The Biggest Crypto Hacks in History: 17 Heists Ranked (2026 Update)

Updated October 30, 2026.

The biggest crypto hacks in history used to be measured in hundreds of millions of dollars. Mt. Gox lost about $473 million worth of bitcoin. Coincheck lost about $530 million.

Then the numbers broke. Bybit lost about $1.5 billion in February 2025. And on October 29, 2026, attackers took about $6.36 billion from Binance in roughly 20 minutes, according to blockchain analytics firm TRM Labs. That one theft is bigger than the next 11 on this list combined.

This list ranks every crypto hack we could verify at more than $200 million, by value when stolen: how the attackers got in, who was blamed, and how much came back. Then the patterns: North Korea's share, why some money gets frozen and some never does, and how to protect your own coins.

Biggest crypto hacks in history: the short version

• The largest crypto hack ever is Binance, October 2026: about $6.36 billion across ten blockchains, per TRM Labs. Binance's preliminary finding points to a compromised engineer's laptop.
• Bybit is second at about $1.5 billion (February 2025). The FBI blamed North Korea.
• 17 hacks have topped $200 million by our count, and five of them happened in 2026 alone: Drift, KelpDAO, Liquid Network, Bitget and Binance.
• North Korea dominates. Hacks linked to North Korea by investigators, analytics firms or the companies involved make up about $10.3 billion of the roughly $13.8 billion on this list. Some of those links are still preliminary.
• Most big hacks aren't code bugs. About 85% of the money on this list was lost through compromised people, devices, keys and infrastructure, not smart-contract bugs.
• Recovery is rare and lopsided. Stablecoins can be frozen by the companies that issue them. Stolen bitcoin and ether almost never come back unless the thief returns them.

The biggest crypto hacks in history, ranked

Values are what the crypto was worth on the day it was stolen.

1. Binance (October 2026): about $6.36 billion

On October 29, 2026, Binance hot wallets on ten blockchains were drained, most of it in about 20 minutes. A hot wallet stays online so an exchange can pay out withdrawals fast, which makes it the usual target.

How they got in: Binance's preliminary finding is that a DevOps engineer's laptop was compromised, giving the attacker a service container that sent unauthorized withdrawals. TRM Labs says the pattern points to Binance's hot-wallet signing system. Who: TraderTraitor, a North Korean state hacking unit, per TRM (high confidence). Recovered: about $2.7–3 billion frozen, almost all stablecoins; Binance says its SAFU fund and company money cover users. Full story: how Binance was hacked.

2. Bybit (February 2025): about $1.5 billion

How they got in: forensic firm Sygnia and wallet provider Safe said a Safe{Wallet} developer's machine was compromised. Malicious code disguised a transaction, so Bybit's signers emptied an Ethereum cold wallet while their screens showed something else. Who: the FBI named North Korea's TraderTraitor five days later. Recovered: about $42 million frozen in the first days. Bybit said it remained solvent.

3. Ronin Network (March 2022): $625 million

Ronin is the bridge behind the game Axie Infinity. A bridge locks coins on one blockchain and issues matching tokens on another, so it sits on a big pile of locked coins. It lost 173,600 ETH and 25.5 million USDC.

How they got in: The Block reported that an engineer was lured with a fake job offer whose PDF carried spyware. Attackers took four of the nine validator keys that approve withdrawals, plus a fifth through an old allowlist nobody switched off. Who: the FBI named North Korea's Lazarus Group and APT38. Recovered: developer Sky Mavis raised $150 million to reimburse users.

4. Poly Network (August 2021): $611 million, mostly returned

How they got in: a permissions flaw in Poly Network's cross-chain smart contracts let the attacker approve transfers to themselves, according to CertiK. Who: unknown; Poly Network nicknamed them "Mr. White Hat." Recovered: nearly everything. The hacker returned the funds over about two weeks and refused a $500,000 bounty.

5. BNB Chain bridge (October 2022): about $570 million

How they got in: the attacker forged the proofs that BSC Token Hub, the bridge between Binance's two BNB chains, relied on, and got 2 million newly created BNB. Recovered: validators halted the chain within hours. Binance's then-CEO estimated about $100 million got away; others say $110–130 million. Who: not publicly attributed.

6. Coincheck (January 2018): about $530 million

How they got in: about 523 million NEM tokens sat in a single-signature hot wallet, and the attacker got its private key. Recovered: Coincheck repaid about 260,000 customers in yen from its own funds, about ¥46 billion. Who: never confirmed.

7. FTX (November 2022): about $477 million

Within a day of FTX's bankruptcy filing, about $477 million left its wallets in unauthorized transfers, by Elliptic's estimate. How they got in: in 2024, US prosecutors charged three people in a SIM-swap scheme, where a criminal hijacks a phone number to receive security codes. The indictment's "Victim Company-1" was identified by Bloomberg's sources as FTX.

8. Mt. Gox (2011–2014): about 850,000 BTC

When Mt. Gox collapsed in February 2014, about 850,000 bitcoin were missing, roughly $473 million at the time; about 200,000 BTC later turned up in an old wallet. How they got in: a 2015 WizSec analysis found the coins were stolen from the hot wallet over time, starting in late 2011. Recovered: a trustee began repaying creditors in July 2024 and last moved the final deadline to October 31, 2026.

9. Bitget (September 2026): $387.5 million

How they got in: Bitget says attackers used a zero-day (a flaw with no fix yet) in third-party security products. Mandiant's findings, reported by BleepingComputer, trace them from there to a production wallet server, where Bitget says they spoofed transaction data to trigger its own approval process. Who: Bitget's CEO says the activity matched North Korean groups (preliminary). Recovered: about $1.1 million frozen; Bitget says its User Protection Fund covers users.

10. Wormhole (February 2022): about $326 million

How they got in: a missing check on the Solana side of the bridge let the attacker bypass signature verification and mint 120,000 wrapped ether (wETH) with no real ETH behind it. Recovered: backer Jump Crypto replaced the 120,000 ETH. Who: not publicly attributed.

11. Liquid Network (September 2026): about $320 million, mostly returned

How they got in: about 4,000 BTC left the federation wallet behind Blockstream's Liquid, a bitcoin sidechain; reports describe a software bug, not a cryptographic break. Recovered: the attackers, calling themselves white hats, returned 3,400 BTC after the bug was patched and kept about 598 BTC as a "bounty." Blockstream said it would not pay a ransom.

12. DMM Bitcoin (May 2024): $308 million

How they got in: per the FBI and Japan's National Police Agency, a fake LinkedIn recruiter sent an employee of DMM's wallet vendor, Ginco, a malicious Python script posing as a pre-employment test. That access was later used to manipulate a real transaction and take 4,502.9 BTC. Who: TraderTraitor (North Korea). Recovered: DMM pledged to cover customers, then wound down and moved accounts to SBI VC Trade.

13. KelpDAO (April 2026): about $292 million

How they got in: someone minted 116,500 unbacked rsETH (a restaked-ether token). LayerZero says attackers compromised two RPC nodes (servers that feed blockchain data) its verifier used and flooded others offline. It blames Kelp's "1-of-1" setup, where one verifier was enough; Kelp says it used the default. Who: Lazarus Group's TraderTraitor, in LayerZero's preliminary view. Recovered: Arbitrum's Security Council froze 30,766 ETH, about $71 million.

14. Drift Protocol (April 2026): about $285 million

How they got in: TRM Labs says attackers talked signers of Drift's Security Council multisig (a wallet that needs several approvals) into pre-signing transactions with hidden admin powers. With a 2-of-5 threshold and no time delay, the attacker listed a fake token as collateral and made 31 withdrawals in about 12 minutes. Who: "likely" North Korea, per TRM. Recovered: none reported. CertiK's early estimate of the loss was lower, $136 million.

15. KuCoin (September 2020): about $281 million

How they got in: attackers drained the exchange's hot wallets. Who: Chainalysis linked the laundering to Lazarus Group. Recovered: 84% of affected assets, KuCoin said; its insurance fund covered the rest.

Also over $200 million

• WazirX (July 2024): $234.9 million. Signers of the Indian exchange's multisig wallet approved a transaction that handed control to the attackers; WazirX and custodian Liminal dispute whose systems failed. The US, Japan and South Korea linked it to Lazarus. A court-approved restructuring returned about 85% of claim value in October 2025.
• Cetus (May 2025): about $223 million. A logic flaw in the Sui exchange's pool contracts was drained. Sui validators froze $162 million, and a vote cleared it to go back to users.

Crypto hacks by year: how the record kept breaking

On this list, the record has fallen five times: Coincheck beat Mt. Gox in 2018, Poly Network beat Coincheck in 2021, Ronin edged past Poly in 2022, Bybit more than doubled Ronin in 2025, and Binance quadrupled Bybit in 2026.

2026 is the heaviest year on this list. Before Binance, trackers already called September 2026 the worst month of the year, with PeckShield counting $766.5 million and CertiK $768.4 million. Binance's $6.36 billion alone is nearly double Chainalysis's $3.4 billion total for all of 2025.

How do crypto hacks happen?

Smart-contract bugs get the headlines, but the biggest crypto hacks mostly start with people and machines. Chainalysis found that private key and signing compromises made up 88% of losses in the first quarter of 2025. The same holds across this list.

Exchange wallet systems

Attackers who get inside the systems that sign an exchange's withdrawals can simply pay themselves. Binance (a laptop, then a service container), Bitget (a security-product flaw) and Coincheck (a hot-wallet key) all fit this pattern.

Tricked signers and fake recruiters

A multisig wallet needs several people to approve each transfer, which only helps if they can see what they're approving. At Bybit and WazirX, signers approved disguised transactions. At Drift, signers were talked into pre-signing hidden admin powers. Ronin and DMM Bitcoin both began with a fake job: an offer document or a "coding test" that planted malware.

Bridges and smart-contract bugs

Bridges hold huge pools of locked coins and rely on code or outside verifiers to decide what's real. Wormhole, BNB Chain and KelpDAO were all tricked into creating tokens with nothing behind them. Poly Network and Cetus were straightforward code flaws.

Who is behind the biggest crypto hacks?

North Korea, more than anyone. The FBI has publicly blamed North Korean units for Ronin (Lazarus Group and APT38), DMM Bitcoin and Bybit (both TraderTraitor). A joint US, Japan and South Korea statement linked WazirX to Lazarus. Analytics firms and companies have linked KuCoin (Chainalysis), Binance (TRM Labs), Drift (TRM Labs), KelpDAO (LayerZero) and Bitget (its CEO); the last three are preliminary.

The share keeps growing:

• 2025: Chainalysis counted at least $2.02 billion stolen by North Korea-linked hackers out of about $3.4 billion overall, and put North Korea's all-time total at $6.75 billion as a lower bound. Binance alone nearly matches that.
• Share of hack losses: TRM Labs puts North Korea at 22% in 2022, 37% in 2023, 39% in 2024, 64% in 2025 and 76% in the first four months of 2026 (about $577 million), before Bitget and Binance.
• Tactics: Chainalysis describes North Korean IT workers getting hired inside crypto firms, fake recruiters running "technical screens," and fake investors probing executives.

North Korea has dismissed the reports, blaming "reptile media." And not every big hack is North Korean: Poly Network and Liquid Network were hit by self-styled white hats who gave most of it back, and several others remain unattributed.

How much stolen crypto is ever recovered?

Less than headlines suggest, and it depends on what was stolen:

• Returned by the hacker: Poly Network (nearly all) and Liquid Network (3,400 of about 4,000 BTC).
• Frozen: Binance (about $2.7–3 billion), Cetus ($162 million), KelpDAO (about $71 million) and Bybit (about $42 million early on). Most frozen money is stablecoins like USDT and USDC, which their issuers can block.
• Paid back by the company or backers: Coincheck, Wormhole (Jump Crypto), Ronin ($150 million raise), DMM Bitcoin, KuCoin, Bitget and Binance covered users, or say they will, from their own money or reserve funds.
• Long waits: Mt. Gox creditors started getting paid more than ten years after the collapse. WazirX users got about 85% back after 15 months.

Bitcoin and ether have no company in the middle that can freeze them. That's why, even after record freezes, about $2.4 billion in ETH and BTC from the Binance hack is still with the attacker, per TRM Labs. "Recovered" usually means a company paid, not that the thief gave anything back.

How to protect your own crypto

This is security guidance, not investment advice.

1. Don't park more on an exchange than you need. Big exchanges get hacked. Many made users whole, but that's a business decision, not a guarantee.
2. If you hold your own keys, use a hardware wallet and keep the recovery phrase offline. Personal wallets are targets too: Chainalysis counted 158,000 personal wallet compromises in 2025, worth $713 million.
3. Read what you sign. Bybit, WazirX and Drift signers approved transactions that weren't what they looked like. Use a wallet that shows the transaction in plain terms, and reject anything you can't read.
4. Treat job offers and "tests" as hostile. Ronin and DMM Bitcoin began with a recruiter. Never open a file or run a coding test on a device that holds crypto or work logins.
5. Drop SMS codes. Use an authenticator app, passkey or security key on exchange accounts, so a SIM swap can't take over your login.
6. Expect scams after every big hack. Fake "refund," "claim" or "verify your wallet" messages are a standard follow-up to big breaches; we flagged the same risk after the Sony So-net breach. Go to the official site yourself.
7. In DeFi, check the controls. Drift's 2-of-5 multisig had no time delay, and KelpDAO relied on one verifier. A time delay on admin actions gives everyone a chance to react.

Could you survive crypto's worst heists? (quiz)

Biggest crypto hacks FAQ

What is the largest crypto hack ever?

The Binance hack of October 29, 2026 is the largest crypto hack on record. TRM Labs counts about $6.36 billion stolen across ten blockchains, and attributes it with high confidence to North Korea's TraderTraitor unit. That's about four times the previous record, Bybit's $1.5 billion in February 2025. About $2.7–3 billion was frozen, mostly stablecoins.

What was the biggest crypto hack of 2025?

Bybit, in February 2025, at about $1.5 billion. Attackers compromised a Safe{Wallet} developer's machine and got Bybit's signers to approve a disguised transaction from its Ethereum cold wallet. The FBI attributed it to North Korea's TraderTraitor. Bybit alone made up a large share of the roughly $3.4 billion Chainalysis counted as stolen in 2025.

What is the biggest crypto hack of 2026?

Binance, at about $6.36 billion on October 29, 2026. Before that, the biggest 2026 hacks were Bitget ($387.5 million, September), Liquid Network (about $320 million, mostly returned), KelpDAO (about $292 million) and Drift Protocol (about $285 million). Most of 2026's big hacks have been linked to North Korea, several of them preliminarily.

Who is the biggest crypto hacker?

North Korea's state hacking units, often grouped as the Lazarus Group, with TraderTraitor behind many recent heists. The FBI blamed them for Ronin, DMM Bitcoin and Bybit, and TRM Labs for Binance. Chainalysis put North Korea's lower-bound all-time haul at $6.75 billion through 2025, and TRM Labs ties the $6.36 billion Binance theft to TraderTraitor too.

What are the biggest crypto exchange hacks?

Among exchanges: Binance ($6.36 billion, 2026), Bybit ($1.5 billion, 2025), Coincheck (about $530 million, 2018), FTX (about $477 million, 2022), Mt. Gox (about 850,000 BTC, 2011–2014), Bitget ($387.5 million, 2026), DMM Bitcoin ($308 million, 2024), KuCoin (about $281 million, 2020) and WazirX ($234.9 million, 2024).

Has stolen crypto ever been recovered?

Sometimes. Poly Network's hacker returned nearly all of $611 million, and Liquid Network's attackers returned 3,400 BTC. Stablecoin issuers froze about $2.7–3 billion of the Binance haul. But stolen bitcoin and ether rarely come back, so most "recoveries" are companies or backers repaying users, as Coincheck did from its own funds and Jump Crypto did for Wormhole.

How do crypto hacks happen?

Most of the biggest ones don't break any code. Attackers compromise a laptop, a vendor or a hot wallet's signing system, or trick signers into approving a disguised transaction, often after a fake job offer. Bridges are another weak spot: Wormhole, BNB Chain and KelpDAO were fooled into creating tokens with nothing behind them.

Is my crypto safe on an exchange?

It's never risk-free. Big exchanges including Binance, Bybit and Bitget have been drained, though each said it could absorb the loss. Keep only what you trade on an exchange, protect your account with an authenticator app or passkey, and hold long-term coins in a hardware wallet you control.

Cleus is an uncensored AI agent that searches the web live, so it can tell you about any hack that happened after this list was updated.

Sources

• TRM Labs: North Korea steals $6.36 billion from Binance in the largest hack in history
• U.Today: Binance reveals when it will resume withdrawals after historic hack
• TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions
• FBI IC3: North Korea responsible for $1.5 billion Bybit hack
• BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine
• The Block: How a fake job offer took down the world's most popular crypto game
• CoinDesk: US officials tie North Korea's Lazarus hackers to $625M crypto theft
• CertiK: Poly Network exploit
• The Block: Poly Network hacker returns nearly all of the $611 million
• BNB Chain: ecosystem update on the BSC Token Hub exploit
• The Block: BNB Chain resumes service after hacker siphons at least $100 million
• Cointelegraph: Coincheck to refund all customers affected by hack
• Elliptic: $477 million in unauthorized transfers from FTX
• The Block: DOJ charges trio for $400 million SIM-swapping hack targeting FTX
• Wikipedia: Mt. Gox
• Decrypt: Mt. Gox pushes back bitcoin repayments to October 2026
• BleepingComputer: Bitget hacked via zero-day in third-party security products
• Unchained: How did hackers take $388M from Bitget?
• Halborn: Explained, the Wormhole hack
• The Register: Wormhole currency theft
• Security Affairs: Hackers drain $320 million from Liquid Network, then return most of it
• Decrypt: $47M still missing after Liquid hack
• BleepingComputer: FBI links North Korean hackers to $308 million crypto heist
• Merkle Science: How attackers stole $292M from Kelp DAO
• CoinDesk: LayerZero blames Kelp's setup, attributes exploit to Lazarus
• TRM Labs: North Korean hackers attack Drift Protocol in $285 million heist
• The Block: KuCoin has recovered 84% of affected funds
• Wikipedia: 2024 WazirX hack
• The Block: Sui community passes vote to recover stolen Cetus funds
• Chainalysis: 2025 crypto theft report
• crypto.news: TRM Labs says North Korea-linked hackers drive 76% of 2026 crypto thefts
• Cointelegraph: Crypto hacks total $766M in September
• The Block: North Korea blames "reptile media" over crypto theft reports