Why crypto exchanges get hacked, and Bitcoin ETFs do not | Opinion
In September, Bitget, one of the world’s larger crypto exchanges, lost about $352 million from its internet-connected wallets. A year and a half earlier, Bybit lost about $1.5 billion. Indian investors remember WazirX, which lost about $230 million in July 2024 and froze withdrawals for months.
Over the same period, US spot Bitcoin ETFs have grown to hold more than $100 billion of Bitcoin. None of them has reported losing any to a hack.
Both groups hold the same asset, on the same network. So why do exchanges keep losing customers’ Bitcoin while ETFs do not? The answer has little to do with Bitcoin itself, and a lot to do with what each institution is built to do.
An exchange exists to exchange. Its customers expect to buy, sell and withdraw at 3am on a Sunday, so a meaningful part of its holdings has to sit in “hot” wallets, connected to the internet and able to sign transactions in seconds. Every connection, every employee with signing rights and every software vendor adds to what security teams call the attack surface. Bybit’s loss is instructive: the funds were taken while being moved from cold storage to a warm wallet, through a compromised signing interface. The weak point was not the vault. It was the door, and an exchange opens that door many times a day.
An ETF exists to hold. It has a daily cut-off, much like the stock market it trades on. New money is collected through the day and settled in a single batch. That rhythm means the Bitcoin can stay offline, in cold storage, with the signing keys split across locations and several independent people required to approve any movement. The custodian is usually a specialist appointed to do exactly one thing: keep the asset safe. It does not trade, lend or chase volume.
The distinction is between access and safekeeping. An exchange must optimise for access, and it pays for that in risk. A custodian can optimise for safekeeping, and pays for it in convenience: moving assets takes hours, not seconds.
This is not to say ETFs carry no risk. A large share of US ETF Bitcoin sits with a small number of custodians, which concentrates operational risk, and Bitcoin’s price remains volatile whichever way it is held. But the specific risk that has cost exchange customers billions, a breach of internet-connected wallets, is largely designed out of the custodial model.
The same principle is available to Indian investors who do not buy ETFs abroad. Platforms like BitSave that keep 100% of client assets with an institutional custodian in cold storage, and publish verifiable proof of reserves that anyone can verify 24×7 on the blockchain, follow the ETF model rather than the exchange model.
The question for a long-term investor, then, is not only what to buy, but where it will sit. If the plan is to hold for a decade, an asset does not need to be one click from a sale. It needs to be hard to steal.
Note: The above article is authored by Shiv Ram Pande, Chief Business Officer, BitSave; the views and opinions expressed here by contributors, authors, or guests are their own and do not necessarily reflect the official policy, position, or opinions of LiveMint.
