The biggest exchange hack ever is the Binance hack of October 29, 2026. Roughly $6.3 billion left Binance hot wallets in about 20 minutes. That is four times the previous record, the $1.5 billion Bybit hack of February 2025. Both were pulled off by the same North Korean crew.
This list ranks the biggest crypto exchange hacks by the dollar value stolen at the time. It only covers centralized exchanges. DeFi exploits and bridge hacks get their own list. I keep this page updated, so bookmark it and check back after the next big one.
Total crypto stolen from exchanges on this list: about $11.1 billion, and Binance alone makes up more than half of it.
Update log: November 2026, first version published after the Binance hack and the Mercado Bitcoin incident.
Why I wrote this list
I have been in crypto since 2013. In that time I have watched Mt. Gox collapse, FTX implode and Binance get drained. Two of the hacks below hit me personally. I had significant funds on Bitfinex in 2016 and on Bybit in 2025. Both times I came out fine, though not without a scar or two. More on that further down.
Every hack on this list teaches the same lesson. An exchange balance is an IOU. Your coins only become yours once they sit in a wallet you control. Hopefully this page helps you remember that before the next incident, not after.
1. Binance, $6.3 billion (October 2026)
Binance tops the list by a mile. On October 29, 2026, an attacker took control of the signing infrastructure behind Binance’s hot wallets. Within about 20 minutes, around $6.36 billion moved out across ten blockchains. Ethereum assets made up the largest share at roughly $3.8 billion, followed by 18,270 BTC.
Binance paused withdrawals and said it would cover every loss. Tether and Circle froze more than $2.3 billion in stablecoins within hours, and about $3 billion was frozen in total. The FBI later confirmed North Korea’s TraderTraitor group as the attacker. Withdrawals reopened on November 1.
I covered the Binance hack live as it unfolded and followed up with a Binance hack post mortem once the first details came out. Binance says a full technical report is still coming.
2. Bybit, $1.5 billion (February 2025)
Before Binance, Bybit held the record. On February 21, 2025, hackers drained about 401,000 ETH from a Bybit cold wallet during a routine transfer to a warm wallet. The attackers had compromised the Safe wallet interface, so the Bybit signers approved a malicious transaction that looked normal on screen.
Bybit CEO Ben Zhou went live within hours and promised that every client was backed one to one. The exchange processed more than 350,000 withdrawal requests in 12 hours and stayed solvent. The FBI attributed the attack to TraderTraitor, the same North Korean unit behind the Binance hack.
I had a large chunk of my trading capital on Bybit that day. My full story is in the Bybit hack post, but the short version is simple. I tweeted the warning from the AirdropAlert account while my own withdrawals were still pending. Getting out was slow and stressful, but Bybit paid everyone.
3. Coincheck, $530 million (January 2018)
Japanese exchange Coincheck lost about 523 million NEM tokens on January 26, 2018. The coins sat in a single hot wallet without multisig protection. At the time, this was the largest crypto theft in history, bigger even than Mt. Gox.
Coincheck refunded all 260,000 affected users from its own balance sheet. Japan’s regulator then tightened exchange rules across the country. Monex Group bought the exchange a few months later.
4. Mt. Gox, $450 million (February 2014)
Mt. Gox is the most famous exchange collapse in crypto history. In early 2014, the Tokyo exchange handled around 70% of all Bitcoin trading. Then it admitted that roughly 850,000 BTC were missing, worth about $450 million at the time. Later investigations showed the coins had been drained slowly since 2011.
I vividly remember those days. The whole industry felt like it was collapsing. Every chat I was in blew up at once, and back then we were mostly on Skype, long before Discord existed. Nothing I have seen since comes close. To get a feel for it today, imagine Binance, Hyperliquid, Coinbase, Bybit, OKX and MetaMask all getting exploited on the same day. That was Mt. Gox in 2014. It is probably the most insane hack moment I will ever experience in my life.
Mt. Gox filed for bankruptcy and creditors waited more than a decade. Repayments only started in 2024, by which time the recovered coins were worth many times the original loss.
5. FTX, $415 million (November 2022)
FTX was already collapsing when the hack hit. Hours after the exchange filed for bankruptcy on November 11, 2022, an attacker drained between $415 million and $477 million from FTX wallets. The timing fueled plenty of insider theories.
In early 2024, US prosecutors charged three people with a SIM-swap ring behind the theft. FTX itself is better known for fraud than for hacking, so this one often gets forgotten. Still, it ranks among the biggest exchange hacks ever by dollar value.
6. Bitget, $387.5 million (September 2026)
Bitget joined the list on September 24, 2026. Attackers breached a backend wallet system and pulled funds from hot and warm wallets across seven networks. Bitget first estimated the loss at $351.6 million, then raised it to about $387.5 million after finding stolen assets on Zcash and TRON.
CEO Gracy Chen blamed North Korea and said the $464 million Protection Fund would cover the loss. Withdrawals reopened in phases from September 28. I tracked the whole incident in the Bitget hack post and broke down the cause in the Bitget post mortem.
7. DMM Bitcoin, $305 million (May 2024)
Japan’s DMM Bitcoin lost 4,502 BTC on May 31, 2024, worth about $305 million. The FBI and Japanese police later attributed the theft to TraderTraitor. The attackers had compromised an employee at a third-party wallet software provider.
DMM Bitcoin raised funds to cover the loss but never fully recovered as a business. The exchange announced in late 2024 that it would wind down and transfer accounts to SBI VC Trade.
8. KuCoin, $281 million (September 2020)
KuCoin confirmed a hot wallet breach on September 26, 2020. Private keys were leaked and about $281 million in Bitcoin, Ethereum and ERC-20 tokens left the exchange. Lazarus Group got the blame.
The recovery was unusual. Token projects froze or reissued contracts, and KuCoin said it got back about 84% of the stolen value. Insurance covered the rest. Users lost nothing.
9. WazirX, $235 million (July 2024)
India’s largest exchange lost about $235 million on July 18, 2024. The attackers manipulated a multisig wallet managed with custody provider Liminal, again linked to North Korea. The hack wiped out roughly 45% of WazirX reserves.
Unlike most exchanges on this list, WazirX could not cover the loss. It went through a restructuring in Singapore, and users received only partial repayment. This case shows why the size of an exchange’s reserve fund matters.
10. BitMart, $196 million (December 2021)
BitMart lost around $196 million on December 4, 2021, after a private key leak hit two hot wallets on Ethereum and BNB Chain. Most of the stolen tokens were altcoins and meme coins, including a large pile of SHIB and SAFEMOON.
BitMart promised to compensate users from its own funds. Payouts dragged on for weeks, which caused plenty of anger in the community. The exchange survived and still operates.
11. BitGrail, $170 million (February 2018)
Italian exchange BitGrail reported that 17 million Nano (then RaiBlocks) tokens had vanished in February 2018. The haul was worth about $170 million. The story got messy fast. Nano developers accused the founder of mismanagement, and an Italian court later ordered him to repay customers.
Whether this was a hack or something else is still disputed. Either way, the funds were gone and BitGrail went bankrupt.
12. Poloniex, $120 million (November 2023)
Poloniex, owned by Justin Sun, lost about $120 million on November 10, 2023. Attackers gained control of hot wallet private keys and drained Bitcoin, Ethereum, TRON and a long list of altcoins. Several analysts pointed at Lazarus based on the laundering pattern.
Sun said the exchange would cover all losses and offered the hacker a bounty to return the funds. Withdrawals stayed closed for weeks. Users were made whole, but the incident was a reminder that founder wealth is not the same as an insurance fund.
13. Liquid, $90 million (August 2021)
Japanese exchange Liquid lost more than $90 million on August 19, 2021, when attackers compromised its warm wallets. Bitcoin, Ethereum, XRP and various ERC-20 tokens were taken. Liquid moved everything else to cold storage and took a $120 million loan from FTX to cover the gap.
FTX later bought Liquid outright. Then FTX collapsed, dragging Liquid down with it. Two hacks in a row for the same users, if you count the FTX bankruptcy.
14. Phemex, $85 million (January 2025)
Phemex lost roughly $73 million to $85 million on January 23, 2025. The attacker emptied hot wallets across 16 blockchains in a matter of hours. Analysts spotted the pattern of a private key compromise, with stablecoins swapped into ETH quickly to dodge freezes.
Phemex paused withdrawals, rebuilt its wallet system and reopened in phases within days. User balances were covered. This was the first big exchange hack of 2025, one month before Bybit.
15. Bitfinex, $72 million (August 2016)
Bitfinex lost 119,756 BTC on August 2, 2016. At the time that was worth about $72 million. Today those coins would be worth several billion dollars, which makes Bitfinex the biggest exchange hack ever in current terms.
The aftermath was unique. Bitfinex spread the loss across every customer with a 36% haircut and issued BFX tokens as IOUs. Those tokens were redeemed in full by April 2017. In 2022, US authorities arrested Ilya Lichtenstein and Heather Morgan and recovered most of the coins.
I had significant funds on Bitfinex when it happened. The hack hit the night before a surf trip to Morocco I had scheduled for months. So I got up, saw the news and sold some Bitcoin before leaving. A week later I came back and BTC was already trading higher. I bought back above where I sold. My pre-vacation risk management cost me some there, but at least I slept on the beach. Bitfinex eventually made everyone whole, and that week is why I have never trusted a single exchange with the bulk of my stack since.
Honorable mentions
A few incidents fall just outside the top 15 or do not fit the definition of a wallet hack.
Zaif, September 2018. The second Japanese exchange hacked that year after Coincheck. Attackers took about $60 million in Bitcoin, Bitcoin Cash and MonaCoin from hot wallets. Operator Tech Bureau sold the exchange to Fisco to fund repayments.
Mercado Bitcoin, November 2026. Brazil’s biggest exchange suspended withdrawals on November 2 after an attacker hit its hot wallets across at least ten chains. On-chain trackers put the haul at roughly $46 million, though Mercado Bitcoin has not confirmed a figure. I covered the details in the Mercado Bitcoin hack post. If the final number grows, this entry moves up the list.
Upbit, November 2019. South Korea’s largest exchange lost 342,000 ETH, worth about $49 million. Later investigations linked it to Lazarus.
Binance, May 2019. Hackers used phished API keys and 2FA codes to withdraw 7,000 BTC, about $40 million at the time. Binance covered it from its SAFU fund. I wrote about it back then in this Binance hack post.
Coinbase, May 2025. A data breach rather than a wallet hack. Covered in the never-hacked section below.
Exchanges that have never lost user funds to a hack
People google “has Coinbase been hacked” more often than any entry on this list. So here is the short answer for the big names with a clean wallet record.
Coinbase has never had its wallets breached. It has had two incidents that get called hacks anyway. In 2021, attackers used a flaw in SMS two-factor recovery to empty around 6,000 customer accounts, and Coinbase refunded them. In May 2025, bribed overseas support contractors leaked customer data, which scammers then used for social engineering. Coinbase put the cost at $180 million to $400 million. A data breach is not a wallet hack, but for the victims the result was the same. Their names, addresses and balances ended up with criminals who called them pretending to be Coinbase support. I broke the whole thing down in the Coinbase data breach post.
Kraken has never lost user funds. In 2024, security researchers found a bug that let them mint balances and pulled about $3 million before Kraken caught it. The funds came back, after a public fight over whether it was research or extortion. Customers were never exposed.
OKX has no exchange-level breach on record. The cases you will find online are individual account takeovers through SIM swaps and phishing, mostly in 2024. Those are user-side attacks, not a wallet compromise. OKX added stronger withdrawal controls after that wave.
A clean record is not a guarantee. Bybit had one too until February 2025. Treat it as one data point, next to proof of reserves, fund size and how fast the exchange communicates when something goes wrong.
Biggest exchange hacks by year
One entry per year, the largest exchange hack in each.
2026: Binance, $6.3 billion
2025: Bybit, $1.5 billion
2024: DMM Bitcoin, $305 million
2023: Poloniex, about $120 million
2022: FTX, $415 million
2021: BitMart, $196 million
2020: KuCoin, $281 million
2019: Upbit, $49 million
2018: Coincheck, $530 million
2016: Bitfinex, $72 million
2014: Mt. Gox, $450 million
Notice the pattern. The record has been broken in 2014, 2018, 2025 and 2026. Four new records in twelve years, and the gap between them is shrinking.
What the biggest exchange hacks have in common
Three patterns show up again and again when you line these hacks up.
First, North Korea. Lazarus and its TraderTraitor unit are tied to Binance, Bybit, Bitget, DMM Bitcoin, WazirX, KuCoin, Upbit and Phemex. One state actor is behind more than $8.5 billion of the thefts on this page. If you want to see how their money moves after a hack, read our post on ZachXBT tracking Lazarus.
Second, the entry point is rarely the exchange’s own code. Bybit was hit through a wallet provider’s interface. DMM Bitcoin and WazirX through third-party custody tools. Coinbase through outsourced support staff. Binance says an engineer’s laptop was compromised. Supply chains and people are the weak links, not blockchains.
Third, survival depends on the reserve fund. Binance, Bybit, Bitget, Coincheck and KuCoin covered everything. WazirX and Mt. Gox could not. Before you deposit, check whether an exchange publishes proof of reserves and how big its insurance fund is.
How to protect yourself
Nobody can predict the next hack, but you can limit the damage before it happens.
Keep only what you actively trade on an exchange. Everything else belongs in a hardware wallet. Spread your trading capital across two or three venues instead of one. Set up withdrawal whitelists and 2FA on every account. Follow the AirdropAlert X account, because I post warnings the moment rumours of a hack start circulating, usually before the official confirmation.
For a full checklist of wallet and account hygiene, read our stay safe guide. If you are considering a move to self custody for trading, my comparison of which DEX is safe explains how the big perp DEXs handle custody.
Picking an exchange that fits you
Security is one filter. Fees, coin selection, leverage and local regulation are the others, and the right answer changes by country. We have published more than 40 articles reviewing centralized exchanges and perp DEXs, comparing them head to head, and ranking the best options per region. Start with our exchange reviews and compares to find the venue that fits where you live and how you trade.
What to do when you have funds on a hacked exchange
A lot of exchanges now have insurance or an emergency fund. Binance has SAFU, Bitget has its Protection Fund, Bybit proved it could cover a $1.5 billion hole. That is reassuring, but it is not a reason to relax.
My own rule has not changed. If withdrawals are still open, take your money off as soon as possible and move it into self custody. Do not wait for the official statement. Then let the storm blow over. Once the exchange has responded properly and security is back, you can decide whether you want to deposit again or not.
Whatever you do, do not sit on your hands hoping it will all turn out fine. Plenty of times, it did not. Mt. Gox users waited ten years. WazirX users got a partial repayment. BitGrail users got nothing for a long time. Being early to the exit costs you nothing if the exchange survives. Being late can cost you everything if it does not.
Keep This Content Free
Every exchange on this list that survived did so because it could pay its users back. OKX and Bybit both publish proof of reserves and run large protection funds. If you sign up through our links, you get their welcome bonus and we earn a small commission that keeps AirdropAlert running.
Final Words
The biggest exchange hacks ever keep getting bigger. Mt. Gox lost $450 million and the industry thought that was the end of crypto. Twelve years later, Binance lost fourteen times that amount and reopened withdrawals in three days. Exchanges have become far better at absorbing losses. Attackers have become far better at causing them.
My own rule has not changed since Bitfinex in 2016. An exchange is a place to trade, not a place to store. Twice I had significant funds on an exchange when it got hacked, and twice I came out the other side. That was partly luck and partly because I never leave everything in one place. I will keep updating this list after every major incident, so check back whenever the next alarm goes off.
FAQ
What is the biggest crypto exchange hack ever?
The Binance hack of October 29, 2026 is the biggest exchange hack ever. Roughly $6.3 billion was stolen from Binance hot wallets across ten blockchains. About $3 billion was frozen within days, and Binance covered all user losses.
What was the biggest exchange hack before Binance?
Bybit held the record with $1.5 billion stolen on February 21, 2025. Coincheck’s $530 million loss in 2018 was the record before that.
Who is behind most of the biggest exchange hacks?
North Korea. The FBI has attributed Binance, Bybit, DMM Bitcoin and several others to the TraderTraitor unit of Lazarus Group. Bitget’s CEO also blamed North Korea for the September 2026 hack.
What is TraderTraitor?
TraderTraitor is the name the FBI uses for a North Korean hacking unit inside the Lazarus Group. It targets crypto exchanges and their suppliers through fake job offers, poisoned software and compromised developer machines. The FBI has tied it to the Binance, Bybit and DMM Bitcoin hacks.
How many exchange hacks are linked to Lazarus Group?
At least eight on this page. Binance, Bybit, Bitget, DMM Bitcoin, WazirX, KuCoin, Upbit and Phemex have all been attributed to Lazarus or its TraderTraitor unit by investigators or the exchanges themselves. Together those thefts top $8.5 billion.
Did users lose money in these exchange hacks?
In most recent cases, no. Binance, Bybit, Bitget, KuCoin, Coincheck and Phemex all covered losses from their own funds. Mt. Gox, WazirX and BitGrail users were not fully repaid.
Do exchanges refund hacked funds?
Usually yes, if the exchange is large and solvent. Binance, Bybit, Bitget, KuCoin and Coincheck all repaid users in full. Smaller or already troubled exchanges often cannot, which is what happened at Mt. Gox and WazirX. Do not rely on it. The section above on what to do when your exchange gets hacked explains why withdrawing first is the safer play.
Did Mt. Gox users get their money back?
Partly, and very late. Mt. Gox recovered about 142,000 BTC, roughly a fifth of what went missing. Repayments to creditors only began in July 2024, more than ten years after the collapse. Because Bitcoin rose so much in the meantime, many creditors received more dollar value than they lost, even though they got back far fewer coins.
Was the Bitfinex hack money recovered?
Most of it. In February 2022, US authorities seized about 94,000 of the 119,756 stolen BTC from Ilya Lichtenstein and Heather Morgan, then worth around $3.6 billion. Bitfinex had already made its customers whole in 2017 through the BFX token program, so the recovered coins went to the government and Bitfinex rather than to users.
Is the Bitfinex hack the biggest in today’s prices?
Yes. The 119,756 BTC stolen from Bitfinex in 2016 were worth $72 million then and several billion dollars today.
How often is this list updated?
After every major exchange hack. The update log at the top shows the latest revision.
Credit: Source link
