The September 2024 breach of Indonesian exchange Indodax, which saw $22 million stolen from hot wallets, is the latest in a long line of exchange hacks that have shaken cryptocurrency users’ confidence. If you have ever wondered what happens to your funds when an exchange gets compromised, and more importantly, what you can do to protect yourself, this guide walks you through everything you need to know — from immediate response steps to long-term security practices.
The Basics
When you deposit cryptocurrency on an exchange like Indodax, Binance, or Coinbase, you are entrusting a third party with the private keys to your funds. This is fundamentally different from keeping cash in a bank account. In the traditional banking system, deposits are insured by government programs like the FDIC in the United States. In cryptocurrency, there is no universal insurance, and recovery of stolen funds depends entirely on the exchange’s reserves and willingness to reimburse users.
Hot wallets — the internet-connected wallets that exchanges use to process daily withdrawals — are the most vulnerable component of any exchange’s infrastructure. They are necessary for operational efficiency but represent an attractive target for hackers. When an exchange announces “maintenance” or pauses withdrawals without clear explanation, it may indicate a security incident in progress. Understanding this basic dynamic is the first step toward protecting your assets.
Why It Matters
The numbers tell a stark story. Billions of dollars in cryptocurrency have been stolen from exchanges since the industry’s inception. While major exchanges typically have the reserves to absorb losses and reimburse users, smaller or less well-capitalized platforms may not. Even when exchanges do reimburse users, the process can take weeks or months, during which you have no access to your funds. With Bitcoin trading around $57,600 and Ethereum near $2,389 at the time of the Indodax hack, even a small percentage loss can represent a significant financial impact for individual users.
The psychological impact of a hack should not be underestimated either. The uncertainty of not knowing whether your funds are safe, the stress of waiting for exchange communications, and the potential loss of investment gains during the recovery period all contribute to a highly unpleasant experience that proper security practices can help you avoid entirely.
Getting Started Guide
The single most important step you can take to protect your cryptocurrency is to move funds off exchanges and into your own custody. Here is how to get started:
Step 1: Choose a hardware wallet. Hardware wallets like Ledger, Trezor, or Keystone store your private keys on a dedicated physical device that is never directly connected to the internet. Prices range from $50 to $250, which is a small investment considering the value of the assets they protect. When selecting a hardware wallet, purchase only from the official manufacturer’s website or authorized retailers — never from third-party marketplaces where devices could be tampered with.
Step 2: Set up your wallet securely. When you initialize your hardware wallet, it generates a recovery phrase — typically 12 or 24 words. This phrase is the master key to your funds. Write it down on paper or a metal backup plate and store it in a secure location like a safe or a bank deposit box. Never store your recovery phrase digitally — not in a photo, not in a note-taking app, not in cloud storage. Anyone who obtains your recovery phrase has full access to your funds.
Step 3: Transfer your crypto. Send small test transactions first to verify that your wallet is set up correctly and the address is correct. Only after confirming the test transaction should you send larger amounts. Double-check the destination address carefully, as blockchain transactions cannot be reversed once confirmed.
Step 4: Verify and monitor. After your funds are in your hardware wallet, periodically verify your balances using the wallet’s official software. You do not need to connect your hardware wallet to check balances — most hardware wallet apps allow you to view balances using public addresses without connecting the device.
Common Pitfalls
Several common mistakes trip up newcomers to self-custody. First, do not share your recovery phrase with anyone, ever. No legitimate support representative will ask for it. If someone asks for your seed phrase, it is a scam. Second, be wary of phishing websites that mimic popular wallet interfaces. Always verify the URL and bookmark the official site. Third, avoid keeping all your crypto in a single wallet or with a single exchange. Diversification of custody reduces the impact of any single point of failure.
Another frequent mistake is neglecting to plan for inheritance or emergency access. If something happens to you, will your loved ones be able to access your crypto? Consider creating a secure inheritance plan that includes instructions for accessing your wallets without compromising security during your lifetime.
Next Steps
Once you have mastered basic self-custody with a hardware wallet, consider exploring more advanced security configurations such as multi-signature wallets, which require multiple independent approvals before funds can be moved. Learn about different wallet types — including software wallets for smaller amounts you need quick access to and cold storage solutions for long-term holdings. Stay informed about security developments in the cryptocurrency space, and regularly review and update your security practices as the threat landscape evolves. The investment you make in security today is the best insurance you can have for your cryptocurrency holdings.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult with qualified professionals regarding security implementations.
Indodax losing 22M and resuming in 3 days with zero user communication is wild. traditional finance would have regulators swarming within hours
key_escape_ traditional finance has mandated deposit insurance and circuit breakers. crypto has neither. the comparison ends at both moving money
$22M from indodax hot wallets and people still keep balances on exchanges. the mental model gap between crypto and traditional banking is permanent for most retail
cold storage ratio is the real question. indodax had 22m exposed and nobody asked what percentage was hot until after the fact
$22M stolen from Indodax and trading resumed 3 days later like nothing happened. zero transparency on which users were affected. this is why I moved everything to a Trezor after the WazirX hack
Praveen S. the transparency issue is huge. exchanges should have to publish hot vs cold wallet ratios daily. if customers knew how much was sitting in hot wallets they would withdraw overnight
Adebowale O. publishing hot vs cold ratios would cause bank runs during volatility. exchanges would rather deal with a hack than transparency
Adebowale O. publishing hot vs cold ratios would trigger instant bank runs. exchanges would rather opacity over transparency because the truth is uglier than anyone thinks
Adebowale O. publishing hot vs cold ratios would trigger instant bank runs. exchanges would rather opacity over transparency because the truth is uglier than anyone thinks
Rule #1 should be: do not keep funds on an exchange you do not actively need for trading. Everything else is damage control.
damage control is generous. more like accepting the risk and hoping the exchange doesnt get hit while youre sleeping
The FDIC comparison is important for newcomers to understand. Your exchange balance is a promise, not a deposit. Big difference.
calling it a promise not a deposit is the cleanest framing ive seen. should be on every exchange signup page in 48pt font
Kasper J. putting it on the signup page wont help. people click agree without reading. needs to be a forced quiz before first deposit
even FDIC insurance has a $250k per depositor limit. crypto has zero backing. people really need to understand the asymmetry between traditional banking and exchange deposits
node_runner_ the FDIC comparison cuts both ways. crypto people say ‘be your own bank’ but most users dont want to be a bank. they want FDIC-equivalent protections without the custody tradeoff
the fact that move to cold storage is still advice that needs to be given in 2024 tells you everything about the state of crypto UX
crypto UX has improved but the mental model of not your keys not your coins still hasnt clicked for most retail users
the UX gap and the mental model gap are both still massive. most retail users genuinely treat their Binance balance like a savings account. that assumption will break again
the mental model gap isnt unbridgeable its just painful. people who lived through FTX moved to cold storage overnight. fear is the best teacher
hotwallet_skeptic fear is absolutely the best teacher. went through mt gox and coincheck and havent kept more than lunch money on an exchange since. people who learn from others mistakes are rare
Ewa D. the Indodax hack was $22M from hot wallets. most users didnt even know their funds were in hot wallets. exchanges need to show a hot vs cold breakdown on the dashboard
Ewa D. 100%. my cousin lost 4 ETH on indodax and still keeps everything on binance because ‘its too big to fail’. the mental model gap is unbridgeable for most people
hot_wallet_hater your cousin lost 4 ETH on indodax and still keeps everything on binance. thats the honest truth for 90% of crypto users. they wont change until they get hurt personally
Indodax losing 22M and resuming trading in 3 days with zero disclosure is wild. traditional finance would have regulators on site within hours not days
Indodax losing 22M and resuming trading in 3 days with zero disclosure is wild. traditional finance would have regulators on site within hours not days
the FDIC comparison needs to be stated louder. 250k guaranteed per depositor in tradfi vs literally zero backing in crypto. your exchange balance is an unsecured loan to a private company
the FDIC comparison needs to be stated louder. 250k guaranteed per depositor in tradfi vs literally zero backing in crypto. your exchange balance is an unsecured loan to a private company