The biggest crypto hack of all time is the Binance hack of October 29, 2026, at about $6.3 billion. In fact, it is larger than the next four hacks combined. Behind it sit Bybit at $1.5 billion, then the Ronin bridge at $625 million and Poly Network at $611 million.
This list ranks the 20 biggest crypto hacks ever by value at the time of the theft, across every place crypto can sit. So centralized exchanges, DeFi protocols, cross-chain bridges and wallets all count. Every entry also notes how much came back, because that number tells you more about where to keep your coins than the headline figure does.
Altogether, the top 20 adds up to roughly $14 billion. North Korea is behind more than half of it.
Update log: November 2026, first version.
How this list is different from the exchange list
Last week I published the biggest exchange hacks ranking, which only covers centralized platforms. That post is also where my own Bybit and Bitfinex stories live. This one zooms out instead. Exchanges still take most of the top spots, but DeFi and bridges fill the middle of the table. On top of that, 2026 added the first hardware wallet disasters big enough to matter.
Three questions shape every entry below. First, where was the money sitting. Second, how did the attacker get in. Finally, did anyone get paid back.
1. Binance, $6.3 billion (exchange, October 2026)
An attacker took over the signing infrastructure behind Binance hot wallets and then moved about $6.36 billion across ten chains in roughly 20 minutes. The FBI later pinned it on North Korea’s TraderTraitor unit.
Recovered: about $3 billion frozen, mostly by Tether and Circle. Binance also covered every user from its own balance sheet and reopened withdrawals on November 1. For the first details of how it happened, read the Binance hack post mortem.
2. Bybit, $1.5 billion (exchange, February 2025)
Hackers compromised the Safe wallet interface used by Bybit signers and drained 401,000 ETH from a cold wallet during a routine transfer. Once again, TraderTraitor. The Bybit hack post mortem explains how a developer’s machine at Safe became the entry point.
Recovered: very little, because most of the ETH was laundered within weeks. Still, Bybit absorbed the full loss and stayed solvent.
3. Ronin Network, $625 million (bridge, March 2022)
The bridge behind Axie Infinity ran on nine validators, and Sky Mavis controlled five of them. Lazarus phished an engineer with a fake job offer, got those keys and then signed withdrawals for 173,600 ETH and 25.5 million USDC. Nobody noticed for six days.
Recovered: around $30 million seized by US authorities. Afterwards, Sky Mavis raised $150 million from Binance and others to reimburse users.
4. Poly Network, $611 million (DeFi, August 2021)
A cross-chain protocol with a flaw in how it verified messages between chains. As a result, one attacker drained $611 million across Ethereum, BNB Chain and Polygon in a single afternoon.
Recovered: all of it. The hacker, who called himself Mr. White Hat, returned the funds within two weeks and was even offered a $500,000 bounty. Still the strangest ending in the history of crypto hacks.
5. BNB Chain bridge, $570 million (bridge, October 2022)
An attacker forged proofs on the BSC Token Hub bridge and minted two million BNB out of thin air. However, validators halted the entire chain within hours.
Recovered: most of it never left. Only around $100 million was bridged out before the halt, which is why some lists count this one lower.
6. Coincheck, $530 million (exchange, January 2018)
Japan’s Coincheck kept 523 million NEM in one hot wallet with no multisig. Consequently, it was emptied in one go.
Recovered: none from the hackers. Instead, Coincheck refunded all 260,000 users itself.
7. Mt. Gox, $450 million (exchange, February 2014)
Roughly 850,000 BTC drained slowly from 2011 onwards, then discovered in 2014. In other words, the hack that nearly killed crypto.
Recovered: about 142,000 BTC found in old wallets. Creditor repayments only started in July 2024, more than a decade later.
8. FTX, $415 million (exchange, November 2022)
Hours after FTX filed for bankruptcy, someone drained between $415 million and $477 million from its wallets. US prosecutors later charged a SIM-swap gang.
Recovered: partial. Some funds were frozen on other exchanges, and since then the estate has been clawing back assets for years.
9. Bitget, $387.5 million (exchange, September 2026)
A backend wallet system was breached and hot and warm wallets drained across seven chains. CEO Gracy Chen blamed North Korea. I tracked it live in the Bitget hack post as the number grew.
Recovered: a small share frozen on chain. Bitget’s Protection Fund then covered the rest.
10. Wormhole, $325 million (bridge, February 2022)
A signature verification bug in the Solana side of the Wormhole bridge let an attacker mint 120,000 wrapped ETH without depositing anything.
Recovered: none from the hacker. Instead, Jump Crypto, Wormhole’s backer, replaced the full amount within a day to keep the bridge solvent. In 2023, Jump also clawed back $225 million by counter-exploiting the hacker’s positions.
11. Liquid Network, $320 million (sidechain, September 2026)
A range-proof bug in Blockstream’s Elements software let attackers mint unbacked L-BTC and redeem it for real Bitcoin. As a result, about 4,000 BTC left the federation wallet on September 6, roughly 95% of the sidechain’s reserves. The full story is in our Liquid Network hack post.
Recovered: 3,400 BTC returned the next day by attackers calling themselves white hats. However, they kept 598 BTC, about $47 million, as a self-appointed bounty. Many in the industry called that extortion with extra steps.
12. DMM Bitcoin, $305 million (exchange, May 2024)
4,502 BTC stolen after TraderTraitor compromised an employee at DMM’s wallet software provider.
Recovered: none. DMM Bitcoin covered users, then wound down and handed its accounts to SBI VC Trade.
13. KelpDAO, $292 million (DeFi, April 2026)
Attackers first compromised KelpDAO’s internal RPC nodes and knocked external ones offline. Then they fed a forged burn message to its LayerZero bridge, which released 116,500 unbacked rsETH. Lazarus attributed. The full breakdown is in our KelpDAO exploit explainer.
Recovered: about a quarter frozen. In May, rsETH was restored to full backing through the DeFi United coalition led by Lido, EtherFi and Aave’s founder.
14. Drift Protocol, $285 million (DeFi, April 2026)
No smart contract bug here. Instead, North Korean operators spent six months on social engineering, including in-person meetings, until they held enough admin keys to drain the Solana perp DEX. Our Drift exploit explainer walks through the whole operation.
Recovered: none. It remains the largest exploit in Solana history after Wormhole.
15. KuCoin, $281 million (exchange, September 2020)
Hot wallet keys leaked and $281 million in BTC, ETH and tokens walked out. Lazarus again.
Recovered: about 84%. Token projects froze and reissued contracts, while insurance covered the rest. In the end, users lost nothing.
16. WazirX, $235 million (exchange, July 2024)
A multisig managed with custody provider Liminal was manipulated into signing a malicious upgrade. North Korea linked, as usual.
Recovered: none at first. WazirX could not cover it. After a Singapore restructuring, however, users got about 85% back in late 2025.
17. Cetus, $223 million (DeFi, May 2025)
A math overflow bug in the Sui DEX’s liquidity logic let an attacker drain its pools with almost no capital.
Recovered: $162 million. Sui validators froze the attacker’s addresses, which then started a long argument about whether a chain that can freeze funds is decentralized at all.
18. Euler Finance, $197 million (DeFi, March 2023)
A flash loan exploit against a flaw in Euler’s donation function emptied the lending protocol in minutes.
Recovered: nearly all of it. After weeks of on-chain negotiation, the attacker returned the funds and even apologised.
19. BitMart, $196 million (exchange, December 2021)
Private key leak on two hot wallets, mostly altcoins and meme coins.
Recovered: none. BitMart paid users back from its own funds, although slowly.
20. Nomad, $190 million (bridge, August 2022)
A botched upgrade let anyone replay a valid transaction with their own address swapped in. Within hours, hundreds of copycats joined. In effect, the first crowdsourced hack.
Recovered: around $37 million, returned by white hats and guilty copycats.
The hack that split Ethereum
One hack is too small for the top 20 by dollar value and yet too important to leave out. In June 2016, an attacker drained 3.6 million ETH from The DAO, a crowdfunded investment fund that held around 14% of all ETH in existence. At the time, the haul was worth about $60 million.
The Ethereum community then voted to hard fork the chain and return the funds, effectively rewriting history. A minority refused and kept running the original chain instead, which became Ethereum Classic. Every argument since about immutability, about whether code is law and about freezing stolen funds on Sui or Berachain traces back to that fork. By percentage of a network’s supply, in fact, no hack on this list comes close.
The biggest wallet hacks
Wallet hacks rarely reach the sizes above, because the losses are spread across thousands of people. 2026 changed that. Two hardware wallet incidents in three months put the “not your keys” rule under real pressure.
Coldcard, July to August 2026. A seed generation flaw on affected Coldcard devices produced recovery phrases that attackers could recreate. Starting July 30, they swept roughly 1,789 BTC from 8,865 addresses in waves, about $115 million. Most of the coins have not moved since. Coinkite fixed the firmware, but a patch does not repair a seed that was already weak. We covered the first wave in our Coldcard wallet hack post while losses were still counted in the tens of millions.
Ledger and CryptoBilis, October 2026. Ledger devices sold through CryptoBilis, an authorised reseller in Malaysia, Indonesia and the Philippines, contained a hidden implant under the screen. It read the recovery phrase as the device displayed it and then sent it out over a cellular chip. Ledger’s Genuine Check still passed, because the secure chip itself was untouched. So far, researchers have traced more than $93 million across 311 wallets. However, the true total cannot be measured. Nobody knows how many tampered devices were sold, some victims may not have discovered the loss yet, and Trezor has since confirmed a tampered Safe 5 from the same reseller. By scale and by what it did to trust in hardware wallets, it is therefore the biggest hardware wallet scandal in crypto’s history.
Atomic Wallet, June 2023. Around $100 million drained from more than 5,000 users of the software wallet. Attributed to Lazarus, although the cause was never fully explained.
Slope, August 2022. About $4 million from 9,000 Solana wallets, after the Slope app logged seed phrases to a central server in plain text.
The common thread is not weak cryptography. Rather, it is the supply chain around the wallet, from the firmware that generates the seed to the shop that hands you the box.
What the biggest hacks have in common
North Korea sits behind at least 11 of the entries above, including the top two. Elliptic estimated Lazarus had stolen $6 billion between 2017 and late 2025. Then Binance alone doubled that in one evening. Our guide to Lazarus Group crypto hacks covers how they operate and why they keep winning.
Bridges are the weak point of DeFi. Ronin, BNB Chain, Wormhole, Liquid, KelpDAO and Nomad all moved assets between chains. In other words, six of the top 20 come from that one category, and the failure mode has barely changed since 2022. If you are not sure why that code is so fragile, start with our explainer on what a crypto bridge is.
The entry point is almost never the blockchain. Instead, phished engineers, bribed support staff, compromised laptops, tampered hardware and six-month social engineering campaigns did most of the damage on this page. Code audits, after all, do not catch a fake job offer.
Where the stolen money goes
Stealing is the easy part. Afterwards, nearly every entry above went through the same laundering pipeline. Stablecoins get swapped into ETH or BTC within minutes, because Tether and Circle can freeze USDT and USDC but nobody can freeze Ether. Our explainer on Tornado Cash and crypto mixers shows how the next step works and why mixers keep getting sanctioned.
From there, large hauls often end up in privacy coins. Monero is the usual destination, because its transactions hide sender, receiver and amount by design. Once stolen funds become XMR, on-chain tracing mostly ends. That is the main reason exchanges keep delisting it, and equally the main reason thieves keep using it. Our deep dive on whether Monero is the best privacy coin covers both sides of that fight.
Where your crypto is least safe
Ranked by what this list shows, not by theory.
Centralized exchanges lose the most money in absolute terms, but users usually get repaid. Nine of the top 20 are exchanges, and in seven of those cases customers were made whole.
DeFi protocols and bridges lose less per incident, yet refund far less often. Of the eleven DeFi, bridge and sidechain entries, only Poly Network, Euler, Wormhole and Liquid ended with users covered, and three of those depended on the hacker’s goodwill. Our running DeFi hacks 2026 guide tracks every protocol exploit this year.
Self custody has the best record by far, until the hardware itself is compromised. Coldcard and CryptoBilis victims have no exchange to call and no DAO to vote on a refund. In short, the coins are simply gone. If you ever end up on the wrong side of one of these, read can stolen crypto be recovered before you pay anyone who promises to get it back.
My own setup follows that logic. First, trading capital on two or three exchanges with large reserve funds. Second, farming capital spread across many wallets so no single protocol can hurt me. Finally, long-term holdings on hardware wallets I bought directly from the manufacturer. Our stay safe guide walks through the full checklist.
Keep This Content Free
Most of the exchange hacks above ended with users repaid, because the platform had a real reserve fund. OKX and Bybit both publish proof of reserves and have also proven they can absorb a hit. Signing up through our links gets you their welcome bonus and, at the same time, helps us keep tracking every hack on this list.
Final Words
Fourteen billion dollars across 20 incidents, and the top of the list keeps moving. In 2022 the record was Ronin at $625 million. By 2025 it was Bybit at $1.5 billion. Then, by late 2026, it was Binance at $6.3 billion. Each time, the industry said it had learned its lesson.
The pattern underneath, however, has not changed since The DAO in 2016. Attackers go after people and infrastructure, not math. Exchanges pay back, DeFi mostly does not, and hardware wallets are only as trustworthy as the supply chain behind them. So spread your risk across all three and keep this page bookmarked. I will update it after every hack that earns a spot.
FAQ
What is the biggest crypto hack of all time?
The Binance hack of October 29, 2026, at about $6.3 billion. It is the largest theft in crypto history by a factor of four, ahead of Bybit’s $1.5 billion loss in February 2025.
What is the biggest DeFi hack ever?
Poly Network at $611 million in August 2021, although every dollar was returned. The biggest DeFi hack where funds were not returned is KelpDAO at $292 million in April 2026.
What is the biggest crypto bridge hack?
Ronin Network, $625 million in March 2022. BNB Chain’s bridge was exploited for $570 million later that year, but most of it was frozen before leaving the chain.
What is the biggest hardware wallet hack?
Coldcard, with roughly 1,789 BTC worth about $115 million swept in August 2026 through a seed generation flaw. The Ledger CryptoBilis implant scandal from October 2026 may be larger, but its full size cannot be measured.
What was The DAO hack?
In June 2016, an attacker drained 3.6 million ETH, about $60 million at the time, from The DAO on Ethereum. The community hard forked to reverse it, and the chain that refused became Ethereum Classic.
How much crypto has North Korea stolen?
More than $12 billion, by Elliptic’s count combined with the Binance hack. Lazarus and its TraderTraitor unit are tied to Binance, Bybit, Ronin, KelpDAO, Drift, DMM Bitcoin, KuCoin, WazirX, Bitget and Atomic Wallet.
Do victims of crypto hacks get their money back?
It depends on where the money was. Large exchanges usually repay users from reserve funds. DeFi protocols rarely can, unless the hacker returns the funds or a backer steps in. Wallet victims almost never get anything back.
Which crypto hacks were fully recovered?
Poly Network and Euler Finance, both because the attacker returned the funds. Wormhole, Ronin and KelpDAO were made whole by backers or coalitions rather than by recovering the stolen coins. Liquid Network got 85% back.
Credit: Source link
