On November 2, Brazil's Mercado Bitcoin froze deposits and withdrawals after a cyberattack with over $40M in suspected losses. It came four days after Binance lost $6.36B, the largest crypto hack ever. Two exchanges, two very different sizes, one question: what happens to an exchange after it gets hacked?

We went through every centralized exchange hacked for $1M or more since 2011. There are 69 of them.

The split

• Survived on their own: 35 (51%)
• Rescued by a buyer: 6 (9%)
• Sold later, at a premium: 4 (6%)
• Died after the hack: 14 (20%)
• Survived the hack, closed later: 10 (14%)

In total, 24 of 69 are gone, about one in three.

Survived on their own (35)

Bybit lost $1.46B in February 2025 and never stopped withdrawals. Partner loans and deposits refilled its reserves within 72 hours. KuCoin lost $281M in 2020, had BTC and ETH withdrawals back in 11 days and covered the last $45.6M from its insurance fund. Bitfinex went the hard way: after its 2016 hack it cut every balance by 36%, issued tokens for the loss and bought all of them back at $1 within 8 months.

Rescued by a buyer (6)

Coincheck lost $530M in 2018, paid clients back from its own capital and was sold to Monex 70 days later for $33.5M, about 6% of the loss. Zaif went to Fisco, and DMM Bitcoin's accounts went to SBI. On median, a buyer showed up 2.6 months after the hack. A rescue is no guarantee: Liquid needed a $120M loan from FTX and died with it, and two smaller rescues collapsed under their buyers.

Sold later, at a premium (4)

A hack does not always mark the top of the risk. Deribit lost $28M in 2022, and Coinbase later bought it for $2.9B, 104x the hack. Bitstamp lost $5.3M in 2015, and Robinhood paid about $224M for it. Upbit, hacked for $49M in 2019, has a pending deal with Naver.

Died after the hack (14)

Mt. Gox, BitGrail, Cryptopia and Lykke are the best known. The dead were mostly small: their median hack was $6.5M, against $26M for exchanges that survived. Of the 25 exchanges that lost $40M or more, only Mt. Gox and BitGrail died right after. Below $40M, 12 of 44 did. Dollar size here is a proxy for exchange size, so read it as a pattern, not a law.

Survived, then closed (10)

BitMart, CoinEx, EXMO, AscendEX and NoOnes all got through their hacks, then announced closures between July and September 2026. Only EXMO partly tied the decision to its hack.

The clock

We checked withdrawal reopening dates in 20 cases. Exchanges that survived had withdrawals back in a median of 5 days, and 11 of 13 reopened within three weeks. Bybit, Crypto.com and Deribit took less than a day. Mt. Gox, Cryptopia and Lykke never reopened. All three died.

Who paid matters as much. In 12 of 21 cases the exchange covered the loss itself from reserves, SAFU or an insurance fund. Four relied on loans or outside money, two cut client balances, and in three cases nobody paid. All three of those died.

Binance: survivor territory

Binance lost $6.36B on October 29, about 3.7% of its $171B in reserves. It replaced 95% of the stolen amount from SAFU, its insurance fund and treasury, and reopened withdrawals 2.4 days after the drain started. On every measure we tracked, that sits inside the survivor range.

Mercado Bitcoin: the number to watch

Mercado Bitcoin, founded in 2013, serves 4.5M clients. The main drain took about 34 minutes across roughly 10 chains, through ordinary signed transfers rather than a smart contract bug. MB says the incident is contained, with no harm to clients and no data leak, and Tether froze 4.5M USDT.

MB applied for its new Brazilian central bank licence on October 27, six days before the hack. The rules already required an incident response plan, and nothing in them says a hack costs a licence.

Deposits and withdrawals are still paused, with no reopening date. History says that date is the clearest early signal of how this ends.

Sources: company statements and filings, Banco Central do Brasil, Hypernative, CoinDesk, The Block, Reuters, CryptoDiffer analysis of 69 exchanges hacked for $1M+ (2011-2026).