Exchanges Reveal Hidden Risks: Loss Absorption Capacity Trumps Attack Size

Three centralized exchanges, Bitget, Bybit, and WazirX, suffered significant security incidents between 2024 and 2026. The breaches resulted in losses of approximately $387.5 million, $1.46 billion, and $230-235 million respectively.

The recovery process varied among the three exchanges, with Bitget restoring operations in 85 hours using its own resources, Bybit maintaining continuous withdrawals despite a loss of institutional scale, and WazirX freezing users' assets for 463 days due to lack of sufficient reserves.

The outcomes highlight the importance of loss absorption capacity and custody architecture in determining the result of security incidents. Bitget's decision to cover the full impact with its own resources ensured user balances remained unaffected, while Bybit's ability to assume cost on its balance sheet maintained operational continuity.

WazirX, lacking sufficient reserves and access to bridge financing, converted clients into creditors under a court-approved restructuring scheme, aiming to recover 75-80% of locked funds over an undefined horizon.