Bitcoin exchange hacks have wiped out billions in user funds over the past decade. Yet most investors assume some form of insurance exists, the way a bank account carries a government guarantee. That assumption is wrong, and the gap between expectation and reality has cost Australian holders real money.
This article covers what exchange-level insurance actually looks like, what it covers (and doesn't), and what practical steps you can take to protect your Bitcoin before a hack ever occurs.
What exchange insurance actually covers
Some larger exchanges do carry commercial insurance policies. The coverage is not standardised. Each exchange negotiates its own terms, and the policies almost universally apply only to funds held in the exchange's hot wallet, meaning the portion kept online for daily trading activity. Cold storage, which is where most exchanges park the bulk of user funds, may be excluded entirely or subject to separate terms.
Coinbase, for example, has publicly disclosed that it carries crime insurance for assets held in hot wallets, but explicitly states this does not cover individual account breaches resulting from credential theft or phishing. Kraken maintains similar carve-outs. The policy protects the business from a catastrophic breach of its own infrastructure, not from the variety of smaller, account-level incidents that are far more common.
Australian exchanges are not required by law to carry any insurance on user funds. The Australian Transaction Reports and Analysis Centre (AUSTRAC) registers exchanges as Digital Currency Exchange Providers, but that registration doesn't mandate deposit protection. The Australian Financial Complaints Authority (AFCA) covers many financial disputes, but crypto assets generally fall outside the consumer protection frameworks that apply to bank deposits.
What happens during a real exchange hack
The pattern is consistent. An exchange suffers a breach. It freezes withdrawals. It issues a statement promising a full investigation. Then comes the hard part: determining whether affected users will be compensated and how.
In the most serious hacks, the exchange itself becomes insolvent. Mt. Gox lost 850,000 Bitcoin in 2014 and entered bankruptcy. FTX collapsed in 2022 with an $8 billion shortfall. In both cases, users waited years for partial recoveries through legal proceedings, and most received cents on the dollar. Neither company held meaningful insurance against user losses.
Smaller exchanges that survive a hack often compensate users from their own reserves, but this is entirely voluntary and depends on the company having the capital to do so. There's no legal obligation to make users whole. If reserves are insufficient, users simply lose their funds.
Why your Bitcoin on an exchange isn't legally "yours"
When you deposit Bitcoin to an exchange, you don't hold Bitcoin anymore in a strict legal sense. You hold a claim against the exchange for that amount of Bitcoin. The exchange owns the private keys. You own a contractual right to receive the equivalent value on demand. If the exchange fails, that claim goes into a creditor queue, the same queue as suppliers, staff, and secured lenders.
Understanding what a private key in Bitcoin actually is makes this distinction concrete. The private key is the real ownership proof. An exchange that holds your private key holds your Bitcoin. You hold an IOU.
This is why the phrase "not your keys, not your coins" has circulated in Bitcoin communities for years. It's not just a philosophical point. It's a legal and financial reality with direct consequences in a hack or insolvency.
Self-custody as the practical alternative
Moving Bitcoin off an exchange into self-custody removes exchange counterparty risk entirely. A hacker who breaches an exchange can't reach Bitcoin that isn't held there. The trade-off is that you take on full responsibility for key management and storage security.
For most holders with meaningful positions, a hardware wallet held in cold storage is the standard answer. For those earlier in their Bitcoin journey, understanding when to move Bitcoin off an exchange is one of the most practical decisions they'll face. The general guidance is straightforward: if you wouldn't feel comfortable with that amount sitting in an unsecured location, it's too much to leave on an exchange.
Self-custody doesn't mean you can never use an exchange. It means keeping only what you need for near-term trading activity on the exchange, and moving the rest to a wallet you control.
What to look for in an exchange's security disclosures
Before depositing funds, it's worth asking specific questions. Most exchanges publish security pages, but the useful information is in the fine print of their terms of service.
- Does the exchange carry commercial crime insurance, and what are the coverage limits?
- What percentage of user funds are held in cold storage versus hot wallets?
- Does the exchange maintain a proof-of-reserves attestation?
- Has the exchange ever experienced a breach, and how did it handle user compensation?
An exchange that can't or won't answer these questions clearly is an exchange worth avoiding.
The ATO angle: tax doesn't care about the hack
There's a final sting that catches Australian investors off guard. If you lose Bitcoin in an exchange hack, the ATO's position on deductibility is not straightforward. A capital loss may be claimable, but only under specific conditions, and you'll need to demonstrate you've taken all reasonable steps to recover the funds first. Exchanges that later return partial funds complicate the calculation further.
Australian investors already navigating tax on Bitcoin gains need to factor hack scenarios into their record-keeping. Documenting what you held, when you deposited it, and what the market value was at the time of the breach is essential for any future claim.
The honest summary
Most exchange insurance is partial, conditional, and not disclosed clearly to users. Australian law doesn't require it. Government deposit guarantees don't apply. In a serious breach or insolvency, the realistic outcome is a drawn-out creditor process with uncertain returns.
The Bitcoin network itself has never been hacked. Every major loss of user funds has happened at the exchange layer, not at the protocol layer. That's worth sitting with. The safest Bitcoin is Bitcoin you hold the keys to yourself.