Top 10 Biggest Crypto Hacks in History

Some incidents resulted in hundreds of millions of dollars in stolen assets, while others exposed weaknesses in the infrastructure used to move and store cryptocurrencies. Examining these events helps explain how different types of attacks occur and why security practices remain important across the crypto ecosystem.

Key Takeaways

• Largest Reported Incident: The October 2026 Binance security breach was reported to have an estimated impact of approximately $6.3 billion, although this figure should not be treated as confirmed net losses.
• Exchange Security: Incidents involving Bybit, Coincheck, FTX, and Mt. Gox demonstrate the risks associated with centralized custody and wallet access.
• Bridge Vulnerabilities: The Ronin, Poly Network, BNB Chain, and Wormhole incidents exposed weaknesses in cross-chain infrastructure and transaction verification.
• Smart Contract Risks: Vulnerabilities in blockchain code and access-control mechanisms can allow attackers to move assets without obtaining users’ private keys.
• Recovery Outcomes Differ: Some stolen funds were frozen, returned, or replaced, while other incidents resulted in substantial unresolved losses.
• Security Is Multi-Layered: Protecting digital assets requires attention to wallet management, private keys, smart contract design, access permissions, and operational controls.

10 Biggest Crypto Hacks in History at a Glance

The largest crypto hacks vary in their methods and consequences. Some involved unauthorized access to centralized exchange wallets, while others exploited smart contract vulnerabilities or cross-chain bridge mechanisms. The following list highlights ten major incidents based on their reported financial scale.

Binance Security Breach (2026): Approximately $6.3 Billion

In October 2026, Binance experienced a major security breach that was reported to have an estimated financial impact of approximately $6.3 billion. The incident became one of the most significant security events in cryptocurrency history by reported value.

According to public reporting, Binance worked with industry partners to freeze affected assets and had located approximately $3 billion at the time of the initial reports. The remaining amount had not been fully accounted for in the same reporting period. Binance also stated that it would cover hacking-related losses.

The incident highlighted the importance of exchange-level security, asset monitoring, incident response, and coordination with blockchain analytics providers and other industry participants. It also demonstrated why reported breach figures should be interpreted carefully: the total value affected, the amount actually stolen, the amount frozen, and the final loss to customers are different measures.

Bybit Hack (2025): Approximately $1.4 Billion

On February 21, 2025, cryptocurrency exchange Bybit suffered a major security breach in which attackers stole approximately 401,000 ETH, valued at around $1.4 billion at the time. The incident became the largest publicly reported crypto theft by value at that point.

The attack involved unauthorized control over the transaction-signing process associated with Bybit’s Ethereum multisignature wallets. Investigations indicated that attackers manipulated the transaction interface and signing workflow, causing authorized signers to approve transfers that redirected assets to attacker-controlled addresses.

The incident demonstrated that multisignature wallets alone do not eliminate security risks. Even when multiple approvals are required, compromised interfaces, signing devices, or operational processes can undermine those protections.

Bybit responded by investigating the incident, coordinating with security firms and law enforcement, and addressing the affected wallet infrastructure. The case also drew attention to the security of third-party software and transaction-signing environments.

Ronin Network Hack (2022): Approximately $624 Million

The Ronin Network hack occurred in March 2022 and involved the compromise of validator private keys. Ronin is an Ethereum-linked blockchain developed to support the blockchain game Axie Infinity and its ecosystem.

At the time, the Ronin bridge relied on a validator-based system to authorize transfers between Ronin and Ethereum. Attackers obtained control of enough validator keys to approve unauthorized withdrawals, draining approximately 173,600 ETH and 25.5 million USDC from the bridge. The stolen assets were valued at approximately $624 million when the incident became public.

The attack exposed weaknesses in validator access management and the concentration of signing authority. It also showed how a vulnerability in bridge infrastructure can affect users and applications across an entire blockchain ecosystem.

Following the incident, the Ronin team suspended bridge operations, worked with security partners, and introduced additional security measures. The network also arranged compensation for affected users. The FBI later attributed the attack to North Korea-linked hacking groups.

Poly Network Exploit (2021): Approximately $611 Million

In August 2021, cross-chain protocol Poly Network suffered a smart contract exploit that affected assets across Ethereum, BNB Chain, and Polygon. The attacker exploited a vulnerability in the protocol’s access-control and cross-chain authorization mechanisms, allowing unauthorized transactions.

The incident initially involved approximately $611 million in digital assets, making it one of the largest DeFi-related exploits at the time. Unlike many other major crypto hacks, however, the event had an unusual outcome: the attacker returned nearly all of the stolen funds after communicating with the Poly Network team.

The incident highlighted the complexity of cross-chain protocols. These systems must verify messages and transactions between separate blockchain networks. If the authorization logic is flawed, an attacker may be able to execute transfers that would otherwise require valid permissions.

The Poly Network case also demonstrated that recovering funds after an exploit can depend on cooperation, on-chain traceability, and the technical characteristics of the affected assets.

BNB Chain Bridge Exploit (2022): Approximately $570 Million

In October 2022, an attacker exploited a vulnerability in the BNB Chain Token Hub bridge, which connected BNB Beacon Chain and BNB Smart Chain. The attacker generated fraudulent cross-chain proof data and used it to create unauthorized BNB tokens.

The exploit initially involved approximately two million BNB, valued at around $570 million at the time. However, a significant portion of the affected assets was frozen through coordination among validators and ecosystem participants, limiting the amount that could be moved or converted.

It is important to distinguish this incident from a direct hack of the Binance cryptocurrency exchange. The vulnerability affected the BNB Chain bridge infrastructure, not the exchange’s customer trading platform.

The event demonstrated the risks associated with cross-chain verification systems. Bridges rely on mechanisms to confirm that an event on one blockchain is valid before assets are released or represented on another. Weaknesses in these verification mechanisms can create opportunities for unauthorized asset creation or transfers.

Coincheck Hack (2018): Approximately $530 Million

In January 2018, Japanese cryptocurrency exchange Coincheck suffered a major security breach involving its NEM holdings. Attackers obtained access to the exchange’s hot wallet and stole approximately 523 million NEM tokens, valued at around $530 million at the time.

A hot wallet is connected to the internet and allows a platform to process transactions more conveniently. However, its online accessibility can also make it a target for attackers if private keys or wallet infrastructure are not adequately protected.

The Coincheck incident raised questions about the exchange’s asset storage practices and internal security controls. It also became a major event in Japan’s cryptocurrency industry, contributing to increased attention from regulators and market participants toward exchange security.

Coincheck later announced a compensation plan for affected customers. The incident remains an important example of the risks associated with storing large amounts of customer assets in online wallets.

FTX Wallet Incident (2022): Approximately $477 Million

In November 2022, cryptocurrency exchange FTX filed for bankruptcy. During the period surrounding the bankruptcy announcement, unauthorized transactions moved hundreds of millions of dollars in digital assets from wallets associated with the platform.

The amount involved was widely estimated at approximately $477 million, although reports and investigations differed in their treatment of the transfers and the assets involved. The incident occurred amid a broader crisis involving FTX’s liquidity, governance, and financial controls.

Unlike a typical smart contract exploit, the FTX incident involved the movement of assets from exchange-controlled wallets during a period of organizational disruption. It highlighted the importance of internal access controls, asset segregation, custody procedures, and operational continuity.

The case also demonstrated that crypto security risks are not limited to technical vulnerabilities. Governance failures, inadequate internal controls, and weak operational oversight can create conditions in which digital assets become vulnerable.

Mt. Gox Collapse (2014): Approximately $450 Million at the Time

Mt. Gox was once one of the largest Bitcoin exchanges in the world. In February 2014, the Tokyo-based platform suspended trading, stopped withdrawals, and filed for bankruptcy after reporting that approximately 850,000 BTC were missing.

The missing Bitcoin included customer holdings and assets belonging to the exchange. At the time, the reported amount was valued at approximately $450 million. Around 200,000 BTC were later found, reducing the estimated shortfall.

The precise causes and timeline of the losses remain complex. The missing Bitcoin accumulated over an extended period, and the case involved a combination of security failures, operational issues, and disputed circumstances rather than one clearly established attack.

The Mt. Gox collapse became a defining event in the early history of cryptocurrency exchanges. It showed the risks of leaving digital assets under the control of a centralized platform without direct access to the underlying private keys.

Repayments to eligible creditors began in 2024 through the rehabilitation process, although the recovery process has involved substantial time and administrative complexity.

Wormhole Bridge Exploit (2022): Approximately $326 Million

In February 2022, Wormhole, a cross-chain messaging protocol, suffered an exploit that resulted in the unauthorized creation of wrapped ETH on Solana. The attacker took advantage of a vulnerability in the bridge’s signature verification process.

The exploit allowed the attacker to bypass an important verification step and create 120,000 wrapped ETH without providing the required backing assets. The affected tokens were valued at approximately $326 million at the time.

Wormhole’s cross-chain infrastructure was designed to allow assets and messages to move between different blockchain networks. The incident showed how a flaw in message verification can undermine the relationship between assets represented on one chain and the underlying assets held elsewhere.

Jump Crypto, a major supporter of the Wormhole ecosystem, replaced the missing ETH to restore the bridge’s backing. The incident highlighted the importance of secure signature verification and independent security reviews for cross-chain protocols.

DMM Bitcoin Hack (2024): Approximately $305 Million

In May 2024, Japanese cryptocurrency exchange DMM Bitcoin announced that approximately 4,502.9 BTC had been transferred from its wallets without authorization. The stolen Bitcoin was valued at around $305 million at the time.

Investigators and security analysts linked the incident to a compromise of private key-related processes. The breach raised concerns about the security of exchange wallet infrastructure and the procedures used to authorize asset transfers.

DMM Bitcoin suspended certain services while investigating the incident and arranged measures to protect affected customer balances. The company later announced plans to transfer customer assets and liabilities as part of its response.

The case illustrated the importance of private key protection, transaction monitoring, withdrawal controls, and contingency planning for centralized exchanges.

Common Attack Methods Behind Major Crypto Hacks

Although major crypto hacks differ in their technical details, many incidents involve a limited number of recurring security weaknesses. Understanding these attack methods can help users and developers recognize where risks may arise.

Private Key and Wallet Compromise

Private keys authorize access to cryptocurrency held in a wallet. If attackers obtain a private key or compromise the systems used to manage it, they may be able to transfer assets without the owner’s permission.

The Coincheck, Ronin Network, and DMM Bitcoin incidents demonstrate how compromised wallet access can lead to substantial losses. Exchanges and protocols therefore need secure key storage, access restrictions, transaction monitoring, and carefully managed signing procedures.

Smart Contract Vulnerabilities

Smart contracts execute predefined instructions on a blockchain. However, coding errors, flawed authorization logic, and incorrect assumptions about external data can create vulnerabilities.

The Poly Network exploit is an example of how weaknesses in smart contract permissions can allow unauthorized transactions. Because deployed contracts may control large amounts of digital assets, security reviews and testing are important before and after deployment.

Cross-Chain Bridge Exploits

Cross-chain bridges allow users to transfer assets or messages between different blockchain networks. They often rely on validators, cryptographic proofs, or messaging systems to confirm that transactions are legitimate.

The Ronin, BNB Chain, and Wormhole incidents show that weaknesses in bridge validation or authorization can put assets across multiple networks at risk. Bridge security depends on the reliability of its verification mechanisms and the protection of the entities responsible for approving transfers.

Phishing and Social Engineering

Not every crypto hack requires a direct attack on blockchain code. Attackers may target employees, developers, or wallet signers through phishing messages, impersonation, or compromised software interfaces.

Once access credentials or signing permissions are obtained, attackers may be able to authorize transactions that appear legitimate. The Bybit incident highlighted the importance of verifying transaction details through trusted interfaces and protecting the systems used for signing.

Operational and Governance Failures

Security also depends on how an organization manages its systems, employees, assets, and internal permissions. Poor access management, inadequate segregation of duties, and weak operational controls can increase the impact of a technical incident.

The FTX and Mt. Gox cases illustrate why asset custody and organizational governance are closely connected. Technical security measures cannot fully compensate for weak internal oversight.

How to Reduce the Risk of Crypto Security Incidents

No security measure can eliminate every risk, but users and platforms can adopt practices that reduce exposure to common attack methods.

• Protect private keys and recovery phrases: Never share wallet recovery phrases or private keys with another person or an unverified service.
• Enable two-factor authentication: Use additional authentication methods to protect exchange accounts and other important services.
• Verify transaction details: Check wallet addresses, networks, token amounts, and transaction permissions before approving transfers.
• Use official platforms and links: Be cautious of impersonation websites, suspicious messages, and unofficial applications.
• Review wallet permissions: Periodically check connected applications and revoke unnecessary token approvals where supported.
• Understand custody arrangements: Learn whether assets are held in a personal wallet or by a third-party platform, and understand the responsibilities associated with each arrangement.

Users can also review the Gate TR account security guide for additional information about protecting account access.

Frequently Asked Questions

What Is the Biggest Crypto Hack in History?

The October 2026 Binance security breach was reported to have an estimated impact of approximately $6.3 billion, making it the largest reported incident by financial scale in the available reporting. However, the figure represents estimated impact and should not be interpreted as the final amount of unrecovered assets.

What Was the Biggest Crypto Exchange Hack Before 2025?

The Bybit hack in February 2025 was the largest publicly reported crypto theft at the time, involving approximately $1.4 billion in ETH. The attack targeted the transaction-signing process associated with the exchange’s multisignature wallets.

How Do Crypto Hacks Usually Happen?

Crypto hacks can occur through compromised private keys, phishing attacks, smart contract vulnerabilities, bridge verification flaws, or weaknesses in internal access controls. Some incidents involve technical exploits, while others rely on manipulating people or operational processes.

Can Stolen Cryptocurrency Be Recovered?

Recovery depends on the circumstances of each incident. Blockchain transactions are generally difficult to reverse, but stolen assets may sometimes be frozen, traced, returned voluntarily, or recovered through legal and investigative efforts. Recovery is not guaranteed.

Are Blockchain Networks Completely Secure?

Blockchains use cryptographic mechanisms and distributed consensus to validate transactions, but applications built on top of them can still contain vulnerabilities. Exchanges, wallets, smart contracts, bridges, and user devices all introduce potential security risks.

How Can Users Protect Their Cryptocurrency?

Users can reduce risks by protecting private keys and recovery phrases, enabling two-factor authentication, checking transaction details, using official platforms, and avoiding suspicious links or messages. Understanding how assets are stored and transferred is also important.

Conclusion

The biggest crypto hacks in history reveal that digital asset security involves more than the underlying blockchain technology. Exchange wallets, private key management, smart contracts, cross-chain bridges, and internal operational systems can all become targets.

From Mt. Gox and Coincheck to Ronin, Bybit, and the 2026 Binance incident, each case demonstrates a different type of vulnerability and the importance of layered security controls. Understanding these incidents can help users make more informed decisions about wallet management, platform security, and the risks associated with digital assets.