Seventeen thefts from exchanges, bridges and DeFi protocols, ranked by the US dollar value of what was stolen at the time. The newest, an exploit of Binance on October 29, 2026, is estimated at $6.3 billion and is still preliminary; it is about four times the previous record, Bybit’s $1.46 billion in 2025. Nine of the 17 were carried out by, or blamed on, North Korean hackers. Figures are as of October 31, 2026.
Pictured: a news report on the Binance hack, #1 with an estimated (preliminary) $6.3 billion.
Rank
Incident / victim
Stolen ($M)
Date
Type
Attribution
Recovered or frozen
1
Binance (exchange)
6,300
Oct 29, 2026
Exchange
Suspected North Korea (TRM Labs, preliminary)
~$3,000M frozen; none returned yet
2
Bybit (exchange)
1,460
Feb 21, 2025
Exchange
North Korea — Lazarus / TraderTraitor (FBI)
~$79M recovered or frozen (about 5%)
3
Ronin Network (Axie Infinity)
625
Mar 23, 2022
Bridge
North Korea — Lazarus (US Treasury)
~$30M seized
4
Poly Network
611
Aug 10, 2021
Bridge
None attributed
Nearly all returned by the attacker
5
BNB Chain bridge (BSC Token Hub)
570
Oct 6, 2022
Bridge
None attributed
Not stated; only ~$100M left the chain
6
Coincheck (exchange)
530
Jan 26, 2018
Exchange
None attributed
None; exchange refunded users from its own funds
7
FTX (exchange)
477
Nov 11, 2022
Exchange
None attributed (disputed)
Partly frozen; amount not stated
8
Mt. Gox (exchange)
450
Feb 2014
Exchange
None attributed
~200,000 BTC found in an old wallet
9
Bitget (exchange)
351.6
Sep 24, 2026
Exchange
Suspected North Korea (Bitget, Elliptic)
None reported; Bitget’s protection fund covers users
10
Wormhole (bridge)
326
Feb 2, 2022
Bridge
None attributed
None; Jump Crypto replaced the 120,000 ETH
11
DMM Bitcoin (exchange)
305
May 31, 2024
Exchange
North Korea — TraderTraitor (FBI, Japan NPA)
No recovery reported
12
KelpDAO rsETH bridge
292
Apr 18, 2026
Bridge
Probably Lazarus (LayerZero)
30,766 ETH frozen by Arbitrum; total not stated
13
Drift Protocol
285
Apr 1, 2026
DeFi protocol
North Korea-linked (Mandiant, Drift, TRM, Elliptic)
No recovery reported
14
KuCoin (exchange)
281
Sep 25, 2020
Exchange
Lazarus (Chainalysis, UN experts)
~84% recovered (KuCoin)
15
WazirX (exchange)
235
Jul 18, 2024
Exchange
Lazarus (Elliptic, not official)
No recovery reported
16
Cetus Protocol
223
May 22, 2025
DeFi protocol
None attributed
$162M frozen by Sui validators
17
Nomad (bridge)
190
Aug 1, 2022
Bridge
None attributed
Partly returned; amount not verified
No matching rows.
As of October 31, 2026. Amounts are the US dollar value of the assets when they were stolen, not today’s value, so bitcoin and ether thefts look small next to current prices. Sources disagree by tens of millions on most rows; the figure shown is the one most outlets and the victim cite. The Binance row is a preliminary estimate (about $6.3 billion per Binance and TRM Labs) and may be revised, as may Bitget’s (first reported $351.6 million, later estimates up to about $390 million). “Official” attribution means a government agency named North Korea; “suspected” means a security firm or the victim did. “Recovered or frozen” is money returned, seized or frozen, not reimbursements paid by the victim. Hacks of individuals, scams and rug pulls are excluded. For bitcoin’s other crime stories see The Biggest Bitcoin Busts in US History, and for more bitcoin data visit Bittery.[1][12]
The Top 10
#1
Binance — $6.3 billion (preliminary)
On October 29, 2026, attackers moved about $6.3 billion out of the world’s largest exchange across 10 blockchains, most of it within roughly 20 minutes; TRM Labs put the outflow at about $6.36 billion and Chainalysis at $6.4 billion.[2] Binance said the breach began with a compromised laptop, suspended deposits and withdrawals, and pledged to cover all losses; about $3 billion has been frozen, including stablecoins frozen by Tether and Circle, but no funds have been returned.[2] TRM Labs attributed it “with high confidence” to the North Korean TraderTraitor group; no government has confirmed that yet.[2] Every figure here is preliminary and may be revised.
#2
Bybit — $1.46 billion
On February 21, 2025, attackers took about 401,000 ETH and related tokens, worth roughly $1.46 billion, from the Dubai exchange’s cold wallet by compromising a developer machine at wallet provider Safe.[3] The FBI attributed it to North Korea’s TraderTraitor group, better known as Lazarus.[3] By August 2026 Bybit said about $48 million had been recovered and about $30 million frozen, roughly 5% of the total.[3]
#3
Ronin Network — $625 million
On March 23, 2022, attackers forged withdrawals from the Ronin bridge behind the game Axie Infinity, taking 173,600 ETH and 25.5 million USDC after gaining control of five of its nine validators; it was noticed six days later.[4] Reports put the loss between $552 million and $625 million depending on the price used; this post uses $625 million. The US Treasury linked it to Lazarus, and about $30 million was seized later that year.[4]
#4
Poly Network — $611 million
On August 10, 2021, an attacker exploited the cross-chain protocol Poly Network for about $611 million in Ether, BNB Chain tokens and USDC, then said they did it “for fun.”[5] Within about two weeks nearly everything was returned, which is why it is the largest hack on this list with almost no net loss.[5]
#5
BNB Chain bridge — $570 million
On October 6, 2022, an attacker forged a proof on the BSC Token Hub bridge and minted 2 million BNB, valued at about $570 million.[6] Validators halted the chain, and only around $100 million was ultimately moved off it, so the real loss was far smaller than the headline value.[6]
#6
Coincheck — $530 million
In January 2018, hackers drained 523 million NEM tokens, about $530 million then, from the Japanese exchange’s hot wallet.[7] Coincheck refunded roughly 260,000 customers about ¥46.3 billion from its own funds; the stolen NEM were never fully recovered.[7]
#7
FTX — $477 million
On November 11, 2022, hours after FTX filed for bankruptcy, about $477 million was moved out of its wallets without authorization, according to blockchain analysts Elliptic.[8] Who was behind it remains disputed: three people were later indicted in a SIM-swapping case tied to it, but this table lists no attribution.[8]
#8
Mt. Gox — about $450 million
When Mt. Gox collapsed in February 2014, its filing put losses at 850,000 bitcoin, about $450 million then (estimates run $440–480 million), of which about 200,000 BTC turned up in an old wallet.[9] Measured at today’s bitcoin price the loss would be many times larger; this list uses value at the time. The culprits were never publicly identified.[9]
#9
Bitget — $351.6 million
On September 24, 2026, Bitget said suspected North Korean actors had taken $351.6 million from its hot and warm wallets after a backend compromise; Elliptic judged the link highly likely, but no government has confirmed it.[10] Later tallies reached about $387–390 million. Bitget said its User Protection Fund covers the loss, and this row uses the first confirmed figure.[10]
#10
Wormhole — $326 million
On February 2, 2022, an attacker minted 120,000 wrapped ETH on the Solana–Ethereum bridge Wormhole without depositing the matching ether, about $320–326 million.[11] Jump Crypto replaced the 120,000 ETH within a day, so users were made whole, though the stolen funds were not recovered.[11]
Decrypt, “Biggest Crypto Hacks of All Time” (Bybit, Poly Network, BNB Chain, Coincheck, Ronin); Comparitech and Cointelegraph lists used as cross-checks. Rule used: US dollar value of the assets at the time of the theft (or, for Mt. Gox, its disclosure), not at today’s prices; amounts vary by source, so the figure shown is the one most outlets and the victim cite. Hacks counted are thefts and exploits of an exchange, bridge or protocol, not scams, rug pulls or thefts from individuals.
Bloomberg, “Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack Shakes Industry” (October 29, 2026); CNBC, “Binance hack: $6.3 billion stolen, $3 billion frozen” (October 30, 2026; TRM Labs and Chainalysis figures, attribution); CNN, NBC News and ABC News coverage of the same day. All figures preliminary.
NBC News and TechTarget on the FBI’s attribution of Bybit to TraderTraitor (February 2025); Bybit’s August 2026 lawsuit announcement via Decrypt (recovered and frozen amounts); Benzinga on the February 2025 freeze.
Decrypt on Ronin (Lazarus, US Treasury, ~$30 million seized September 2022); Forklog, “Ronin sidechain developers reveal further details of $625 million hack”.
CNBC, “Poly Network hacker behind $600 million crypto heist did it for fun” (August 12, 2021); Decrypt, “Poly Network Suffers Record-Breaking $600.3 Million Hack”.
NBC News, “Crypto exchange Binance suffers $570 million hack” (October 2022); Decrypt (BSC Token Hub, about $100 million siphoned off the chain).
Decrypt, “Japan officials to seize funds from $530 million Coincheck hack”; Dark Reading, “Hack Costs Coincheck Cryptocurrency Exchange $530 Million”; Security Affairs on the refund to customers.
Elliptic, “$477 million in unauthorized transfers from FTX” and “Three individuals implicated in the $477 million FTX heist”. FTX itself later cited $323 million out of FTX.com and $90 million out of FTX US, and Bloomberg reported $372 million; estimates differ.
Mt. Gox bankruptcy filing coverage (850,000 BTC, about $450 million then; 200,000 BTC found in March 2014), via Bloomberg (March 21, 2014) and Vice, “How Mt. Gox Imploded”.
TechCrunch, “North Korean hackers suspected in $351M crypto theft, the largest so far this year” (September 25, 2026); Bloomberg, “Bitget Says $351 Million Affected in Breach, Halts Withdrawals” (September 24, 2026); The Hacker News (September 2026).
The Block, “Wormhole replenishes its blockchain bridge after $325 million exploit”; Blockworks and Cointelegraph on Jump Crypto’s 120,000 ETH replacement; CNBC video with Jump Trading Group’s CIO.
Rows 11–17: The Record and Cointelegraph on DMM Bitcoin (FBI and Japan’s National Police Agency, December 2024); The Block and Decrypt on KelpDAO (April 2026; LayerZero attribution, Arbitrum freeze); TRM Labs, “North Korean Hackers Attack Drift Protocol in $285 Million Heist” (April 2026); Chainalysis on KuCoin and The Block on its 84% recovery; The Record and Forklog on WazirX; The Defiant and SecurityWeek on Cetus; TechRadar and Google Cloud (Mandiant) on Nomad. Beanstalk (April 2022, $182 million protocol value but about $76 million taken by the attacker) is left out under the stolen-value rule.
