How Can an Exchange Distinguish between a Legitimate Hash Rate Increase and an Attack Preparation?

Exchanges look for specific patterns. A legitimate increase is usually gradual, corresponding to an increase in the coin's price or mining profitability.

An attack preparation is often characterized by a sudden, massive, and temporary spike in hash rate followed by a deep block reorganization. Monitoring the source of the hash rate (e.g. known rental services) and correlating it with deposit/withdrawal patterns can also help in differentiation.