was counted. Reputable explainers from CoinTracker and FinanceFeeds describe how this works in practice.

What PoR does well versus where it falls short:

The core limitation is liabilities. A platform can display billions in verified assets and still be insolvent if it has hidden loans, leverage, or obligations the snapshot ignores. PoR is a point-in-time photograph, not a live feed, and its credibility depends on the independence of the auditor. Some firms are now moving toward a stronger "proof of solvency" standard that verifies both sides of the ledger.

How to use PoR sensibly:

• Treat it as one positive signal among several, not a guarantee.
• Prefer exchanges whose PoR is checked by a credible independent third party, with a clear date.
• Combine it with regulatory standing, security track record, and your own custody choices.

CeFi meets DeFi: newer risks to watch

A growing share of exchanges now offer staking, yield, lending, and DeFi-linked products inside the same app where you trade. Convenient, yes, but it widens the attack surface.

• Smart contract risk. A bug in a staking or yield contract can freeze withdrawals or drain pooled funds, even when the exchange's own hot wallets are untouched.
• Counterparty opacity. "Earn" products may lend your assets to third parties. If you cannot see who holds your coins, you cannot price the risk.
• Confusing custody lines. It is easy to forget which balances are spot, which are staked, and which are locked. In a crisis, locked positions are the hardest to exit.

If you use these features, read exactly what happens to your assets, and keep amounts proportionate to the risk you can absorb. For background on the wider tokenisation trend driving many of these products, see our explainer on RWA tokenisation of gold, silver, and real estate in 2026.

A prioritised security checklist

Security advice is only useful if it is ordered by impact. Here is what moves the needle most, from highest to lowest leverage.

1. Decide what should not live on an exchange at all

The most effective single step is reducing how much you keep on any exchange. Use exchanges for trading and active balances; move long-term holdings to self-custody.

• For meaningful, long-term holdings, a hardware wallet (cold storage) remains the gold standard. Compare two market leaders in our Ledger vs Trezor hardware wallet guide for 2026, and read our hands-on reviews of the Trezor and the Ledger Nano X.
• Understand the trade-offs first with our explainer on self-custody versus custodial wallets in 2026. Self-custody removes exchange risk but puts seed-phrase responsibility entirely on you.

If you decide to self-custody, you can buy a device directly from a manufacturer. Affiliate disclosure: links beginning with /go/ are affiliate links. If you buy through them we may earn a commission at no extra cost to you. We only suggest products we would use ourselves, and this never changes our assessments.

• Hardware wallets we cover: Ledger, Trezor, and Tangem.

2. Harden your exchange logins

For the balances you do keep on an exchange:

• Drop SMS-based 2FA. It is vulnerable to SIM-swap attacks. Prefer a hardware security key (such as a U2F/FIDO2 key) or an authenticator app.
• Use a unique, strong password per exchange, stored in a password manager. Never reuse passwords.
• Enable withdrawal allowlists so funds can only leave to addresses you pre-approved.
• Turn on every alert: logins, withdrawals, password changes, and new device sign-ins.

3. Assume every "support" contact is fake until proven otherwise

Social engineering is the most common path to loss for ordinary users.

• No legitimate exchange will ever ask for your seed phrase, private keys, or live 2FA codes. Anyone who does is an attacker.
• Never click links in unsolicited messages. Type the exchange URL yourself or use a saved bookmark.
• Be sceptical of urgency, "account frozen" warnings, and unexpected "refunds". These are classic pressure tactics, as seen in cases like our CryptoMine Pro scam warning.
• Verify any contact through the exchange's official support channel, never a number or handle supplied in the message itself.

4. Choose platforms that fail safely

When picking where to trade, weight these factors:

• Regulatory standing in your country (for UK users, FCA registration).
• Security track record and how transparently past incidents were handled.
• Independent proof of reserves with a recent, dated audit.
• Clear cold/hot wallet practices and a published incident response approach.

For worked examples, see our reviews of Kraken and Bitget, which assess these dimensions in detail. If you actively trade and have weighed the regulatory points above, you can open accounts directly with Kraken, Bitget, or Binance (affiliate links, as disclosed).

5. Build routine monitoring habits

• Review account activity logs periodically for sign-ins or transactions you do not recognise.
• Keep your device's operating system and browser patched.
• Follow the official channels of the exchanges you use, plus reputable security reporting, so you hear about incidents early.

A simple way to think about allocation

You do not need a complex framework. A useful mental model:

• Spending and active trading: small, on a reputable, regulated exchange.
• Medium-term holdings: split across no more than one or two trustworthy platforms.
• Long-term core holdings: self-custody in cold storage, with a securely backed-up seed phrase.

The goal is not zero risk, which is impossible. The goal is to ensure no single failure, of an exchange, a contract, or a phishing message, can wipe out everything at once.

Frequently asked questions

Is it safe to keep my crypto on an exchange? It can be acceptable for active trading and smaller balances on a reputable, regulated platform, but no exchange is fully risk-free. The Bybit incident showed that even very large exchanges can be compromised through the transaction-approval process. For long-term holdings, self-custody in a hardware wallet reduces your exposure to any single exchange's failure.

What does "proof of reserves" actually guarantee? It demonstrates that an exchange held certain assets at a specific point in time and lets you check that your balance was included. It does not prove the exchange is solvent, because it usually does not capture all liabilities, and it does not guarantee the assets are still there later. Treat it as one useful signal, not a complete safety verdict.

How was the Bybit hack carried out? According to NCC Group's technical analysis, attackers compromised the systems around a multi-signature wallet interface and manipulated what the human signers saw, leading them to approve a malicious transfer. The blockchain cryptography itself was not broken; the people approving the transaction were deceived.

Is HTX (Huobi) safe to use in the UK? The FCA began High Court enforcement action against HTX in 2026 for illegally promoting cryptoasset services to UK consumers and placed it on its Warning List. UK users should be very cautious with platforms the FCA has flagged, and should check the FCA register before signing up anywhere.

What is the single most effective security step I can take? Reduce how much you keep on exchanges. Use them for trading and active balances, and move long-term holdings to a hardware wallet you control. After that, replace SMS 2FA with a hardware security key or authenticator app, and treat every unsolicited "support" contact as a potential scam.

Does FCA registration mean an exchange is guaranteed safe? No. Registration signals that a firm meets certain anti-money-laundering and promotion standards and can be held accountable by the regulator. It does not eliminate hacking, solvency, or operational risk. It is a meaningful filter, used alongside the other checks in this guide, not a guarantee.

Safety reminder: Your digital assets are ultimately your responsibility. Understand the risks, layer your defences, and when something feels off, slow down and verify through official channels. Caution costs you a few minutes; a mistake can cost far more.

Sources

• Bloomberg: Lazarus $1.5 Billion Hack on Bybit Shakes Up the Crypto World
• NCC Group: In-Depth Technical Analysis of the Bybit Hack
• CSIS: The Bybit Heist and the Future of U.S. Crypto Regulation
• FCA: Action against HTX over illegal financial promotions
• Hogan Lovells: UK FCA takes first court action against a crypto exchange for illegal financial promotions
• CoinTracker: What is proof of reserves?
• FinanceFeeds: Proof of Reserves Crypto Exchanges