On October 29, 2026, about $6.36 billion walked out of Binance in twenty minutes — the biggest crypto theft ever recorded, roughly four times the previous record. Binance says users are covered. Maybe. The refill receipt is public: the proof-of-reserves snapshot on November 1.
That pledge is the real story of every hack on this list. Because the stolen money almost never comes back — security firm Immunefi estimated only about 7.7% of hacked funds were recovered in 2024. What actually decided whether users lost everything was a different question: whose balance sheet absorbed the loss? An exchange that could borrow. A backer who wrote a check. A protection fund. Or nobody — and the users became creditors.
Here are the 14 biggest crypto hacks in history, ranked by US dollar value at the time of the theft, with the only scorecard that matters: who paid.
| # | Target | Date | Stolen (at the time) | Users paid back? |
|---|---|---|---|---|
| 1 | Binance | Oct 2026 | ~$6.36B | Pledged — Nov 1 PoR is the check |
| 2 | Bybit | Feb 2025 | ~$1.5B | Yes — Bybit borrowed it back |
| 3 | Ronin Bridge | Mar 2022 | ~$625M | Yes — venture raise + balance sheet |
| 4 | Poly Network | Aug 2021 | ~$611M | Yes — the hacker returned it |
| 5 | BNB Chain Token Hub | Oct 2022 | ~$570M minted | No user loss — forged coins |
| 6 | Coincheck | Jan 2018 | ~$530M | Yes — cash, at Coincheck's rate |
| 7 | FTX (post-bankruptcy drain) | Nov 2022 | ~$415–477M | No — absorbed by the estate |
| 8 | Mt. Gox | 2014 | ~$470M then | Partially — a decade later |
| 9 | Bitget | Sep 2026 | ~$388M | Yes — protection fund |
| 10 | Wormhole | Feb 2022 | ~$326M | Yes — Jump Crypto's check |
| 11 | Liquid Network | Sep 2026 | ~$319M | ~85% returned by the actors |
| 12 | DMM Bitcoin | May 2024 | ~$305–308M | Covered via acquisition wind-down |
| 13 | KelpDAO | Apr 2026 | ~$292M | Outcome unverified |
| 14 | Drift Protocol | Apr 2026 | ~$285M | Outcome unverified |
1. Binance — October 29, 2026 — ~$6.36 billion
A compromised DevOps engineer's laptop gave the attacker a path into a service container used to submit unauthorized withdrawals across 10 chains in about 20 minutes. On Ethereum, an EIP-7702 delegation turned the Binance 14 hot wallet into an attacker-controlled sweeper, using 50 pre-signed authorizations. TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea's state hacking unit; Binance has not confirmed the attribution and puts affected assets at ~$6.3 billion (Chainalysis estimates ~$5.9 billion stolen).
Who paid: About $2.7 billion was frozen by issuers — Tether (~$1.57B), Circle ($0.8B+), Ripple (~$0.2B) and others — but roughly $2.4 billion (420,000+ ETH and 18,270 BTC) is beyond any issuer's reach. Co-CEO Yi He pledged Binance covers all losses. The catch: the drained wallets were the same wallets behind Binance's October 1 proof-of-reserves, with ETH backing at ~94% until refilled. The November 1 snapshot is the receipt. Until then, "covered" is a promise, not a balance.
2. Bybit — February 21, 2025 — ~$1.5 billion
Over 400,000 ETH left a cold wallet during a routine transfer. The multisig wasn't broken — the signing screen was. Attackers compromised a developer machine at Safe{Wallet}, Bybit's third-party multisig provider, and injected code so Bybit's signers saw a legitimate-looking transaction and blind-signed a malicious one. The FBI attributed it to TraderTraitor within five days.
Who paid: The stolen funds were largely laundered away. Users never felt it anyway: withdrawals were never halted, and Bybit restored reserves to 100% within about 72 hours using bridge loans from partners. The exchange's credit absorbed the loss — a finance fact, not a crypto one.
3. Ronin Bridge — March 23, 2022 — ~$625 million
The bridge behind Axie Infinity needed 5 of 9 validator signatures. A fake LinkedIn job offer with a malware-laced PDF compromised a Sky Mavis engineer's machine and yielded four keys; a fifth came from an Axie DAO validator whose signing authority had been delegated during a 2021 traffic surge and never revoked. The drain went unnoticed for six days. The FBI and US Treasury attributed it to North Korea's Lazarus Group.
Who paid: About $30 million was eventually seized — the first recovery of North Korean stolen crypto. Users were made whole a different way: Sky Mavis raised a $150 million round led by Binance in April 2022 and covered the rest from its balance sheet. Users were saved by a fundraise, not by the protocol.
4. Poly Network — August 10, 2021 — ~$611 million
A contract flaw let the attacker reassign the "keeper" role of the bridge's cross-chain manager contract — in plain terms, they made themselves the authorized signer and told the bridge to pay out. The attacker styled himself "Mr. White Hat" and claimed it was done to expose the flaw.
Who paid: Nobody had to. The attacker returned essentially everything within about two weeks (Tether kept $33 million of frozen USDT frozen). One of only two top-tier hacks where the money mostly came back — and it came back because $611 million in traceable tokens turned out to be nearly impossible to spend. Traceability was the security model.
5. BNB Chain Token Hub — October 6, 2022 — ~$570 million minted
This one is a classification case: forged Merkle proofs tricked the bridge into minting 2 million BNB out of nothing. No user deposits were drained. Only about $100–137 million was moved off BNB Chain before validators halted the chain entirely, and the rest was blacklisted into irrelevance by a coordinated fork.
Who paid: No one — there was no user loss. But note how the fix worked: the chain got switched off by a small, coordinated validator set. The rescue was possible precisely because the chain is effectively permissioned.
6. Coincheck — January 26, 2018 — ~$530 million
Coincheck kept 523 million XEM in a single internet-connected hot wallet with no multisig. Malware did the rest. The hackers were never publicly identified, and the coins were never recovered. (Amusing footnote: the same XEM is worth only ~$10 million today — the rare hack whose loot depreciated.)
Who paid: Coincheck itself — about ¥46.3 billion (~$425 million) in cash to roughly 260,000 customers, at a fixed rate of ¥88.549 per XEM that Coincheck picked, below the theft-day value. A solvent company chose to pay, and even then it set the price. The reimbursement rate is part of the promise.
7. FTX post-bankruptcy drain — November 11–12, 2022 — ~$415–477 million
Hours after FTX filed for bankruptcy, its wallets started draining. This figure is only that drain — separate from the ~$8 billion fraud hole in the SBF case. For years the assumption was an insider. Then a DOJ indictment charged a US SIM-swap crew — Robert Powell, Carter Rohn, and Emily Hernandez — with the theft: per prosecutors, a fake ID at an AT&T store SIM-swapped an FTX employee's phone and harvested the authentication codes.
Who paid: The bankruptcy estate absorbed it, which means it was spread across creditors. FTX customers are being repaid from the estate's other recoveries — venture stakes and clawbacks — not from getting this money back. The most-suspected insider hack in crypto history was, per prosecutors, a phone-store con.
8. Mt. Gox — disclosed February 2014 — 850,000 BTC (~$470 million then)
The original. A slow, years-long drain of the hot wallet, undetected because the exchange's own accounting never reconciled against the blockchain. 850,000 BTC went missing — about 750,000 of it customers'. At today's prices that is roughly $65 billion, which is why ranking by value-at-the-time buries the biggest theft in bitcoin terms after Bitfinex.
Who paid: 200,000 BTC were "found" in an old wallet. Creditors entered civil rehabilitation, and repayments in BTC began in July 2024 — ten years later. The trustee's deadline was extended again on October 16, 2026, to October 31, 2027, and the estate still holds ~34,388 BTC. The grim punchline: Gox creditors are the only hacked users on this list who gained dollar value from the hack — because a court forced them to hold bitcoin for a decade.
9. Bitget — September 24, 2026 — ~$388 million
A zero-day in a third-party security product handed attackers high-privilege credentials, letting them push forged withdrawal commands through Bitget's own approval flow. The Mandiant and SlowMist root-cause reports ruled out private-key compromise; cold wallets were untouched. Chainalysis attributed the theft to North Korea-linked actors.
Who paid: Only ~$1.1 million was frozen — the money is effectively gone. Bitget's User Protection Fund absorbed it: a fund of over $464 million that lost more than half its value to one vendor's zero-day, then was refilled above $300 million with company capital within the week. The fund worked exactly as advertised. You can also watch what it cost: the protection fund is the product, so check its size against the hot wallets it insures.
10. Wormhole — February 2, 2022 — ~$326 million
A signature-verification bug in the bridge's Solana contract let the attacker spoof a guardian signature and mint 120,000 wETH with no ETH deposited on the other side.
Who paid: Jump Crypto, Wormhole's backer, deposited 120,000 real ETH the next day and restored backing 1:1 — users were whole within about 24 hours because a trading firm wrote the check. Epilogue: in February 2023, Jump and Oasis executed a court-ordered counter-exploit, using a previously unknown admin-multisig flaw in Oasis's own contracts to recover ~$140 million from the hacker's vaults. Saved by a bailout, partly recovered by exploiting a backdoor under a judge's order. Both halves of that sentence are the lesson.
11–14. The 2026 class (and one 2024 entry)
Liquid Network — Sep 2026 — ~$319 million. Classification disputed: the actors called themselves whitehats and returned ~85% (~3,400 BTC). Even in 2026, the second-biggest "recovery mechanism" on this list is the attacker's own decision to give the money back.
DMM Bitcoin — May 2024 — 4,502.9 BTC (~$305–308 million). Pure social engineering: a fake recruiter's "pre-employment test" script compromised an employee at Ginco, DMM's wallet vendor, and a stolen session cookie did the rest. The FBI and Japan's National Police Agency attributed it to TraderTraitor. The BTC was never recovered; DMM wound down and customer assets moved to SBI VC Trade — users exited through an acquisition, not a recovery.
KelpDAO — Apr 2026 — ~$292 million. The rsETH bridge leaned on a single-verifier design; subvert that one path and the bridge pays out. TRM Labs and LayerZero attributed it to TraderTraitor/Lazarus. As of this writing, no credible public accounting of recovered funds or user compensation exists — that absence is the finding.
Drift Protocol — Apr 2026 — ~$285 million. Months of social engineering, including in-person meetings, captured the governance approval path; the vaults drained in minutes. A project-commissioned investigation attributed it to North Korean actors. Recovery and compensation figures remain unverified in reputable reporting.
Special case: Bitfinex, 2016 — the biggest theft nobody ranks
Bitfinex lost 119,756 BTC in August 2016 — "only" ~$72 million then, about $9.2 billion at October 2026 prices. Its BitGo co-signing setup signed withdrawals without independent limits, so compromising Bitfinex's servers was enough despite the "multisig" label. Users took an immediate 36% socialized haircut and got BFX debt tokens; Bitfinex redeemed every token at par by April 2017. In 2022 the DOJ seized 94,643 BTC — its largest financial seizure ever — from Ilya Lichtenstein, who later pleaded guilty to being the original hacker. In 2025 a federal court ordered the seized bitcoin returned to Bitfinex, and the fight over whether it belongs to the company or the haircut users is still not fully settled. The haircut-then-repay playbook worked — and created a decade of litigation anyway.
The pattern: one country is behind half this list
Seven of the 14 ranked hacks carry a credible North Korea attribution — Binance (TRM, high confidence), Bybit (FBI), Ronin (FBI/Treasury), Bitget (Chainalysis), DMM Bitcoin (FBI/Japan), KelpDAO (TRM/LayerZero), and Drift (project investigation) — summing to roughly $9.8 billion at theft-time values. Below the cut, WazirX ($234.9M, 2024) drew a joint US/Japan/South Korea attribution, and Harmony's bridge ($100M, 2022) an FBI one. Chainalysis puts North Korea-linked theft at at least $6.75 billion cumulative through the end of 2025 — including a record $2.02 billion in 2025 alone — before Binance.
And notice the method, because it repeats: fake recruiters and job offers (Ronin; DMM through its vendor), a poisoned signing interface (Bybit), a supplier's zero-day (Bitget), months of relationship-building (Drift). In essentially none of the biggest hacks was a blockchain's cryptography broken. The playbook targets laptops, vendors, and people. Chainalysis separately found private-key compromises accounted for 43.8% of all crypto stolen in 2024.
The all-in number — and the WazirX warning
Chainalysis's annual totals put theft at $3.2B (2021), $3.7B (2022, the peak year), $1.8B (2023), $2.2B (2024), and over $3.4B in 2025 — more than $14 billion in five years, before 2026 added Binance and the rest. Just below this list sits the counterexample every user should know: WazirX (July 2024, $234.9M). No deep protection fund, a loss equal to roughly 40–45% of platform assets — and users were not made whole. Withdrawals froze for 463 days; a court-sanctioned scheme eventually distributed about 85% of claims at July 2024 prices, with the rest in non-tradable "recovery tokens." When the loss is bigger than the cushion, users turn into creditors. That is the branch of the fork Binance's November 1 snapshot will rule out — or won't.
The BogusAPY takeaway
Fourteen hacks, one recurring cast of rescuers: an exchange's credit line, a backer's check, a protection fund, a hacker's change of heart, a court's patience. Almost never the stolen coins themselves. So for any platform holding your money — especially one advertising a yield — the security questions are not about the blockchain. They are: who can freeze, who can cover, how big is the cushion next to the hot wallets, and what happens to you if the answer is nobody? Binance's answer gets graded on November 1. Check the snapshot.
Check it yourself: links and sources
- TRM Labs — Binance hack analysis (Oct 29, 2026): trmlabs.com/resources/blog
- FBI IC3 — Bybit attribution PSA (Feb 26, 2025) and FBI/DC3/Japan NPA joint DMM statement (Dec 23, 2024): ic3.gov and fbi.gov
- Chainalysis — Crypto Crime Reports and the Bitget attribution (Oct 1, 2026): chainalysis.com/blog
- DOJ — Bitfinex seizure and Lichtenstein/Morgan case (D.D.C.); FTX SIM-swap indictment (unsealed Jan 2024): justice.gov
- Elliptic — incident analyses (Bybit, Poly Network, FTX drain): elliptic.co/blog
- Bitget / Mandiant / SlowMist — root-cause reports (Sep 30, 2026): bitget.com
- Mt. Gox rehabilitation trustee notices (incl. the Oct 16, 2026 extension): mtgox.com
- Immunefi — 2024 recovery-rate estimate: immunefi.com
- CoinDesk and Reuters — Binance, Ronin, Wormhole and Coincheck coverage (2018–2026)
Amounts are US dollar values at the time of each theft unless stated otherwise; where credible sources disagree (Binance: $6.36B TRM vs ~$5.9B Chainalysis; FTX drain: $415–432M per the debtors vs ~$477M per Elliptic), both figures are shown. Checked October 30, 2026. Not financial advice.
Comments
Post a Comment