Crypto Hacks since 2011

Money stolen every year

Every hack on one timeline

Each bubble is one hack: the higher and bigger it is, the more was stolen. The scale is logarithmic, so each line up is ten times more money.

How the attackers got in

Most hacks are bugs in smart-contract code (53% of all hacks), but most of the money goes in a few huge break-ins where attackers get the keys: stolen keys and phishing alone took 44% of everything stolen.

Stolen private keys

The secret keys that control a wallet were stolen, leaked or badly generated. Whoever has the key has the coins.

Hacked servers & laptops

Attackers broke into the computers, servers or websites around the wallets rather than the wallets themselves.

Bugs in smart-contract code

A mistake in an app’s code — a missing permission check, wrong math, an unchecked input — let attackers take funds.

Phishing & tricks

People were tricked: fake job offers, fake websites or messages that got staff to sign or install something.

Bridge flaws

A bridge accepted fake messages or proofs and released coins that were never deposited.

Price manipulation

Attackers moved a token’s price with borrowed money (flash loans) to fool an app into lending or paying too much.

Insiders (rug pulls)

The project’s own team ran off with the money.

Governance takeovers

Attackers got enough voting power to pass a vote that sent them the treasury.

The 10 biggest crypto hacks

1. 1

   Binance

   $6.36B

   29 Oct 2026 · Exchange · Hacked servers & laptops · North Korea

   On October 29, attackers exploited Binance’s operational infrastructure to execute unauthorized withdrawals across multiple blockchains, resulting in approximately $6.3 billion in losses. Binance’s preliminary investigation identified a potentially compromised DevOps engineer’s laptop that allowed access to a service container, with no evidence of wallet private key leakage. Approximately $3 billion in stolen assets were later frozen with help from industry partners. Binance committed to covering all losses using its SAFU fund and company reserves

2. 2

   LuBian

   $3.5B

   28 Dec 2020 · Other · Stolen private keys

   On December 28, 2020, LuBian Bitcoin mining pool (6% of network hashrate in 2020) was hacked. An attacker exploited weak key generation in LuBian's infrastructure to brute-force private keys and steal 127,426 BTC (~$3.5B).

3. 3

   Bybit

   $1.4B

   21 Feb 2025 · Exchange · Phishing & tricks · North Korea · $1.4B returned or repaid

   On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deployed a rogue hot-wallet policy. This drained approximately $1.4-1.5 billion in ETH and assets.

4. 4

   Ronin Bridge

   $624M

   23 Mar 2022 · Bridge · Stolen private keys · North Korea

   On March 23, 2022 the Ronin Network bridge (connecting Axie Infinity sidechain to Ethereum) suffered the largest cryptocurrency theft in history when attackers compromised validator node private keys, gaining control of 5 of 9 validators and using the majority to approve fraudulent withdrawals of 173,600 ETH and 25.5 million USDC ($624M total). The breach was discovered six days later on March 29.

5. 5

   Poly Network

   $611M

   10 Aug 2021 · Bridge · Bugs in smart-contract code

   Poly Network was exploited for $611M on August 10, 2021 across Ethereum ($273M), BSC ($253M) and Polygon ($85M) via an access control and cryptography vulnerability in cross-chain bridge contracts. The attacker voluntarily returned nearly all funds within 15 days, keeping only transaction fees.

6. 6

   Binance Bridge

   $570M

   6 Oct 2022 · Bridge · Bridge flaws

   On October 4-6, 2022 the BNB Chain's BSC Token Hub bridge (connecting BEP2 and BEP20) was exploited via incomplete Merkle proof verification in the bridge contract, allowing an attacker to forge proofs and mint 2 million BNB (~$570 million). Binance paused the chain on October 6; roughly $137M bridged out before containment; $433M remained frozen.

7. 7

   Coincheck

   $534M

   26 Jan 2018 · Exchange · Stolen private keys

   On January 26, 2018, Coincheck announced hackers stole 523 million NEM coins from its internet-connected hot wallet, which lacked adequate security controls. The exchange began reimbursing approximately 260,000 affected users.

8. 8

   Mt. Gox

   $470M

   7 Feb 2014 · Exchange · Stolen private keys

   Mt. Gox, the world's largest Bitcoin exchange, collapsed when it revealed that 850,000 BTC belonging to customers and the company were missing. The exchange had been incrementally hacked since at least 2011 when attackers gained access to the hot wallet, with hackers siphoning BTC over several years.

9. 9

   FTX

   $450M

   12 Nov 2022 · Exchange · Phishing & tricks

   On November 11-12, 2022, a SIM-swapping gang stole approximately $450M in crypto from FTX by walking into AT&T stores with fake IDs, hijacking employee phone accounts, intercepting 2FA codes sent to FTX users, and draining their wallets during the company's bankruptcy.

10. 10

    Bitget

    $387M

    24 Sept 2026 · Exchange · Stolen private keys

    Bitget detected unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24. Subsequent tracing identified approximately $387.5M transferred to attacker-controlled addresses across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron. Bitget states that the incident has been contained and no further unauthorized transfers are possible

All 1,330 hacks

Data: DefiLlama hacks database, updated 31 Oct 2026. Amounts are in US dollars at the time of the hack, not today’s prices — the 850,000 bitcoin lost by Mt. Gox would be worth far more today. “Returned or repaid” counts money given back by the attacker or covered by the company. Not financial advice.