The Risk of Storing Your Funds on Centralized Exchanges

[obuoma]

I'm surprised that Bybit did not send email correspondence to their customers for something as big as this. It is possible that they are not yet aware but I'm sure this incidence should already be on social media expecially X. Storing money in CEX is a very risky thing to do and should be avoided. The only time I send money to exchange is when I want to trade through sport of P2P, this helps me lower the risk such that any loss will be that funds and not my entire saving.

[BIT-BENDER]

So I was just online doing my usual activity , then this warning message popped up from a friend .  Saying that his friend  Bybit was compromised, I had to ask him in his private dm how did it happened he was like they login with his email . Now there’s nothing they can do , this is the reason why keeping your assets in exchanges is not encouraging at all , and we can never emphasize on that enough . Because many will keep falling for it , there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support (I’ve mentioned a friend that also fell for this ) e.t.c.

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

Who wiped the friends funds? Is it the exchange or scammers, the story wasn't specific on if it's about exchanges clearing out people's fund or is it a type of negligence from the friend that resulted into getting their funds stolen.

Regardless it is nearly 2027 are we still going to talk about not saving your funds on any exchange, it's such an embarrassment to see that there are people who get their asset cleared out because they left it on an exchange.

[Stable090]

So I was just online doing my usual activity , then this warning message popped up from a friend .  Saying that his friend  Bybit was compromised, I had to ask him in his private dm how did it happened he was like they login with his email . Now there’s nothing they can do , this is the reason why keeping your assets in exchanges is not encouraging at all , and we can never emphasize on that enough . Because many will keep falling for it , there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support (I’ve mentioned a friend that also fell for this ) e.t.c.

Leaving your coin on exchange is not always encouraged because anything can happen to it at any moment. Also you are not suppose to give random people your phone, because they might end up getting informations which they need about you, if they have access to your phone. Also I do encourage people not to stay logged in on the gmail which they used to register on sensitive websites.

Don’t believe anyone that ask for your Gmail or password claiming they are customer support, you should know that customer support will never ask you for your password, only scammers are going to do that.

We should only keep the amount which we are using to trade on exchange, and if we won’t be trading for some time, make we just withdraw d money back to our wallet, I feel say na d best thing just be that, make we no Dey leave coin for exchange.

[iBaba]

So I was just online doing my usual activity , then this warning message popped up from a friend .  Saying that his friend  Bybit was compromised, I had to ask him in his private dm how did it happened he was like they login with his email . Now there’s nothing they can do , this is the reason why keeping your assets in exchanges is not encouraging at all , and we can never emphasize on that enough . Because many will keep falling for it , there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support (I’ve mentioned a friend that also fell for this ) e.t.c.

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

This is why my advice always is that we should take security serious first before you take any step, not only after something happens, things like phishing links, sim swapping and fake support accounts can catch anybody off guard. You don’t have to master everything, just know what to avoid and it could save you from a lot of trouble.

If you are keeping bitcoin for long term using a wallet where you can control the keys gives you more control and know that self custody comes with responsibility too. If You lose your seed phrase or you give it to somebody, there may be no one to help you return your bitcoin back to you.

[Odogwu-Blockchain]

It's your friend fault for keeping his login details in the wrong place, or given out his details to someone knowingly or unknowningly, Bybit has nothing to be blamed for such fraudulent activity that happens in their customers account because it'd be warned never to give out keys to anyone.

Aside from decentralized wallet bla bla, if you are careful with your cex details, you can still be saved except bybit is hacked by a large body of hackers the same way Coldcard suffered.

That kind of case, bybit will compensate every victims from such incidents because it's not customer's fault but the team's fault for not been able to secure their platform.

[The funny mimi]

Your friend didn't enable his 2FA which is the cause of his Bybit account being compromised. This is why it's good to enable 2FA and use different device for your google authenticator so that, if someone have access to your email, he wouldn't have access to your google authenticator. However, only keep what you can afford to lose in an exchange even though, you are a trader and store your major funds in a self custody wallet.

That makes sense
 I’m still a beginner, so I’m learning how important security is when using exchanges like Bybit.
 I didn’t realize that using a separate device for Google Authenticator could add another layer of protection. I also agree that we shouldn’t keep more money on an exchange than we can afford to lose.
 Thanks for sharing this

[Mia Chloe]

~snip

People trust centralized platforms because it makes them feel safe. Outside communities like this forum most people really don't care giving out their KYC data vey easily and most of them do so because of lack of information and most don't even see the dangers in it.

Like I always say these kind of stories and cases will never cease to exist no matter how much you preach decentralization and privacy. The rate at which people accept unnecessary centralization is straight up wild honestly.

[Miles2006]

Always a repeated topic about scammers hacking users exchange account, will people ever learn? Not sure except they learn the hard way. Let them experience it since they don’t want to avoid storing their coins in an exchange, from my experience I receive message twice concerning someone trying to login into my account with a different device. The knowledge about exchange seems to be popular yet everyday people get scammed, nothing is ever certain so it’s not about disclosing personal informations obviously without personal information hackers will always find a way to hack once a person appears as a target. Centralized exchange is meant for buying and selling coin, I wonder why anyone will store coin in an open wallet that might choose to close at anytime.

[CryptoHeadlineNews]

So I was just online doing my usual activity , then this warning message popped up from a friend .  Saying that his friend  Bybit was compromised, I had to ask him in his private dm how did it happened he was like they login with his email . Now there’s nothing they can do , this is the reason why keeping your assets in exchanges is not encouraging at all , and we can never emphasize on that enough . Because many will keep falling for it , there are various way they can access your account , ways like ; phishing , Sim swapping , malware , Malicious API keys ,Fake customer support (I’ve mentioned a friend that also fell for this ) e.t.c.
.

I'm still finding it a bit difficult to actually understand how this scam was able to get executed, because does it mean your friend didn't enabled 2 factor authentication? Because had it been he had done so, the scammer won't have been able to have access to his Bybit account. And this is another reason why we shouldn't be login in people's phone with our Gmail without logging out when we are done checking what we were doing, because it is obvious the person who scammed this guy might be very close to him. However, non custodial wallets will still remain the best place to store our BTC.

[Homemade-IQ]

This matter about storing your crypto asset in an exchange na old story wey all of us know say na wrong thing to do, because if anything happen to the exchange or person gain access to your account, automatically you fit lose everything you get there, this one no be rocket science.

Funny enough, most people know about all this risk, but them go still keep their asset there, just because them want easy access to the asset there, but those types of people, na only when bad thing happen to them like this, before them go learn their lesson.

[Felicity_Tide]

enable strong 2FA,

While reading the post, this was the only thing that kept going through my head. In as much as it's not advisable to store long term assets on Cex platforms, there are also measures that needs to be taken in order to protect the little ones people store there. I can't really wrap my head around how people manage to become victims of their own negligence especially in this situation where most exchanges now offer so many security delivery options... SMS/Gmail/Authenticator apps. And you can even use the three options.

What's even more crazy is when you actually know about all these things, but fail to take them serious. At the end of day, everyone will have to take responsibility for their own actions, and also face the consequences.

[IceLincoln]

The story in the OP isn’t actually related to the title, the information OP is passing is relevant but it’s misplaced because the scam attack wasn’t due to the lapses of centralised exchange but due to the negligence of the user in protecting his account.
Yes there are much risks in using centralised exchanges but even in self custody if you’re not careful, your account will still be compromised, the most important thing is to ensure you have maximum security on all wallets holding your funds and also take security as priority everyday at all times.

[DPHOR]

Nowadays people are so much relaxed on storing their assets on crypto exchange where it would be that easier for them to sell or tradyat any points without them knowing that it is actually risky to keep leaving their assets on exchange simply because they needed an easy access to their assets making them to leave their investments on Centralized platform without knowing the risk associated with leaving their investments on exchange. If there is anything like hack it would definitely affected those that are really leaving their assets on Central exchange which shouldn't be encouraged at any point because since they don't have the keys to their it's assumed they don't have a total control of their assets as well.

[CryptopreneurBrainboss]

This doesn’t mean exchanges are automatically unsafe. They also play vital role in this space by like  making  buying, selling and trading crypto much easier. However, always remember that “NOT YOUR KEYS NOT YOUR COINS “ keeping all your assets on a centralized platform means you are trusting a third party to safeguard your funds. Longterm assets is better kept in a Noncustodial wallet , also avoid using same password in different platform , enable strong 2FA, and always Review Your API Permissions e.t.c. Further research on how to keep your assets safe .

Just wanted to highlight this part as these are what help you stay safe in the industry, and again exchange's aren't entirely to be avoided because we still need them but don't trust them to keep you safe when their platform aren't even safe from hacks so how then do you think they can do a perfect job protecting your coins than yourself (if you follow the precautions of safeguarding your assets perfectly). Use exchanges for only what they're meant for and make use of other platforms for only their intended purposes and you won't put your assets in harm way. Don't use the same wallets for everything as having separate wallets for different things will give you more security incase one gets compromised, it doesn't affect your other investments/coins.

[OsaiEmma]

This particular risks doesn’t apply to only Centralized Exchanges alone, it’s Wallet or account compromise and it can happen anywhere if the holder is not due diligent

This was exactly my thought after reading the OP. Laxity in security leading to wallet theft and crypto compromise is the fault of the user. If for whatever reason your email gets compromised, otilo—it's over lol. So it doesn't really matter if it's a custodial or non-custodial wallet, if you're not good in securing your wallet it will be compromised.

So...we should be safe out there and watch out carefully, especially for phishing attack.

but compromises are much easier on Centralized exchanges or platforms than Self-Custody Wallet.

I don't think this is true, let's be realistic, I've heard more non-custodial wallet compromise than custodial ones. It takes extra effort to compromise a custodial wallet; but for a non-custodial wallet, just a little slip up will lead to serious drainage.

The best set up is not just a self-custodial wallet, but a cold self-custodial wallet.

[Silikiem]

The risk of storing your funds in a centralized exchange is different from when a user is actually being negligent with his/her details, especially the log in details on the platform. Yes it’s true that there could be some risk associated with having funds in a centralized exchanges because sometimes if this exchanges are undergoing some kind of maintenance, your funds could be locked up and you might not have access to it when you needed it most, another one is the exchange company might go bankrupt and your assets will be lost. In nutshell, the moment one is storing their funds in a centralized exchange it means you’re trusting a third party or intermediary with your funds. But in this case, I’m suspecting that the said user whose funds was stolen might have disclosed his email log in details including the password and that’s why his funds was stolen. This is a result of negligence.

[I_Anime]

Logged in with his email like they hijacked his email account ? Because that’s the only way they can get through if eventually OP is also using same email  on  a cloud TOTP authenticator service like Google..  even when a 2FA is enabled for an account.

Email verification are usually required when signing in from a new unrecognized device though … could depend on the CEX too .

So there’s a lot of possibilities here..

That’s the crazy thing . My friend could not even tell me what really happened, he only said his friend email was compromised. Wanted to investigate further by asking more questions, I was like no need it has already happened, many may look this as something simple or normal , but is one of the most scary thing that can happen to anyone in this space , your hard earned money gone like that without a trace . Even those that are using noncustodial can also fall victim (but not with email ), but through other means of carelessness. I would have like to know what really happened cause is best to learn from someone mistakes.

[Yablee0]

This information is no news but it's fine bringing it to the noticed of the newly cryptocurrency/Bitcoin enthusiast. I know many people are still falling victim of this even till this time. However, having your assets in an exchange is a red flag and is like keeping your valuables in somewhere that isn't safe. Therefore, you risk losing it at any point in time and that is not a good one at all. Self custodial wallet is just the perfect decision anyone can take.

Just as it's said , not your key not your coin. Many Bitcoin enthusiast undermine this golden rule and that is the more reasons they keep falling for this in several occasions. I wonder who else can keep our assets safe if not us.

[Cossyblack]

He lost his funds to scammers because his security measures were poor. I use 2FA and passkey verification for my central exchanges. Even if someone has access to my email, he can't use my email and phone number to get access to my account.

Personal security is very important. Your friend gave his device out. It was a well-planned attack on him. In this life, there is nothing that will push me to give someone my device. I don't do all those hep me with your phone shit.

I agree with you, he must've have allow the wrong hand to operate his phone. Another mistake that some people make is that they saved their passwords on their devices for convenient when loggin into their centralised exchange, this is wrong especially if you like giving out your device to random persons,because your account can be access through your saved credentials and in a blink of an eye,your asset could be gone forever.
Again, maybe they must've hacked his account through his Email. This is why i monitor who I give my phone to,so that I can monitor what you are using it for..

[Joeboy]

but compromises are much easier on Centralized exchanges or platforms than Self-Custody Wallet.

I don't think this is true, let's be realistic, I've heard more non-custodial wallet compromise than custodial ones. It takes extra effort to compromise a custodial wallet; but for a non-custodial wallet, just a little slip up will lead to serious drainage.

The best set up is not just a self-custodial wallet, but a cold self-custodial wallet.

A Non custodial wallet can be compromised that's kinda possible, but then again the chances of that happening is like 10/100-- meaning that there is a lesser chance of wallets being compromised systematically when compared to a custodial wallet and so what you claimed to have heard may not be entirely true.. Non- custodial wallet gives its users full control over their private keys and this in turn gives that same user full control over their coin.. Most news of lost coins from wallets are mostly due to the poor security habits of that individual, such as mishandling of seedphrases and whatnots... And that is exactly different from the wallet itself being compromised.. As we all Not Your Keys Not Your Coinz...