# Exchange Back-Office Infrastructure Becomes the Main Theft Target

Large losses at centralized exchanges increasingly come from neglected operational systems, such as retired wallets, sweep services and third-party security software, rather than from the main custody stack, so exchange breaches will keep recurring until proof of reserves and operational audits cover the back office.

- Conviction: 40 / 100 (forming)
- Horizon: Emerging (watchlist)
- Tracking since: 2026-10-26T00:00:00.000Z
- Last updated: 2026-10-26T06:47:45.724Z
- Canonical: https://polylog.news/crypto/trends/exchange-legacy-infrastructure-breaches
- Publisher: Polylog

## Recent evidence

- [neutral] Bitget Hacker Resumes Laundering as October's Security Roundup Adds Ledger Implants and Balancer's Wind-Down (2026-10-26): The attacker behind Bitget's $387.5M theft moved $19.48M between Oct. 21 and Oct. 24. This keeps exchange-theft losses in circulation, but the report doesn't say whether the original breach came through back-office systems.
- [confirms] CoinDCX Admits $15.99 Million USDT Loss From Retired Wallets After Chief Executive Called Reports a False Alarm (2026-10-26): Indian exchange CoinDCX admitted a $15.99M USDT loss after its CEO had called the reports a false alarm. It blamed a failure in its automated deposit-sweep service that left customer deposits on decommissioned wallet addresses, and it will absorb the loss. This is a back-office failure in retired wallets and sweep services, exactly the systems the thesis names, and the initial denial shows that proof of reserves doesn't cover them.