Biggest Crypto Hacks of All Time: Full List (2027)

Last updated: October 31, 2026

Crypto has lost billions to hackers, and the record keeps getting broken. On October 29, 2026, attackers drained about $6.3 billion from Binance in roughly 20 minutes, more than four times the previous record. Before that, Bybit lost $1.46 billion in February 2025, and the list goes back to Mt. Gox, the exchange that once handled most of the world's bitcoin trading.

This is the full list of the biggest crypto hacks of all time, from Mt. Gox to Binance, with how each one happened, who was behind it and whether users got their money back. We also explain what really happened at FTX, the biggest hacks of 2025 and 2026, and how to protect your own crypto.

The Biggest Crypto Hacks of All Time: Full List

Amounts are the value at the time of the theft, as reported by the victims and blockchain analytics firms. Some numbers change as investigations go on, especially for recent hacks.

Notable older hacks that didn't make the top 30 by dollar value include Harmony's bridge ($100 million, 2022, North Korea), Atomic Wallet ($100 million, 2023, North Korea), Bitfinex (119,756 BTC, about $72 million in 2016) and Binance's first hack (7,000 BTC, about $41 million in 2019).

The 10 Biggest Crypto Hacks Explained

1. Binance (October 2026): $6.3 billion

The largest crypto theft ever. Attackers got into Binance's systems, which Binance says started with a compromised DevOps engineer's laptop, then used an EIP-7702 delegation to take over the Binance 14 hot wallet and emptied it in minutes. Funds left on about ten blockchains. Around $3 billion was frozen, Binance says it has replaced about 90% of the loss with its own funds, and TRM Labs links the attack to North Korea's TraderTraitor group. Full story: Binance hack explained.

2. Bybit (February 2025): $1.46 billion

Hackers compromised the Safe{Wallet} interface Bybit used for its cold wallet, so the signers approved what looked like a normal transfer but actually handed control to the attacker. About 401,000 ETH was taken. The FBI attributed it to North Korea within days. Bybit covered the gap with loans and purchases and kept withdrawals open.

3. Ronin Network (March 2022): $625 million

The bridge behind the game Axie Infinity needed 5 of 9 validator signatures. Attackers got control of five, partly through a fake job offer sent to an engineer, and withdrew 173,600 ETH and 25.5 million USDC. Nobody noticed for six days. The FBI blamed North Korea's Lazarus Group.

4. Poly Network (August 2021): $611 million

A bug in Poly Network's cross-chain contracts let an attacker move funds across three blockchains. In an unusual twist, the hacker returned almost everything within two weeks and was even offered a job.

5. BNB Chain bridge (October 2022): $570 million

An attacker exploited a proof verification bug to mint 2 million BNB out of thin air. Validators halted BNB Chain, so only about $100 million to $127 million actually got away.

6. Coincheck (January 2018): $534 million

The Japanese exchange kept NEM tokens in a single hot wallet without multisig. Hackers took 523 million XEM. Coincheck repaid about 260,000 customers in yen, and Japan tightened exchange rules afterwards.

7. FTX (November 2022): $477 million

The day after FTX filed for bankruptcy, about $477 million was drained from its wallets. In 2024, US prosecutors charged three people over a SIM-swap attack linked to the theft. But the hack was the smaller part of the FTX story, see below.

8. Mt. Gox (2011 to 2014): $460 million

Once the world's biggest bitcoin exchange, Mt. Gox lost around 850,000 BTC to thieves over several years before collapsing in 2014. About 200,000 BTC were later found. Repayments to creditors only began in July 2024, and the deadline has been pushed to October 2027.

9. Bitget (September 2026): $388 million

Attackers breached a backend system in Bitget's wallet infrastructure and spoofed transaction data, so the exchange's own authorization process moved funds out of its hot and warm wallets on seven chains. CEO Gracy Chen blamed suspected North Korean hackers. Bitget says user balances were unaffected and its Protection Fund covered the loss.

10. Wormhole (February 2022): $326 million

A signature verification bug let an attacker mint 120,000 wrapped ETH on Solana without backing. Jump Crypto, Wormhole's backer, replaced the ETH within a day.

FTX: Hack or Fraud?

So FTX belongs on a list of hacks, but the much bigger loss came from inside the company, not from hackers. That's an important difference: a hack can be covered by a solvent exchange, while fraud usually means the money is simply gone.

Biggest Crypto Hacks of 2026

2026 already passed 2025 as the worst year for crypto hacks, and Binance alone is bigger than all of 2025 combined. September 2026 was one of the worst months on record.

Biggest Crypto Hacks of 2025

In total, about $2.7 billion was stolen in 2025, according to Chainalysis and TRM Labs, and North Korean hackers took at least $2 billion of it.

North Korea: The Biggest Crypto Thief

One name keeps coming back. North Korea's state hacking groups, known as Lazarus Group and TraderTraitor, are linked to many of the biggest hacks on this list: Bybit, Ronin, Harmony, Atomic Wallet, DMM Bitcoin, WazirX, Drift and, according to TRM Labs, Binance. Elliptic estimated their total crypto thefts since 2017 at around $6 billion by the end of 2025, before the 2026 attacks.

Their favourite way in is people, not code: fake job offers, malicious software sent to engineers, and fake interfaces that trick signers into approving transfers.

How Crypto Hacks Happen

1. Stolen keys or tricked signers. The biggest losses by far. Attackers get control of the keys or the approval process, then withdraw funds as if they were the owner. Binance, Bybit, Ronin and Bitget all fit here.
2. Smart contract bugs. A mistake in code lets attackers mint tokens or skip checks, as in Poly Network, Wormhole, the BNB bridge and Cetus.
3. Price and vote manipulation. Flash loans or thin markets are used to fake prices or win governance votes, as in Beanstalk, Cream and Tectonic.
4. Compromised infrastructure and insiders. Breached servers, cloud databases or people with access, as in Mixin, Multichain and Kelp DAO.
5. Wallet bugs. Rare but painful: the 2026 Coldcard flaw made some seeds weak enough to brute-force years after they were created.

Did Users Get Their Money Back?

The pattern is clear: when a big, profitable exchange is hacked, users usually get covered. When the exchange collapses, they wait years.

How to Protect Your Crypto

• Keep only trading money on exchanges. Hold long-term savings in a wallet you control. Read our post on the Ledger implant scandal before choosing a device.
• Use 2FA and an anti-phishing code on every exchange account.
• Never give API keys withdrawal rights. Trading bots and tools like Cornix only need trading permission.
• Ignore "recovery" offers. Nobody can get stolen crypto back for a fee. Our guide on spotting fakes on Telegram lists the common tricks.
• Keep your wallet firmware updated, and if a flaw affects how seeds were made, move funds to a new seed.
• Lower your leverage when a hack hits the news. Prices move fast and high-leverage positions get liquidated first. Read what to do when an exchange pauses withdrawals.

Frequently Asked Questions

What is the biggest crypto hack of all time?

The Binance hack of October 29, 2026, with about $6.3 billion stolen from its hot wallets. Before that, the record was the Bybit hack of February 2025, at about $1.46 billion.

Was FTX a hack?

Partly. About $477 million was drained from FTX on November 11, 2022, the day after it filed for bankruptcy, and three people were charged in 2024 over a SIM-swap attack linked to it. But FTX's collapse itself was fraud: around $8 billion of customer money was missing, and founder Sam Bankman-Fried was convicted and sentenced to 25 years.

How much crypto was stolen in 2025?

About $2.7 billion, according to Chainalysis and TRM Labs, a record at the time. The Bybit hack alone was about $1.46 billion, and North Korean hackers took at least $2 billion of the total.

Who steals the most crypto?

North Korean state hackers, often called Lazarus Group or TraderTraitor. They were linked to Bybit, Ronin, DMM Bitcoin, WazirX and, according to TRM Labs, the 2026 Binance hack. Elliptic estimated their total crypto thefts since 2017 at around $6 billion by the end of 2025.

Do exchanges pay back users after a hack?

Big exchanges usually do. Binance, Bybit, Bitget, KuCoin and Coincheck all covered customer losses. Mt. Gox users are still being repaid more than ten years later, so it depends on whether the exchange survives.

How do crypto hacks happen?

Most big losses come from stolen keys or tricked signers, where attackers get the power to approve withdrawals. Others come from smart contract bugs, price manipulation, compromised servers or insiders, and wallet bugs like the 2026 Coldcard firmware flaw.

Is it safe to keep crypto on an exchange?

For money you actively trade, a large exchange is usually fine, but no exchange is hack-proof. Hold long-term savings in a wallet you control, keep 2FA on, and never give API keys withdrawal rights.

Has stolen crypto ever been recovered?

Sometimes. Poly Network and Euler Finance got almost everything back, Liquid Network recovered about 3,400 of 4,000 BTC, Cronos reversed $111 million from the Tectonic exploit, and about 94,600 BTC from the 2016 Bitfinex hack was seized in 2022. Stablecoins can often be frozen, but stolen BTC and ETH usually can't.

Figures are based on reports from the affected companies, blockchain analytics firms and news coverage, valued at the time of each theft. Some numbers may change as investigations continue. Not financial advice.