An exchange incident may involve hot wallets, customer balances, withdrawals and custody arrangements in different ways. A single early loss estimate is rarely enough to establish final exposure. The SEC’s custody bulletin explains the practical difference between holding crypto yourself and through a third party.

What the evidence shows

During an incident, facts often change as an operator completes forensics. Readers need the initial time, affected systems, withdrawal status and whether customer balances are exposed. An exchange’s protection-fund claim should be attributed to the exchange until independently confirmed.

Custody arrangements vary: a user who controls private keys faces different operational risks from one relying on a platform. The SEC bulletin discusses those choices. The FTC warns that scammers use crypto requests and impersonation; an urgent 'recovery' message after a breach deserves special skepticism.

Why it matters

First, read the operator’s dated statement for the affected systems. Second, verify current withdrawal and deposit status from official channels. Third, check what customer claim and recovery process actually applies. Screenshots and impersonating support accounts can add a second layer of risk during an incident.

Deeper context and limits

After a security incident, separate four questions: what was accessed, what assets moved, whose balances are affected and whether services are restored. Early statements may answer only some of these. Cold-wallet assurances, reimbursement commitments and withdrawal notices should each be attributed to their issuer and revisited as evidence develops.

Users can protect themselves from secondary scams by navigating to the operator’s official site directly instead of following a purported support link. Never type a recovery phrase into a web form. If funds are on a platform, save transaction IDs and account notices; if self-custodied, review approvals and move only through verified instructions. A breaking story should not speculate about a cause before forensics.

Bull, bear and neutral cases

Confirmation and invalidation

Use official status pages and subsequent forensic reports. Invalidate a social-media claim if the named operator does not confirm it.

Do not send funds to a 'recovery' address from social media or disclose a seed phrase. Record the incident timeline and update estimates only when sourced; retain earlier versions as history.

Reader checklist

• Do not enter a seed phrase into a recovery form.
• Check official withdrawal status directly.
• Keep dated records of announcements and transactions.

Published 26 September 2026. Dated report, not a live price feed or personal investment advice. Source documents may be revised after publication.