Crypto exchange hacks expose a second danger beyond stolen assets: customers may rush to withdraw funds, testing whether a platform can move money safely. The value taken in an attack does not, by itself, show how much liquidity an exchange may need in the hours and days that follow.
The issue returned to focus amid reports of a suspected Binance security incident. Digital Journal examined it through the February 2025 Bybit breach, which resulted in the theft of approximately $1.5 billion in cryptocurrency.
Varun Datta, founder and CEO of Truth Ventures and an early-stage Web3 investor, said Bybit subsequently processed around $4 billion in withdrawals. Customers were reclaiming their own funds, he told Digital Journal, but the exchange still had to transfer those assets while responding to the theft. Datta said he would watch customer withdrawals as closely as the amount stolen.
Exchange Hacks Expose Withdrawal Pressure
A theft and a withdrawal surge create different demands. Stolen assets represent a loss. Customer withdrawals are not losses to the exchange because the assets belong to customers, but a sudden rise in requests can put pressure on an exchange’s ability to transfer funds.
Datta also cautioned that having enough assets does not guarantee transfers can resume immediately. If an exchange is still checking whether an attacker can reach its wallets, customers may have to wait even when funds are sufficient. The company must weigh restoring service against the possibility that the attack route remains open.
“I would want to know how it plans to resume transfers without exposing more assets to theft,” Datta told Digital Journal. His point links security response to liquidity: the exchange needs both funds available and a safe way to move them.
Reserve Composition Can Matter
The makeup of an emergency fund can affect the protection it offers. Datta described a hypothetical exchange that owes customers $1 billion in stablecoins and holds $1 billion in Bitcoin to cover a loss. If Bitcoin falls 10%, he said, the exchange would be $100 million short unless it adds more money.
He contrasted that example with an exchange that owes Bitcoin and holds the same quantity of Bitcoin. In that case, the particular mismatch would not arise. Datta said the asset customers are owed should help determine what the fund holds.
A headline dollar value alone may not describe a fund’s ability to cover obligations. Datta’s example is illustrative, not a claim about a named platform.
Datta also pointed to trading arrangements that let customers keep collateral outside an exchange. He said these arrangements already exist, while their protections depend on who controls the assets and how trades are settled. Moving assets outside an exchange therefore does not, by itself, establish how risk is handled.
For related coverage of crypto oversight, Block Editorial has reported on proposed CFTC rules. Its coverage of Swift’s shared ledger and evolving digital threats addresses broader questions around financial technology and security.
Security Measures Need Careful Context
Binance said its Wallet Security Center helped customers avoid an estimated $540 million in potential losses during the first half of 2026. The company also said it filtered 206 million spam transfers, detected 4.93 million high-risk transactions and flagged 996,000 malicious approvals.
Binance characterized the $540 million as estimated potential exposure, not realized losses. The distinction matters when comparing security figures: the estimate does not represent money customers actually lost or a measured amount recovered after an attack.
Datta’s broader question is whether customers need to leave their entire trading balance in exchange wallets. He said keeping collateral outside an exchange could mean less money is exposed if a venue is compromised, while noting that protections depend on control and settlement arrangements.
Customers assessing an incident must distinguish what was stolen, withdrawal demand, transfer safety and assets backing obligations. Digital Journal’s report centers that distinction.
