The September 2024 breach of Indonesian exchange Indodax, which saw $22 million stolen from hot wallets, is the latest in a long line of exchange hacks that have shaken cryptocurrency users’ confidence. If you have ever wondered what happens to your funds when an exchange gets compromised, and more importantly, what you can do to protect yourself, this guide walks you through everything you need to know — from immediate response steps to long-term security practices.
The Basics
When you deposit cryptocurrency on an exchange like Indodax, Binance, or Coinbase, you are entrusting a third party with the private keys to your funds. This is fundamentally different from keeping cash in a bank account. In the traditional banking system, deposits are insured by government programs like the FDIC in the United States. In cryptocurrency, there is no universal insurance, and recovery of stolen funds depends entirely on the exchange’s reserves and willingness to reimburse users.
Hot wallets — the internet-connected wallets that exchanges use to process daily withdrawals — are the most vulnerable component of any exchange’s infrastructure. They are necessary for operational efficiency but represent an attractive target for hackers. When an exchange announces “maintenance” or pauses withdrawals without clear explanation, it may indicate a security incident in progress. Understanding this basic dynamic is the first step toward protecting your assets.
Why It Matters
The numbers tell a stark story. Billions of dollars in cryptocurrency have been stolen from exchanges since the industry’s inception. While major exchanges typically have the reserves to absorb losses and reimburse users, smaller or less well-capitalized platforms may not. Even when exchanges do reimburse users, the process can take weeks or months, during which you have no access to your funds. With Bitcoin trading around $57,600 and Ethereum near $2,389 at the time of the Indodax hack, even a small percentage loss can represent a significant financial impact for individual users.
The psychological impact of a hack should not be underestimated either. The uncertainty of not knowing whether your funds are safe, the stress of waiting for exchange communications, and the potential loss of investment gains during the recovery period all contribute to a highly unpleasant experience that proper security practices can help you avoid entirely.
Getting Started Guide
The single most important step you can take to protect your cryptocurrency is to move funds off exchanges and into your own custody. Here is how to get started:
Step 1: Choose a hardware wallet. Hardware wallets like Ledger, Trezor, or Keystone store your private keys on a dedicated physical device that is never directly connected to the internet. Prices range from $50 to $250, which is a small investment considering the value of the assets they protect. When selecting a hardware wallet, purchase only from the official manufacturer’s website or authorized retailers — never from third-party marketplaces where devices could be tampered with.
Step 2: Set up your wallet securely. When you initialize your hardware wallet, it generates a recovery phrase — typically 12 or 24 words. This phrase is the master key to your funds. Write it down on paper or a metal backup plate and store it in a secure location like a safe or a bank deposit box. Never store your recovery phrase digitally — not in a photo, not in a note-taking app, not in cloud storage. Anyone who obtains your recovery phrase has full access to your funds.
Step 3: Transfer your crypto. Send small test transactions first to verify that your wallet is set up correctly and the address is correct. Only after confirming the test transaction should you send larger amounts. Double-check the destination address carefully, as blockchain transactions cannot be reversed once confirmed.
Step 4: Verify and monitor. After your funds are in your hardware wallet, periodically verify your balances using the wallet’s official software. You do not need to connect your hardware wallet to check balances — most hardware wallet apps allow you to view balances using public addresses without connecting the device.
Common Pitfalls
Several common mistakes trip up newcomers to self-custody. First, do not share your recovery phrase with anyone, ever. No legitimate support representative will ask for it. If someone asks for your seed phrase, it is a scam. Second, be wary of phishing websites that mimic popular wallet interfaces. Always verify the URL and bookmark the official site. Third, avoid keeping all your crypto in a single wallet or with a single exchange. Diversification of custody reduces the impact of any single point of failure.
Another frequent mistake is neglecting to plan for inheritance or emergency access. If something happens to you, will your loved ones be able to access your crypto? Consider creating a secure inheritance plan that includes instructions for accessing your wallets without compromising security during your lifetime.
Next Steps
Once you have mastered basic self-custody with a hardware wallet, consider exploring more advanced security configurations such as multi-signature wallets, which require multiple independent approvals before funds can be moved. Learn about different wallet types — including software wallets for smaller amounts you need quick access to and cold storage solutions for long-term holdings. Stay informed about security developments in the cryptocurrency space, and regularly review and update your security practices as the threat landscape evolves. The investment you make in security today is the best insurance you can have for your cryptocurrency holdings.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with qualified professionals regarding security implementations.
Rule #1 should be: do not keep funds on an exchange you do not actively need for trading. Everything else is damage control.
damage control is generous. more like accepting the risk and hoping the exchange doesnt get hit while youre sleeping
The FDIC comparison is important for newcomers to understand. Your exchange balance is a promise, not a deposit. Big difference.
even FDIC insurance has a $250k per depositor limit. crypto has zero backing. people really need to understand the asymmetry between traditional banking and exchange deposits
node_runner_ the FDIC comparison cuts both ways. crypto people say ‘be your own bank’ but most users dont want to be a bank. they want FDIC-equivalent protections without the custody tradeoff
the fact that move to cold storage is still advice that needs to be given in 2024 tells you everything about the state of crypto UX
crypto UX has improved but the mental model of not your keys not your coins still hasnt clicked for most retail users
the UX gap and the mental model gap are both still massive. most retail users genuinely treat their Binance balance like a savings account. that assumption will break again
Ewa D. 100%. my cousin lost 4 ETH on indodax and still keeps everything on binance because ‘its too big to fail’. the mental model gap is unbridgeable for most people