In fact any centralized  exchange can be hacked because of human factors. For example binance kyc's docs leak was confirmed recently https://www.ccn.com/dark-web-hacker-proves-leak-of-customer-data-from-worlds-leading-cryptocurrency-exchanges/

Some overdue transparency into the Cryptopia exchange hack
20 January 2019

In the five days since the Cryptopia hack was first reported, we've seen surprisingly little information about what actually happened.

Nobody seems to know:

    * How the theft took place: How, when, and where were the funds taken?
    * How much was lost: Cryptopia has not disclosed how much was stolen. Media reports on the total value of stolen assets range from $3m to $13m.
    * The current status of the stolen funds: We've seen a few blips about exchanges freezing stolen funds, but nothing on how much was frozen or where the rest of the funds sit.

This hack impacts thousands of people who have funds in Cryptopia's custody. While Cryptopia may have their reasons for remaining quiet, we think it's important for the facts to be known.

Ironically, definitive answers to all the questions above are hiding in plain sight, encoded in a public database called the Ethereum blockchain, which is unfortunately not well designed for human consumption. However, our technology is designed to enable just that.

Based on data sourced via the Elementus query engine, here is how the Cryptopia hack actually went down.

Edit: As we know there is a lot of bad information going around, we've posted the raw data used in this analysis online so that anyone can validate it for themselves.
What happened?

This case is quite different from other high profile hacks we've seen in the past. But before explaining what makes this case so unusual, here is a brief overview of what's been reported and what we can deduce from the blockchain.

All times below are Eastern Time (GMT-5).

    - Sunday 13-Jan, 8:28am: Funds begin moving out of Cryptopia's two core hot wallets, one holding ether and the other holding tokens.
    - Sunday 13-Jan, 11:58pm: With the core wallets empty, residual quantities of funds begin leaving Cryptopia's 76k+ secondary wallets, a process that would continue for several days.
    - Monday 14-Jan, 6:00am: Cryptopia suspends trading, announcing they are undergoing unscheduled maintenance.
    - Tuesday 15-Jan, 3:00am: Cryptopia discloses the security breach and New Zealand law enforcement steps in.
    - Thursday 17-Jan, 5:58am: The last of Cryptopia's funds are drained.

By our calculations, the total value of the stolen crypto (ether and various tokens), at current market prices, comes out to about $16 million. This number includes only what's on the Ethereum blockchain (ether and ERC20 tokens). We have not examined the Bitcoin blockchain or other blockchains to see if funds were stolen there as well.
The thieves took ether and ERC20 tokens valued at about $16 million

Cryptopia hack - market value of losses by coin

The breakdown of losses by cryptoasset is shown below.
Asset    Value (USD)
ETH           $3,570,124
Dentacoin   $2,446,212
Oyster Pearl   $1,948,223
Lisk ML   $1,718,610
Centrality   $1,148,144
Mothership   $880,141
Ormeus   $452,841
DAPS           $384,425
Zap           $147,158
Pillar           $254,521
Other tokens   $3,051,709
Total           $16,002,108

Market value of crypto assets stolen from Cryptopia, valued at 19-Jan-2019 market prices. For more detail, see the full breakout by token / full list of transactions out of Cryptopia into the hackers' wallets
Where are the stolen funds now?

For the last few days, the hackers have been shuffling the funds around in small pieces and gradually moving them into exchanges to cash out. The table below shows how much has been sent to each exchange.

How much have the thieves attempted to cash-out at exchanges?

Exchange    Deposits    Value (USD)
Bibox   44   $326,581
Binance   63   $279,525
Huobi   21   $147,715
HitBTC   23   $56,648
CoinExchange   9   $22,908
Digifinex   6   $13,017
Bittrex   2   $11,865
Changelly   8   $8,152
Kucoin   4   $6,597
ABCC   6   $4,978
Mercatox   2   $3,199
LAToken   1   $1,381
Bitmart   1   $66
Gate   2   $0
Total   192   $882,632

Market value of stolen crypto assets that have been sent to exchanges

Of the $16m that was stolen, the vast majority (~$15m) remains in two wallets controlled by the thieves:

    0x9007a0421145b06a0345d55a8c0f0327f62a2224
    0xaa923cd02364bb8a4c3d6f894178d2e12231655c

We are continuing to watch the movement of the funds and will keep the figures in this post updated.

What makes this hack so unusual?

This hack is quite different from other high-profile heists on the blockchain. Normally, they fit one of two profiles:

    * Smart contract exploits (e.g. Parity, The DAO, SpankChain): Hackers discover a vulnerability in a wallet's smart contract code, which allows them to empty its funds. These cases may involve many wallets, if the same vulnerability is present in all of them. But once the first wallet is breached, things come to a head rather quickly, as it typically becomes a race between the hackers and the wallet owners (sometimes assisted by white hat hackers) to get to the money first.

    * Unauthorized access credentials (e.g. Coinrail, Tether, Gatecoin): Someone outside (or perhaps inside) the company manages to get a hold of a wallet's private key and simply withdraws the funds into their own blockchain wallet. These cases typically involve the breach of a single wallet, and by the time the theft becomes publicly known, the funds are long gone.

The Cryptopia hack differs from these profiles in two glaring ways.

The hack involved a large number of wallets.

The funds were taken from more than 76k different wallets, none of which were smart contracts. The thieves must have gained access to not one private key, but thousands of them.

The hack continued for days after Cryptopia discovered the breach.

The lack of urgency on the part of the thieves is striking. Rather than withdrawing the funds as fast as possible, as is the case in most crypto hacks, they took their time extracting the assets over the course of nearly five days.

After Cryptopia discovered the hack, they watched the funds continue to flow out of their wallets for four more days, seemingly powerless to stop it. As these wallets were not smart contracts, there should have been no technical complications preventing Cryptopia from securing the funds.

The only plausible explanation for Cryptopia's inaction is that they no longer had access to their own wallets.

It seems Cryptopia not only lost their funds, they also lost access to all, or nearly all, of their 76k+ Ethereum wallets.

One possible explanation is that Cryptopia had their private keys stored in a single server with no redundancy. If the thieves managed to gain access to this server, they could have downloaded the private keys before wiping them from the server, leaving Cryptopia unable to access their own wallets.
Conclusions

Our conclusions from the investigation.

2,000 Ethereum wallets and $46k in Ether remain at risk.

We count about 2,000 remaining Cryptopia wallets holding a combined balance of ~380 ETH (about $46k). Most of these funds were deposited by Cryptopia users after the initial hack took place, apparently unaware of the security breach.

Assuming the thieves have access to these wallets, and Cryptopia does not, recovering the funds is a lost cause. However, if Cryptopia knows the identities of these users, hopefully they've had the foresight to contact them and let them know not to send any more funds.

It's likely Cryptopia has additional funds safely stashed away somewhere.

The value of stolen ETH amounts to "only" about $3.5m. While this is by no means a small amount in absolute terms, it is small relative to what we would expect Cryptopia to hold in user deposits. This leads us to think Cryptopia must have a cache of ether stashed away.

If these funds are out there, they would either be stored on-chain in a cold wallet or off-chain in the custody of another exchange.

Exchanges should be freezing these funds as soon as they arrive.

No excuses. On the blockchain there is nowhere to hide, and no reason 100% of these transfers should not have been frozen immediately.

Any exchanges who care about compliance and want to block these illicit funds are encouraged to get in touch. We will set up a real-time alert to notify you the moment any of these stolen funds hit your accounts, free of charge.

No excuses.

Police making progress in crypto-currency investigation
Tuesday, 22 January 2019 - 5:23pm
National News

Police continue to investigate the unauthorised transfer of crypto-currency worth a significant sum from Christchurch-based crypto-currency trading company Cryptopia on 13-14 January 2019.

Good progress is being made and positive lines of enquiry are being developed to identify the source of the transfer, and to identify where the crypto-currencies have been sent. The assistance of the crypto currency community is being sought as the investigation progresses.

This is a very complex investigation, involving expert digital forensic investigators from within New Zealand and in various overseas jurisdictions, as well as overseas authorities.

Members of the investigation team met with Cryptopia management and staff yesterday and today and outlined progress in the investigation.

Cryptopia management and staff have been co-operating with Police and providing considerable assistance in the investigation. 

The investigation is expected to take some to time complete, and the digital forensic team will be on-site at Cryptopia’s premises for some days to come.

Anyone with information which could assist the investigation can contact police by email at crypto@police.govt.nz .

ENDS

Issued by Police Media Centre

Posted byu/spammero
4 hours ago
Stolen ORME from cryptopia going to Bibox wallet...

Sooo after tracking stolen ORME coins from "hacker" wallet, they transferred the ORME coins from cryptopia to Bibox exchange wallet.

It was the transfers in order: hacker wallet - all stolen ORME to random wallet - all stolen ORME from random wallet to many random wallets (splitted in 400k-800k transactions) - all ORME from random wallets to Bibox main wallet.

https://i.imgur.com/I8z2Xrn.png

You can check the last transfers to Bibox exchange wallet on this img or checking it in etherscan.

https://etherscan.io/token/0x516e5436bafdc11083654de7bb9b95382d08d5de --- ORME token

https://ethplorer.io/address/0xf73c3c65bde10bf26c2e1763104e609a41702efe#transfers=2 --- Bibox wallet

Have you ever checked QRL at crypto51.app to know the theoretical cost of 51 attack? It costs 10$ per hour. Don't you think it's a bit ridiculous to talk about quantum computing with such a huge risk of simple 51% attack?

I heard that this exchange was hacked. Today, every time the situation that would really concern the exchanges and hacking begins to resemble cases when the exchanges are breaking into themselves in order to collect the necessary amount of funds.

You can't say it is no more 2014. It was mt.gox that hacked.

If you think they were the market leader at that time, it would be like binance hack. And that would crash the markets a lot.

What can we expect. Every month there are new exchanges. Which do not meet the high standards of protection. Hackers, of course, are young, they skilfully find frays in such exchanges. The losses will not be big. Since this may lead to a further fall in cryptocurrency prices.

This is the type of thing that makes everyday people scared to use crypto. Hopefully Cryptopia has the resources to make this right and can patch up holes in its security.

I have a lot of issues with them in the past, mainly from support and transactions that take days to confirm. Cryptopia is being beaten by the new exchanges that offered lower fee and cheap listing the only reason I'm here are from a few coins I'm holding that I can only trade here.

this is a truly shame, an exchange went down again. this is going to end as any other time, no funds will be gathered back nor the exchange will come back online. Luckily I'm not using such shitexchanges since a few years when I dumped all my shitcoins.

Not very techy but hey, welcome to the forum although you're older than me to get in and has been involved to the economy for quite a long time. I've been reading some future insights about quantum computers and some are very positive to it but there's always a division of opinion regarding that.

I'm not sure on where we will be going by that time but I think we're still far from that day where intervention with quantum computers to crypto happens.

Okay and do you have some better site? I don´t think that someone will verify all 2200 crypto listed projects. That is impossible.

Well, but if I am a trader, what should I do next? Just everybody keeps funds on exchanges, but I prefer bigger exchanges with good security like binance, okex.
And yeah, if you have big portfolio, then I would split it between cold wallets and several exchanges!

I think we need FRAUD LISTING thread on Bitcointalk forum to fight scammers and bounty hunters need to come together as ONE ,they are the ones Help PROMOTING all this fake projects ,they should be able to warn each other when a fake/scam project get launched on the forum and get the scam project banned off the forum ,we should all remember that the more fake projects are been launched of this forum right under our noses the more cryptocurrency will keep looking bad and NEWBIES are the victims most times ,we investors and bounty hunters have the power to make BITCOINTALK FORUM BETTER.

UPDATE!

As a NEWBIE I never knew we have a scam accusation thread on here ,so newbies like me and for those who doesn't know please let's keep the thread alive ,I believe this will safe many newbies from falling victims
https://bitcointalk.org/index.php?board=83.0