After a Hack, "We'll Compensate You" Is Now Law in Europe — Not in the U.S.

In February 2025, hackers drained roughly $1.5 billion of ether from the exchange Bybit, and Bybit told customers, effectively, that everything was fine: client assets remained 1:1 backed, and the exchange replenished its reserves with emergency loans from Galaxy Digital, FalconX, and Wintermute. In July 2024, hackers took $230 million from the Indian exchange WazirX, and its customers got a court-approved restructuring that paid out roughly 85% of their approved claims, valued as of a set date — a haircut dressed in a recovery token. In 2014, Mt. Gox customers went into bankruptcy and lined up behind a trustee.

Read those three outcomes side by side and the "compensation" column looks like a coin flip, decided case by case, by whoever happened to hold the keys. This is the state of things most U.S. investors still operate under: after a hack, what you get back is a promise, and the promise is worth whatever the platform decides.

That is no longer true in Europe. The change is small, specific, and checkable — which is exactly why it matters.

The promise moved from the terms sheet to the statute

The same exchange hack is now governed differently depending on which jurisdiction holds your wallet. Europe's Markets in Crypto-Assets Regulation (MiCA), Regulation (EU) 2023/1114, applied its licensing regime for crypto-asset service providers from December 30, 2024, and the national grandfathering windows that let pre-existing firms keep operating under old licenses largely closed in mid-2026.

At the center of that regime is Article 75(8). For a provider authorized to hold customers' crypto-assets in custody, it reads as a straight legal liability: the firm is "liable to their clients for the loss of any crypto-assets or of the means of access to the crypto-assets as a result of an incident that is attributable to them", with that liability "capped at the market value of the crypto-asset that was lost, at the time the loss occurred."

This is the identity switch. Before the rule, "we'll compensate you" was a marketing posture a custodian could revisit after a quiet week. After the rule, it is a line item on a licensed balance sheet: a hack the firm caused is the firm's loss, not your lottery ticket. The only escape is narrow — the provider must demonstrate the loss "occurred independently of the provision of the relevant service, or independently of the operations of the crypto-asset service provider," such as a fault in the underlying distributed ledger itself. If the keys were under the provider's control and the attack came through its systems, that carve-out does not reach it.

What the promise is — and what it is not

Three caveats keep the headline honest, and they are the part most summaries skip.

First, the liability attaches to the licensed custody-and-administration service, not automatically to every balance sitting on a general trading venue. MiCA draws the boundary hard: Article 75 is the rulebook for the authorized custody service, while the safekeeping baseline in Article 70 applies to every provider holding client assets but carries no equivalent statutory loss-repair. Where your coins sit inside the platform — and under which authorization — decides whether the promise reaches you.

Second, the cap is set at the moment of loss, not at the moment you are paid. If your ether is stolen at one price and the market doubles before settlement, the law makes you whole in euros at the old value while you are short the coins themselves. The compensation is a floor, not a replacement.

Third, this is a direct liability of one corporate balance sheet. There is no pool, no fund, no backstop standing behind it. The analogy a reader reaches for is deposit insurance or SIPC — and it detonates the moment you ask the second question: who pays if the custodian is both hacked and insolvent? Deposit insurance is pooled and prefunded; MiCA is an unfunded claim against the firm that just lost your money. The guarantee is only as payable as the balance sheet behind it is whole.

What it means for a U.S. portfolio

Nothing in MiCA protects a U.S. customer holding on a U.S. venue. The FDIC does not insure crypto held on an exchange, and SIPC protects securities at a broker, not raw crypto custody. For a U.S. retail investor, the compensation for a hack remains what it was for Mt. Gox: a negotiation over one firm's remaining assets.

That divergence is itself the investment-relevant fact. It reframes "where do I hold my coins" from a convenience question into a legal-jurisdiction question. An EU-authorized custodian that loses your coins carries a statutory obligation to make you whole up to the time-of-loss value; a U.S. counterpart's identical promise is contractual good faith that management can revisit under stress. For anyone reaching for the higher protection, the rational place to look is a MiCA-authorized, custody-licensed venue — with the caveat that the protection is a claim on that firm's balance sheet, so its capital adequacy and the real segregation of client assets are now the actual measures of whether the promise is payable.

For platforms themselves, the rule is a cost line that did not previously exist. A provider that must eat a hack loss up to the time-of-loss market value carries a hard, capped balance-sheet exposure. That favors well-capitalized custodians and penalizes thin ones — and it gives a reason to read proof-of-reserves and solvency data as counterparty-risk inputs rather than marketing.

The break condition

The clean objection to this whole read is the escape hatch. Regulation text "attributable to them" has a long litigation half-life, and some provider will lose coins to a sophisticated exploit and argue the attack was independent of its operations. The day a German court or a BaFin-supervised firm successfully presses that carve-out for a core custody hack, the statutory promise shrinks back toward the discretionary promise it replaced — and the repricing of EU-regulated custody relative to everything else gets restated, not abandoned.

Until that ruling, the table is simple. Europe turned a coin-flip compensation into a capped, licensed liability. The U.S. still runs on the coin flip.