Key Takeaways
The record has been broken three times since 2022. Ronin set it at about $625 million in 2022, Bybit at about $1.5 billion in 2025, and Binance at roughly $6.3 billion to $6.4 billion in October 2026.
Most of the biggest attacks did not break the blockchain. Attackers went after people, signing systems, private keys, and bridge software. Phishing, fake job offers, and compromised laptops did more damage than any flaw in Bitcoin or Ethereum.
Who pays back depends on where the funds were held. Large exchanges usually covered user losses from their own reserves. DeFi protocols and bridges recovered funds far less often, unless the attacker returned them or a backer stepped in.
How This Ranking Works
Every crypto hack list uses slightly different numbers. Before reading the ranking, it helps to know the rules used here.
Value at the time of the theft. Each loss is shown in US dollars at the time it happened, not at today's prices. A theft of 100,000 BTC in 2014 was worth far less then than it would be now.
Hacks and exploits only. The list covers thefts of funds from exchanges, protocols, bridges, and sidechains. It does not include scams, Ponzi schemes, or company collapses such as FTX's bankruptcy itself.
Widely reported figures. Where sources disagree, a range is given. All figures are estimates from public reporting and blockchain analytics firms.
Gross loss, not net loss. The ranking uses the amount taken. Recovery is shown separately, because it changes the story for users.
The 15 Largest Crypto Hacks at a Glance
Rank | Victim | Date | Type | Estimated loss | Main entry point |
|---|---|---|---|---|---|
1 | Binance | Oct 2026 | Exchange | $6.3B to $6.4B | Hot wallet signing systems |
2 | Bybit | Feb 2025 | Exchange | About $1.5B | Compromised wallet interface |
3 | Ronin Network | Mar 2022 | Bridge | About $625M | Stolen validator keys |
4 | Poly Network | Aug 2021 | DeFi / cross-chain | About $611M | Smart contract flaw |
5 | BNB Chain bridge | Oct 2022 | Bridge | About $570M minted | Forged proofs |
6 | Coincheck | Jan 2018 | Exchange | About $530M | Hot wallet keys |
7 | Mt. Gox | Feb 2014 | Exchange | About $450M or more | Long-running key theft |
8 | FTX | Nov 2022 | Exchange | $415M to $477M | Account takeover |
9 | Bitget | Sep 2026 | Exchange | About $387M | Backend wallet systems |
10 | Wormhole | Feb 2022 | Bridge | About $325M | Signature check bug |
11 | Liquid Network | Sep 2026 | Bitcoin sidechain | About $319M | Validator software bug |
12 | DMM Bitcoin | May 2024 | Exchange | About $305M | Third-party wallet provider |
13 | KelpDAO | Apr 2026 | DeFi / bridge | About $292M | Forged cross-chain message |
14 | Drift Protocol | Apr 2026 | DeFi | About $285M | Social engineering of signers |
15 | KuCoin | Sep 2020 | Exchange | About $281M | Leaked hot wallet keys |
The Ranking Explained
1. Binance (October 2026): about $6.3 billion to $6.4 billion
On October 29, 2026, funds began leaving Binance hot wallets across many blockchains. Chainalysis put the total at about $6.4 billion, while Binance used a figure of about $6.3 billion. Chainalysis says the attacker got valid signed authorizations that let a hot wallet run attacker code, then swept the assets out.
Why it matters: It is the largest crypto theft on record, about four times larger than Bybit. It also showed how fast the industry now reacts. Stablecoin issuers began freezing funds within an hour, and Chainalysis reported about $2.8 billion frozen by November 3. The FBI attributed the attack to North Korea's TraderTraitor group. Binance said it covered about 95% of the loss within days using its SAFU reserve, part of its futures insurance fund, and company funds, and it reopened withdrawals in phases on November 1.
2. Bybit (February 2025): about $1.5 billion
Attackers compromised a developer machine at Safe{Wallet}, a wallet tool Bybit used. During a routine transfer from a cold wallet, signers approved what looked like a normal transaction. About 401,000 ETH was taken instead.
Why it matters: It proved that offline storage is only as safe as the software used to approve transactions. The FBI publicly named North Korea within five days. Bybit stayed open and covered the loss, but most of the stolen ETH was laundered within weeks.
3. Ronin Network (March 2022): about $625 million
Ronin was the bridge behind the game Axie Infinity. It needed five of nine validator signatures to approve withdrawals. Attackers gained control of five keys, partly through a fake job offer sent to an engineer, and withdrew 173,600 ETH and 25.5 million USDC. The theft went unnoticed for six days.
Why it matters: It showed the risk of a bridge controlled by a small number of keys. The FBI attributed it to the Lazarus Group in April 2022, and the US Treasury sanctioned the receiving address. Sky Mavis raised $150 million to reimburse users.
4. Poly Network (August 2021): about $611 million
A flaw in how Poly Network checked messages between chains let one attacker drain funds across Ethereum, BNB Chain, and Polygon.
Why it matters: It has one of the strangest endings in crypto history. The attacker returned nearly all the funds within about two weeks and was offered a bounty. It remains the largest DeFi exploit by gross value.
5. BNB Chain bridge (October 2022): about $570 million
An attacker forged proofs on the BSC Token Hub bridge and minted 2 million BNB that did not exist before.
Why it matters: Validators paused the whole chain within hours. Only around $100 million is reported to have left the network, so some lists rank this lower. It started a lasting debate about whether a chain that can halt itself is truly decentralized.
6. Coincheck (January 2018): about $530 million
Japan's Coincheck stored about 523 million NEM tokens in a single hot wallet without multisig protection. It was emptied in one attack.
Why it matters: Coincheck refunded about 260,000 users from its own funds. Japan then tightened exchange rules, including stricter cold storage requirements. Those rules still shape how Japanese exchanges operate.
7. Mt. Gox (February 2014): about $450 million or more
Mt. Gox, then the largest Bitcoin exchange, collapsed after reporting about 850,000 BTC missing. Investigators later found the coins had been drained over several years. About 200,000 BTC was later found in old wallets.
Why it matters: It is the hack that taught the industry about custody risk. Creditor repayments only began in July 2024, and the deadline has since been extended to October 31, 2027.
8. FTX (November 2022): about $415 million to $477 million
Hours after FTX filed for bankruptcy, someone drained hundreds of millions of dollars from its wallets. Estimates vary by source.
Why it matters: It showed how chaos inside a failing company creates openings for attackers. In 2024, US prosecutors charged three people in a SIM-swap case that media reports linked to the theft. A SIM swap is when a criminal takes over someone's phone number to bypass security checks.
9. Bitget (September 2026): about $387 million
On September 24, 2026, attackers drained Bitget hot and warm wallets. Within three hours, the funds moved across Ethereum, XRP Ledger, Zcash, and Tron, according to Chainalysis.
Why it matters: Chainalysis attributed it to North Korea. A month later, funds stolen from Binance mixed on-chain with the Bitget funds, which helped investigators link the two attacks. Bitget said its Protection Fund absorbed the loss and reopened withdrawals in phases.
10. Wormhole (February 2022): about $325 million
A bug in signature checking on the Solana side of the Wormhole bridge let an attacker mint 120,000 wrapped ETH without depositing anything.
Why it matters: Jump Crypto, a major backer, replaced the full amount within a day to keep the bridge solvent. It is a clear example of how one coding mistake in a bridge can put hundreds of millions at risk.
11. Liquid Network (September 2026): about $319 million
On September 6, 2026, attackers exploited a bug in Liquid's validator software to create unbacked synthetic bitcoin tokens, then redeemed them for about 4,000 real BTC. Liquid is a Bitcoin sidechain run by Blockstream.
Why it matters: TRM Labs called it by far the largest attack on a Bitcoin sidechain. The attackers returned about 85% of the funds, which shows that Bitcoin-linked systems built on top of the base chain carry their own risks.
12. DMM Bitcoin (May 2024): about $305 million
A North Korean actor posed as a recruiter on LinkedIn and sent a fake coding test to an employee at Ginco, DMM's wallet software provider. Weeks later, the attackers used that access to alter a real DMM transaction and took 4,502.9 BTC.
Why it matters: It shows how risk spreads through suppliers. The FBI, Japan's National Police Agency, and the US Department of Defense jointly attributed it to TraderTraitor. DMM covered user balances but later shut down and moved accounts to SBI VC Trade.
13. KelpDAO (April 2026): about $292 million
On April 18, 2026, attackers drained about 116,500 rsETH from KelpDAO's bridge, which used LayerZero messaging to move its token across many chains.
Why it matters: It was the largest DeFi exploit of 2026. It shows that restaking tokens, which are spread across many networks, inherit the weaknesses of every bridge they rely on.
14. Drift Protocol (April 2026): about $285 million
Drift, a large trading protocol on Solana, lost about $285 million on April 1, 2026. Reports describe a long social engineering campaign aimed at the people who controlled its admin keys, rather than a code bug.
Why it matters: No recovery has been reported. It confirms a trend seen across 2026: the weakest point is often the human with signing power.
15. KuCoin (September 2020): about $281 million
Hot wallet keys leaked, and attackers took BTC, ETH, and many smaller tokens. Chainalysis later linked the attack to the Lazarus Group.
Why it matters: It is one of the most successful recoveries. Token projects froze or reissued their contracts, and KuCoin reported recovering about 84% of the funds. Users did not lose money.
Two Special Cases Outside the Ranking
LuBian mining pool (December 2020). In 2025, blockchain analysts reported that about 127,000 BTC, worth roughly $3.5 billion at the time, left wallets tied to the LuBian mining pool in late 2020. The likely cause was weak private key generation. The pool never publicly reported a hack, and later reporting linked the coins to a large US government forfeiture case. Because the facts remain disputed, it is listed here rather than ranked.
The DAO (June 2016). An attacker drained about 3.6 million ETH, worth around $60 million then. The amount is small by today's standards, but Ethereum's community responded with a hard fork to reverse it. The original chain that refused the fork became Ethereum Classic.
What the Biggest Hacks Have in Common
North Korea is the largest single actor
US authorities have attributed many of the top entries, including Binance, Bybit, Ronin, and DMM Bitcoin, to North Korean groups. Chainalysis estimates that suspected North Korea-linked hacks made up nearly 89% of reported hack losses in 2026 through October 29. TRM Labs estimates North Korea stole about $7.4 billion in 2026 alone.
The entry point is usually people, not code
Attack vector | What it means | Examples |
|---|---|---|
Social engineering | Tricking staff with fake jobs, tests, or meetings | Ronin, DMM Bitcoin, Drift |
Signing system compromise | Altering what signers see or approve | Bybit, Binance |
Leaked or weak keys | Private keys stolen or poorly generated | Coincheck, KuCoin, LuBian |
Smart contract bugs | Errors in code logic or verification | Poly Network, Wormhole, BNB bridge |
Validator or bridge flaws | Weaknesses in cross-chain systems | Liquid, KelpDAO |
Bridges remain a weak spot
Ronin, BNB Chain, Wormhole, Liquid, and KelpDAO all involved moving assets between chains. Bridges hold large pools of locked funds and rely on complex verification, which makes them attractive targets.
Who Got Their Money Back?
Where funds were held | Typical outcome | Examples |
|---|---|---|
Large centralized exchange | Exchange usually covered losses | Binance, Bybit, Bitget, Coincheck, KuCoin |
Exchange that failed | Long, partial repayment | Mt. Gox |
DeFi protocol or bridge | Recovery only if attacker or backer helped | Poly Network, Wormhole, Liquid |
DeFi with no backstop | Losses often permanent | Drift |
This pattern is general, not a guarantee. A smaller exchange with thin reserves may not survive a hack that a large exchange can absorb.
Practical Lessons for Everyday Users
These are general safety points for education, not financial advice.
Keep only what you actively use on an exchange. Exchange balances are claims on a company.
Learn how self-custody works before using it. A hardware wallet removes exchange risk but makes you responsible for your recovery phrase.
Be careful with bridges. Use them only when needed, and avoid leaving funds parked in bridged tokens you do not understand.
Treat job offers and coding tests with caution. Several top hacks began with a fake recruiter.
Ignore "recovery" services that contact you after a hack. They are a common follow-up scam.
FAQ
What is the largest crypto hack in history? The Binance hack of October 29, 2026, is the largest on record, at roughly $6.3 billion to $6.4 billion depending on the source. The previous record was Bybit at about $1.5 billion in February 2025.
Who is behind most of the largest crypto hacks? North Korean state-linked groups, often called Lazarus Group or TraderTraitor. US authorities have attributed several of the largest thefts to them, including Binance, Bybit, Ronin, and DMM Bitcoin.
What is the biggest DeFi hack ever? By gross value, Poly Network at about $611 million in 2021, though almost all of it was returned. Among DeFi hacks with little or no recovery, KelpDAO and Drift in 2026 are among the largest.
Was Bitcoin itself ever hacked? No major hack on this list broke the Bitcoin protocol. Losses came from exchanges, wallets, key management, and systems built on top of Bitcoin, such as the Liquid sidechain.
Can stolen crypto be recovered? Sometimes. Stablecoins can be frozen by issuers, and some attackers return funds. But once assets are swapped into BTC or ETH and laundered, recovery becomes much harder.
Related Terms
Hot Wallet: A crypto wallet connected to the internet for fast transactions, which makes it more exposed to remote attacks.
Multisig Wallet: A wallet that needs approval from several private keys before a transaction can be sent.
Cross-Chain Bridge: A system that moves assets or messages between separate blockchains, usually by locking assets on one chain and issuing tokens on another.
Private Key: A secret code that gives full control over the crypto held at a blockchain address.
Social Engineering: Manipulating people into revealing information or taking actions that give attackers access.
Disclaimer: This content is for educational and informational purposes only and is not financial, investment, legal, or tax advice. Nothing here is a recommendation to buy or sell any asset or use any platform. Do your own research and manage your risk. Cryptocurrency involves risk, including the permanent loss of funds.
