Top 10 Crypto Hacks Ranked

1. Binance

On 29 October 2026, starting at 20:05 UTC, an attacker pulled about $6.36 billion from Binance wallets on ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. TRM Labs attributes the theft to TraderTraitor with high confidence, and Chainalysis linked the stolen funds to September's Bitget hack.

Binance said the breach began with a compromised engineer's laptop, which gave the attacker access to a service container able to submit withdrawals, according to NBC News. On Ethereum, the intruder used an EIP-7702 delegation, introduced in the Pectra upgrade, with 50 pre-signed authorizations to turn a hot wallet into a sweeper.

Tether, Circle, Ripple and World Liberty Financial froze roughly $2.67 billion in stablecoins, while Arbitrum's Security Council seized another $30 million. The attacker still controlled over 420,000 ETH and 18,270 BTC. Binance pledged to cover every loss and told CNBC that 90% of affected assets were backed before withdrawals reopened.

Highlights

• Holds the record at about four times Bybit's loss, executed mostly within 20 minutes across ten networks.
• Triggered the fastest freeze response yet, with Tether locking 971 million USDT just 37 minutes after the main sweep.
• Showed that EIP-7702 delegations and shared signing systems can expose many chains to a single intrusion.

2. Bybit

On 21 February 2025, attackers took about 401,000 ETH and staked ETH, worth roughly $1.5 billion, from a Bybit cold wallet. The FBI named North Korea's TraderTraitor responsible within five days and published wallet addresses so exchanges and bridges could block the laundering.

The breach did not require stealing Bybit's private keys. Attackers compromised the multisig signing interface used by Bybit's signers, so a routine transfer looked normal on screen while the transaction actually handed wallet control to the attacker. Analysts call this blind signing, and The National described the fake interface as a near-identical copy.

Bybit kept withdrawals open and guaranteed client funds, so the loss fell on the company rather than its users. Chainalysis counts the incident as the core of North Korea's record $2.02 billion haul in 2025. Our Bybit vs Binance comparison weighs the two exchanges' current security setups.

Highlights

• Held the title of largest crypto theft for roughly 20 months until the Binance breach.
• Proved that a trusted signing screen can be weaponized even when private keys stay secure.
• Funds were converted to bitcoin and dispersed across thousands of addresses on multiple blockchains, per the FBI.

3. Mt. Gox

Mt. Gox, the Tokyo exchange that dominated early bitcoin trading, collapsed in February 2014 after disclosing that about 850,000 BTC had disappeared. Investigators later concluded that thieves had drained its hot wallet gradually from around 2011, while the exchange continued reporting balances it no longer held.

About 200,000 BTC were later found in an old wallet, forming the core of a court-supervised rehabilitation plan. The trustee began repaying creditors in bitcoin, Bitcoin Cash and yen during 2024, and The Block reported roughly 19,500 creditors had been paid by October 2025.

Repayments remain unfinished. On 16 October 2026 the trustee extended the deadline to 31 October 2027, the latest in a run of annual delays, with about 34,000 BTC still under its control according to Crypto Briefing. Our crypto crash history places the collapse within bitcoin's wider drawdowns.

Highlights

• Creditors have now waited more than 12 years, and final payouts run into at least late 2027.
• The hidden shortfall pushed exchanges toward publishing verifiable proof-of-reserves attestations.
• Large trustee wallet movements still draw attention from traders watching for potential selling pressure.

4. Ronin Network

On 23 March 2022, attackers forged withdrawals from the Ronin bridge serving Axie Infinity, taking 173,600 ETH and 25.5 million USDC worth about $625 million. Nobody noticed for six days, until a user could not withdraw 5,000 ETH and the team discovered the bridge had been drained.

Ronin's bridge needed five of nine validator signatures, and the attackers obtained five keys: four held by Sky Mavis and one through an Axie DAO allowlist left active. The FBI attributed the theft to Lazarus Group and APT38, and the Treasury sanctioned the receiving address, as BleepingComputer reported.

The incident became the reference case for bridge risk. Value locked in bridges sits in a few contracts guarded by small validator sets, which makes them prime targets. Our crypto bridges guide explains how current bridges distribute verification and what to check before moving funds.

Highlights

• A network marketed as decentralized failed because too few validators controlled the signing threshold.
• Six days passed before anyone noticed, showing why real-time monitoring of bridge outflows matters.
• The US Treasury added the hacker address to its existing Lazarus Group sanctions within weeks.

5. FTX

Hours after FTX filed for bankruptcy on 11 November 2022, more than $400 million left its wallets. With the exchange in chaos, many first suspected an inside job, but a January 2024 indictment described an external theft carried out by a SIM-swapping crew operating across the United States.

According to CNBC, prosecutors charged Robert Powell, Carter Rohn and Emily Hernandez. They allegedly used a fake ID to take over an FTX employee's AT&T phone number, intercepted authentication codes, and moved funds from company wallets across 11 and 12 November. The ring targeted about 50 other victims.

The theft deepened losses for creditors already facing the collapse covered in our Sam Bankman-Fried profile, though it was separate from the fraud for which he was convicted. It also showed how a single phone number can unlock corporate systems when SMS codes guard high-value accounts.

Highlights

• Attackers struck during the bankruptcy confusion, when monitoring and incident response were at their weakest.
• One hijacked phone number reportedly bypassed controls protecting hundreds of millions of dollars.
• The indictment settled a long-running question over whether FTX insiders had taken the missing funds.

6. Ledger

In June 2020, attackers accessed Ledger's e-commerce and marketing database through a misconfigured website API key. Ledger initially said about one million email addresses and 9,500 detailed records were exposed. In December, the full dataset appeared for free on RaidForums, as The Block reported after reviewing the files.

The leak contained 1,075,382 newsletter emails and 272,853 hardware wallet orders with names, phone numbers and home addresses. No seed phrases or devices were compromised, yet customers received waves of fake Ledger emails, counterfeit software prompts and, in some cases, threats of home visits from extortionists.

The breach ranks highly because its damage has lasted more than six years. Addresses cannot be changed like passwords, so buyers remain targets for phishing and intimidation. Our Ledger Nano S Plus vs Nano X comparison covers device security, but delivery privacy now matters almost as much as chip design.

Ledger buyers were exposed again in January 2026, when an unauthorized party accessed a cloud system at payment partner Global-e that held order data from several brands. Ledger said names, contact details and order information leaked, while passwords, recovery phrases and funds were unaffected, though phishing emails soon followed, The Register reported. Neither company confirmed how many customers were affected.

Highlights

• Leaked home addresses cannot be rotated, extending the risk long after the original breach.
• Fake recovery prompts asking for 24-word seeds became the standard attack against hardware wallet owners.
• Casa's Jameson Lopp noted only 1% of leaked buyers had shipped to a PO box, per ForkLog.

7. Coinbase

Coinbase disclosed in May 2025 that criminals had bribed overseas customer support contractors to copy data from internal tools. A filing with Maine's Attorney General put the total at 69,461 people, with activity starting on 26 December 2024 and confirmed on 11 May, according to SecurityWeek.

Exposed records included names, addresses, phone numbers, the last four Social Security digits, masked bank details, government ID images and balance snapshots. Passwords and private keys were not taken, but scammers used the data to impersonate Coinbase staff and persuade customers to move funds into supposedly "safe" wallets.

Coinbase refused a $20 million ransom, offered an equal bounty for information on the attackers, and pledged to reimburse customers tricked by the resulting scams. Its SEC filing estimated remediation costs of $180 million to $400 million, as The Register noted. Coinbase also announced a new US support hub.

Highlights

• No code was exploited; attackers simply bought access from people holding legitimate permissions.
• The estimated cleanup bill exceeds the direct losses of many smart contract exploits.
• Balance data let criminals pick wealthier victims for convincing phone-based impersonation scams.

8. Poly Network

On 10 August 2021, an attacker exploited a flaw in Poly Network's cross-chain contract logic and moved about $611 million across Ethereum, BNB Smart Chain and Polygon. By replacing the keeper role that approves transfers, the attacker authorized withdrawals the protocol treated as legitimate. It was then the largest DeFi theft.

The hacker began returning funds within a day, claiming the attack was meant to expose the bug. Poly Network dubbed the person "Mr. White Hat" and offered a $500,000 bounty plus a security advisor role. By 23 August, control of all remaining assets had been handed back, according to CNBC.

The outcome was unusual, but the method was not. Cross-chain messaging contracts hold large balances and trust signed messages, so one permission flaw can release everything. Similar logic errors appear in later bridge exploits, which is why our LayerZero explainer focuses on how messages are verified between chains.

Highlights

• One of the few nine-figure hacks in which users ultimately lost nothing.
• Tether froze $33 million in stolen USDT, limiting the attacker's exit routes while negotiations continued.
• Privileged cross-chain functions became a priority checklist item in later smart contract audits.

9. Revolut

Revolut confirmed on 12 September 2026 that it had sent customer records to a fraudster using a legitimate government agency email domain, TechCrunch reported. Spain's INCIBE summarized coverage tying the requests to Italian state email, and later reporting placed affected customers near 680.

Notices listed birth dates, addresses, phone numbers and passport or driving licence copies. Investigator ZachXBT said IBANs, withdrawal records and bitcoin transaction histories were also included, per Help Net Security. Attackers reportedly targeted Revolut's "crypto whales" and sought a $3 million ransom, which Revolut said it never received directly.

Revolut said its systems and customer funds were unaffected. Weeks later, a separate breach at US broker DriveWealth exposed historic data from Revolut stock-trading accounts, per The Register. For crypto holders, identity files paired with holdings data create a ready-made target list for phishing and coercion.

Highlights

• A convincing request from a real government domain bypassed technical defences entirely.
• Bitcoin transaction histories let criminals rank victims by their likely crypto holdings.
• Revolut customers received two breach notices from unrelated attackers within a single month.

10. Trezor

Trezor disclosed on 13 August 2026 that fulfilment partner ShipMonk had been breached. BleepingComputer reported 11,742 customers with full exposure of name, email, phone and shipping address, plus 1,947 with partial data, across seven countries for orders placed between May and August 2026.

Attackers exploited an SQL injection zero-day in the Metabase analytics tool ShipMonk used, rated 10.0 on the CVSS scale according to Halborn. On 4 September, Trezor added about 67,000 US customers whose 2019–2021 order records should have been deleted, taking the total near 80,000 people.

Phishing followed quickly, with messages urging recipients to hand over 24-word recovery seeds, though devices and funds were not compromised. Trezor said it plans anonymous delivery for US buyers by the end of 2026. Our Ledger Nano S Plus vs Trezor comparison weighs both brands' device security.

Highlights

• The breach came through a vendor's analytics tool rather than Trezor's own infrastructure.
• Order records retained for years beyond need multiplied the number of exposed customers.
• It was the first Trezor incident to leak phone numbers and shipping addresses, per CoinDesk.

Crypto Hack Statistics in 2026

Hack losses in 2026 have already passed every previous year, driven by a handful of enormous thefts. Counts differ between trackers because each defines incidents and recoveries differently, so we cite the source for every figure.

These figures capture the scale and direction of crypto theft today:

• Year-to-date losses: PeckShield counted about $8.6 billion lost to crypto hacks by 31 October 2026, with the ten largest incidents making up 92.3% of the total.
• October spike: Losses reached $6.48 billion across 56 major incidents in October 2026, a 745% jump from September, with Binance alone accounting for roughly $6.3 billion.
• Third quarter: CertiK recorded about $1.26 billion lost across 247 incidents in Q3 2026, up roughly 54% from Q2, with September the year's costliest month until October.
• First half: CertiK's Hack3D report counted $1.316 billion across 344 incidents in H1 2026; excluding Bybit from 2025's baseline, losses rose about 28% year on year.
• Wallet compromise: Compromised wallets caused over $444 million of H1 2026 losses across just 33 incidents, led by April's Kelp DAO and Drift Protocol breaches, according to CertiK.
• North Korea's share: Chainalysis links about 89% of reported 2026 hack losses to North Korea-linked groups, up from roughly 15% in 2021, per Seoul Economic Daily.
• 2025 baseline: Chainalysis put total 2025 crypto theft at $3.4 billion, with North Korean hackers responsible for $2.02 billion, lifting their tracked all-time total to $6.75 billion.
• Exchange targets: Bitget lost about $387.5 million in September 2026 and Binance followed weeks later, making centralized exchange hot wallets the year's most expensive single-incident targets once again.
• Physical attacks: Chainalysis logged 46 violent wrench attacks through June 2026 and more than $30 million stolen, putting the year on course to beat 2025's $58 million record.
• Freezes and recoveries: Stablecoin issuers and Arbitrum's Security Council froze about $2.7 billion of the Binance haul within hours, showing how centralized stablecoins can limit what attackers keep.

Monthly figures can swing wildly: PeckShield logged $136.3 million in August before September's two large exchange and protocol hacks. For wider context, our stablecoin statistics and crypto wallet statistics track the assets and tools most often targeted.

How the Biggest Crypto Hacks Have Evolved

The ten incidents span fifteen years, and the attack methods have shifted with the industry. Early losses came from poorly secured exchange wallets, while recent thefts target the people, devices and signing systems that approve transactions.

From Code Exploits to Signer Compromise

Between 2021 and 2022, the largest thefts exploited protocol design. Poly Network's attacker abused contract permissions, and Ronin's attackers collected enough validator keys to meet the signing threshold. Bridges were the common thread because they concentrate deposits in a few contracts that release funds whenever enough valid signatures arrive.

Since 2025, North Korean operators have targeted signing workflows instead. Bybit's signers approved a manipulated transaction through a compromised interface, and Binance's attacker obtained valid signatures across ten chains after an engineer's laptop was breached. CertiK's Q3 data still shows exploits causing most losses, but the biggest single thefts now start with people.

Laundering has changed alongside the attacks. After Binance, Chainalysis observed funds cycling through thousands of addresses in automated sequences and stablecoins being swapped quickly into ETH, which issuers cannot freeze. Attackers increasingly race freeze teams in the first hour, so issuer response speed now shapes final losses.

Common Attack Vectors Behind the Largest Incidents

No single weakness explains these incidents. Each exploited a different layer, from smart contract logic to telecom accounts, which is why exchanges and users need defences at several points rather than one strong wall.

These are the main attack routes seen across the ten incidents:

• Hot wallet signing: Binance's attacker made production signing systems approve transfers on ten chains, showing how shared infrastructure can turn one breach into a multi-network loss within minutes.
• Blind signing: Bybit's multisig signers approved a transaction that looked routine in a compromised interface, handing wallet control to attackers without any private key being stolen.
• Validator capture: Ronin's bridge required five of nine signatures, and attackers gathered five keys, proving that small validator sets concentrate risk even in networks marketed as decentralized.
• Contract logic: Poly Network's attacker rewrote a privileged cross-chain role, letting the protocol approve withdrawals it believed were valid, which remains a common audit finding today.
• SIM swapping: FTX's attackers allegedly used a fake ID to hijack an employee's phone number, then intercepted SMS codes guarding company accounts and wallets worth hundreds of millions.
• Insider bribery: Coinbase's breach came from paid support contractors copying customer records, a reminder that legitimate access can be bought when monitoring of staff activity lags.
• Social engineering: Revolut released identity files after receiving requests from a genuine government email domain, so no system intrusion was needed to obtain sensitive customer data.
• Vendor and database leaks: Ledger's e-commerce database and Trezor's shipping partner both leaked buyer details, showing that any system storing addresses forms part of a wallet maker's attack surface.

Why Customer Data Leaks Rank Alongside Theft

Four of the ten incidents stole no coins directly, yet their effects can outlast many heists. Leaked names, addresses and balances let criminals choose victims, write convincing scripts and, in the worst cases, turn up at someone's door. Exposed data cannot be reset, so the risk persists for years.

Chainalysis has linked France's surge in wrench attacks, 30 publicly known cases by mid-2026, to an alleged leak of tax records on wealthy crypto holders. Home invasions rose from 14% of violent incidents in 2025 to 37% in 2026, according to its wrench attack report, underlining why protecting customer data matters.

Who Pays After a Crypto Hack?

The headline loss rarely matches what customers end up losing. Across these incidents, the outcome depended less on the size of the theft than on who stood behind the balance and how long repayment took, so hacks of similar size have left users in very different positions.

These are the main ways the losses above were absorbed:

• Company reserves: Binance said it would fully cover the loss, drawing on its roughly $1 billion SAFU fund, part of its Futures insurance fund and its corporate treasury, and reported replenishing 95% of affected assets as Bitcoin withdrawals reopened on 1 November, per crypto.news. Bybit likewise absorbed its loss and kept withdrawals open.
• Outside investors: Sky Mavis raised $150 million in a round led by Binance and added its own funds to repay Ronin users, per The Block, reopening the bridge on 28 June 2022. About 56,000 ETH belonging to the Axie DAO treasury stayed uncollateralized, Nairametrics reported.
• Attacker returns: Poly Network users lost nothing only because the hacker handed the assets back within 13 days, an outcome no customer can plan around.
• Bankruptcy estates: FTX customers reached a cumulative 105% of their claims after the July 2026 distribution, per Tangem, more than three and a half years after the collapse and measured against 2022 claim values rather than today's prices.
• Court trustees: Mt. Gox creditors have waited more than 12 years, and part of the estate remains undistributed with a deadline of 31 October 2027.
• Data breach victims: No balances were taken at Ledger, Trezor or Revolut, so there is nothing to refund and the cost arrives later as phishing and extortion risk. Coinbase stands out for pledging to reimburse customers tricked by the resulting scams.

None of this is guaranteed. Crypto held on a platform lacks the government protection of a US bank deposit, and the FDIC has ordered firms to stop implying otherwise. A refund after a hack is the company's choice, so CNBC advises reading a platform's custody terms and checking how it is regulated. Our MiCA-licensed exchanges guide is a useful starting point.

How to Protect Your Crypto From Hacks and Data Leaks

Users cannot prevent an exchange breach, but they can limit how much sits on platforms and how easily scammers reach them. These steps address the failure points seen across the ten incidents above.

Apply these protections before the next major breach makes headlines:

1. Limit exchange balances: Keep only trading funds on centralized platforms and move long-term holdings to self-custody; our best crypto wallets guide compares secure hardware and software options.
2. Never share seed phrases: No exchange, wallet maker or support agent needs your recovery phrase, so treat every request for it as attempted theft, whatever the sender's address or claimed urgency.
3. Replace SMS codes: Use an authenticator app or hardware security key instead of text messages, since SIM swaps defeated phone-based checks protecting FTX's company accounts in 2022.
4. Enable address allowlists: Withdrawal allowlisting restricts transfers to pre-approved addresses, which Coinbase recommended after its breach to stop impersonating scammers redirecting funds into "safe" wallets they control.
5. Protect your address: Ship hardware wallets to a PO box or pickup point where possible, because leaked home addresses from Ledger and Trezor buyers have enabled phishing and extortion.
6. Verify every signature: Read what a wallet prompt actually approves, and revoke unused token permissions with our MetaMask permissions guide, since blind approvals drained Bybit's cold wallet.
7. Contact firms directly: Ignore inbound calls and emails about security incidents, and reach exchanges only through official apps, because Revolut and Coinbase victims were targeted through impersonation.
8. Check proof of reserves: Favour exchanges that publish regular reserve attestations and hold most assets offline, and spread larger balances across several platforms to limit any single failure.

If a platform you use reports a breach, read its official notice, change any reused passwords, and expect targeted phishing that references your real account details.

Final Thoughts

Binance's $6.36 billion theft now sits at the top of crypto's loss table, followed by Bybit's $1.5 billion cold wallet breach. Both trace back to North Korea's TraderTraitor, and both show that the biggest risks now sit in the systems and people approving transactions rather than in blockchain code.

Mt. Gox, Ronin, FTX and Poly Network shaped earlier security standards, from proof of reserves to bridge validator design. Ledger, Coinbase, Revolut and Trezor show a parallel threat: leaked identities and addresses that keep exposing holders to phishing and coercion long after an incident fades from the news.

Large exchanges have so far absorbed their losses, but that depends on balance sheets users cannot audit in real time. Keep exchange balances modest, use hardware-key authentication, and guard your personal data as carefully as your seed phrase. For related research, see our Bitcoin statistics and crypto exchange statistics pages.

Our Methodology

We ranked incidents on 1 November 2026 using five criteria, weighting direct financial losses most heavily.

1. Value lost: Dollar figures use values at the time of theft from blockchain analytics firms, official company disclosures, and law enforcement statements such as FBI public service announcements.
2. Customer exposure: For data breaches, we weighed the number of people affected and the sensitivity of exposed fields, including home addresses, ID documents and balances.
3. Lasting impact: Incidents that changed security practice, regulation or user behaviour, such as Mt. Gox and Ronin, ranked above thefts of similar size.
4. Attribution and recovery: We recorded confirmed attribution and the share frozen, returned or repaid, using TRM Labs, Chainalysis, court filings and bankruptcy trustee notices.
5. Data recency: Statistics come from CertiK, PeckShield and Chainalysis releases published through 1 November 2026, with each tracker's methodology noted where totals differ.

Some figures, particularly for Binance and Revolut, remain provisional while investigations continue. We did not independently trace onchain flows. Our editorial methodology explains the full review process.