The 10 Biggest Crypto Hacks of 2026 (So Far)

on


Ten incidents, $8.23 billion out the door — and $6.36 billion of it left in a single night, from the biggest exchange on earth. This was supposed to be the year crypto security grew up. Audits are standard now, bug bounties run into the millions, monitoring dashboards watch every contract. None of it mattered much, because 2026's losses mostly did not come through the code. They came through a laptop, a vendor, a video call, a single bridge verifier. Count it up and roughly 93 cents of every dollar on this list traces back to a person, a key, or a supplier — not a smart contract bug.

Get posts like this by email: Subscribe to BogusAPY

Follow BogusAPY on X: @BogusAPY

How this ranking works

Each entry is ranked by US dollars lost at the moment of the incident, gross — before anything was recovered, returned, rolled back, or covered by an insurance fund. Gross is the honest measure of how big the hole was. What happened to the money afterwards is tracked separately in each entry's status line, because the aftermaths could not be more different: one attacker gave 85% back, one chain rewound its own history, and two of the biggest holes were quietly filled by the victim's own balance sheet.

Some context for the total. Security firm Hacken counted $482.6 million stolen in the first quarter of 2026, $764 million in the second, and $1.18 billion in the third — about $2.43 billion across the first nine months. CertiK's nine-month tally came in above $2.5 billion. Then October 29 happened, and one night at Binance added more than both of those nine-month totals combined.

One entry you might expect is deliberately missing. The much-shared "$44.6 million Aave hack" was not a hack of Aave at all: it was the Binance attacker parking stolen stablecoins on Aave and borrowing ether against them, fully collateralized, as a laundering step. It belongs inside the Binance entry below — counting it twice would flatter the list, not inform it.



The ten biggest crypto hacks of 2026 by US dollars lost at the time of the incident, gross — before recoveries, returns, and rollbacks. Log scale, because on a normal chart Binance eats everything else. Sources: incident post-mortems, Chainalysis, Elliptic, TRM Labs, Hacken, Galaxy Research; checked November 3, 2026.

#10 — Humanity Protocol (June 2026) — $31 million

Humanity Protocol, an identity project built around proving a user is a real person, kept its crown jewels on one computer. During the attack in June, investigators found that malware on a single developer's machine had exposed seven production private keys that had been backed up to that device a year earlier, during the mainnet launch: an admin hot-wallet key plus the owner keys for the project's Ethereum and BSC safes. With those keys the attacker upgraded the bridge contract to a malicious version, drained about 141 million H tokens, and separately minted roughly 300 million new H on BNB Chain — more than tripling the supply. The token fell over 80%. PeckShield and Hacken put losses at $31 million; CoinDesk counted more than $32 million across at least 17 wallets, and the team's own estimate ran to about $36 million.

Status: nothing recovered in any report we can find. The mainnet went offline, the minted BSC tokens were described as effectively unrecoverable while the attacker held admin control, and the founder has since steered the company toward enterprise AI.

#9 — Step Finance (January 2026) — $40 million

Step Finance was Solana's best-known portfolio dashboard, and it was killed by a video call. On January 31, attackers posing as venture capitalists got Step executives onto a call, staged audio problems, and talked them into installing a "fix" that was actually malware. The compromised devices exposed the private keys behind Step's treasury and fee wallets, and 261,854 SOL — about $40 million at Step's and Hacken's accounting — walked out. (CertiK's tally, using a different SOL price, came in lower, around $27–29 million.) Hacken attributes the operation to a North Korean cluster known for exactly this fake-VC playbook. The contracts were never the problem.

Status: about $4.7 million was clawed back early, and it was not enough. On February 23, Step announced it was winding down entirely — Step, its SolanaFloor media arm, and Remora Markets — with a snapshot-based buyback promised to STEP holders.

#8 — Coldcard wallets (July 2026) — $112.7 million

This one has no single victim and no single attacker, because the failure was manufactured into the product. A March 2021 firmware change at Coinkite broke the random-number path Coldcard hardware wallets used to create seed phrases: devices silently fell back to a weak substitute, and TRM Labs estimates the resulting keys carried about 40 bits of strength instead of 128 on the worst-affected models. Anyone could regenerate those "random" seeds offline — no stolen device, no PIN, no phishing required. When attackers started sweeping at scale on July 30, more than 1,082 BTC left in the first 41 minutes. Galaxy Research confirmed 1,778.84 BTC — $112.7 million — taken from over 8,600 addresses, and identified at least a dozen separate attackers racing each other through the same predictable seed space. Coinkite patched the firmware within a day of the sweep starting, but a patch cannot rescue a seed that was born guessable.

Status: the waves stopped after August 6, mostly because the vulnerable wallets were empty or had been moved. About 1,531 of the stolen BTC still sits untouched in attacker addresses. White-hat researchers pre-swept roughly 50 BTC into a recovery trust and returned over 20 BTC to one owner — but there is no fund and no reimbursement. The losses rest with thousands of individual owners.

#7 — Tectonic (August 2026) — $120.4 million

Tectonic was the biggest lending market on Cronos, and its attacker did not break anything — he just bought. TONIC, the protocol's own token, traded so thinly that its weekly volume was around $305,000. On August 30 the attacker pushed its price up roughly a hundredfold in about twenty minutes, and also inflated the collateral market's internal exchange rate by transferring TONIC straight into it. Against that pretend collateral, he borrowed $120.4 million of real assets across nine lending markets. The price feed was not lying, exactly; it was faithfully reporting a market one buyer could bend at will.

Status: the most aggressive undo of the year. Cronos validators halted the chain and rolled it back 10,961 blocks — erasing about 114 minutes of settled history, innocent transactions included — which reversed $111.2 million of the borrowing. The $9.19 million bridged to Ethereum before the halt is gone. Net loss: roughly $9.2 million, paid for with the chain's finality.

#6 — The hardware-wallet whale (January 2026) — $282 million

The largest theft on this list that touched no protocol at all. On the night of January 10, a long-term holder with 1,459 BTC and about 2.05 million LTC in cold storage took a support call. The caller was impersonating hardware-wallet support — the security firm ZeroShadow identified a fake "Value Wallet" support pretext — and talked the victim into revealing the recovery backup that undoes cold storage. Within hours the coins were moving into Monero through instant exchanges, in volumes large enough to visibly spike Monero's price, with other flows bridged across chains. Investigator ZachXBT put the total at over $282 million, the largest social-engineering theft ever recorded, comfortably past the $243 million record set in 2024.

Status: ZeroShadow managed to freeze about $700,000 — roughly 0.2%. The rest was laundered, largely into Monero, and no further recovery has been reported. No code failed here. A person was persuaded, and that was sufficient.

#5 — Drift Protocol (April 2026) — $285 million

Drift was Solana's largest perpetuals exchange, holding about $550 million, and its attackers played a six-month long game. Posing as a trading firm, they built genuine relationships with Drift contributors — including meeting them in person — and used Solana's durable-nonce feature to get members of Drift's Security Council to pre-sign transactions that later handed over admin control. On April 1 they whitelisted a worthless token of their own creation as collateral, inflated its oracle price, and drained the protocol in about twelve minutes. Chainalysis estimated $285 million; Drift's own asset-by-asset accounting came to roughly $295.7 million. Mandiant attributes the operation to a North Korean group tracked as UNC6862.

Status: about $9.2 million was frozen — 3% — and the attacker returned nothing, converting the haul to roughly 131,564 ETH and feeding it to Tornado Cash, most recently about $61.6 million on October 20. Users are instead being repaid slowly through DFX recovery tokens, funded by the protocol's relaunch as Velocity DEX in July and up to $147.5 million of backing from Tether and partners. Claims run until January 2028.

#4 — Kelp DAO (April 2026) — $292 million

Kelp's rsETH bridge ran on LayerZero with a 1-of-1 verifier setup: a single verifier network, and no independent second check that could refuse a bad message. Per LayerZero's own incident report, the compromise began on March 6, when attackers socially engineered a LayerZero developer, reached the RPC infrastructure behind the verifier, and poisoned its nodes. On April 18, with an external data provider knocked offline, the verifier trusted the poisoned nodes and attested a forged cross-chain message. The bridge released 116,500 rsETH — about $292 million — that had never been burned on the other side. The attacker then deposited much of the unbacked rsETH as collateral on Aave and borrowed roughly $190 million against it, leaving the biggest lending protocol in crypto holding the bag. LayerZero's investigators attribute the attack to North Korea's TraderTraitor group.

Status: the hole was filled socially, not recovered. An ecosystem effort dubbed DeFi United — Kelp itself put in 2,000 ETH, Lido about 2,500 ETH — closed the backing shortfall, and rsETH was fully re-backed by late May. Kelp moved the bridge to Chainlink CCIP, absorbed over $650 million in user withdrawals, and in September sued LayerZero, alleging LayerZero had reviewed and endorsed the exact single-verifier setup in writing. LayerZero calls the claim meritless.

#3 — Liquid Network (September 2026) — $320 million

The year's purest code failure happened on a Bitcoin sidechain. Liquid, the federated network built by Blockstream, runs on the Elements codebase, and Elements had a flaw in how it cached rangeproof verification — the cryptographic checks that keep hidden transaction amounts honest. A cache collision could make an invalid proof pass as one that had already been verified. The bug existed in every version before 23.3.4; a fix had been merged days earlier, but federation nodes were still running the old release. On September 6 the attacker used the collision to create 3,998.5 L-BTC backed by nothing, then redeemed it through the normal peg-out for real bitcoin: roughly 4,000 BTC, about $320 million, some 95% of the federation's reserve, gone in minutes.

Status: the strangest negotiation of the year. The attackers left an on-chain message declaring themselves whitehats and, once the bug was patched, returned about 3,400 BTC — roughly $272 million, or 85% — on September 7. They kept 598.5 BTC, about $47 million, and demanded a further 10% bounty to return the rest. Blockstream refused to pay. The network restarted on September 10; the $47 million remains outstanding, and whether its holders are researchers or thieves is, charitably, unsettled.

#2 — Bitget (September 2026) — $388 million

Bitget's breach never touched Bitget's own code or its private keys. According to the exchange and the independent Mandiant and SlowMist investigations that followed, the attacker exploited a zero-day vulnerability in a third-party security product Bitget used, harvested high-privilege internal credentials, and on September 24 used them to insert fraudulent withdrawal commands directly into the wallet backend — bypassing the risk controls entirely, then deleting traces of the commands. Two small test transfers slipped under alert thresholds at 18:31 UTC; about seventeen large ones followed across eleven chains, draining twelve hot and warm wallets. Bitget's reconciliation system caught the discrepancy at 19:05 and automatically blocked withdrawals. Chainalysis attributes the theft to North Korean actors.

Status: users lost nothing. The final verified tally was about $388 million, and Bitget's Protection Fund — 5,500 BTC, worth over $464 million — absorbed all of it; withdrawals were fully restored by October 2. The stolen funds themselves have not been reported recovered, and tracing continues. This was the first security incident in Bitget's eight years of operation.

#1 — Binance (October 2026) — $6.36 billion

On October 29, starting around 20:05 UTC, the largest theft in recorded history unfolded in about twenty minutes. TRM Labs counts $6.36 billion leaving Binance wallets across ten blockchains; Elliptic counts $6.43 billion across eleven; Binance's own estimate is about $6.3 billion. Binance's initial account pointed to a compromised DevOps engineer's laptop reaching a service container that could submit withdrawal transactions; the exchange has since said it found additional points of breach, and its full technical post-mortem is still not public. TRM's on-chain work identified abuse of Ethereum's EIP-7702 delegation feature among the mechanics. The laundering was industrial: Elliptic tracked the loot across some 12,000 wallets and more than 40,000 transactions in under three days — including the attacker parking 60 million stolen USDT on Aave to borrow $44.6 million of ether, swapping a freezable asset for one nobody can freeze. On October 31 the FBI attributed the theft to North Korea's TraderTraitor group; Pyongyang denied it on November 3, and Elliptic publicly rejected the denial.

Status: about $2.85 billion — 44% — has been frozen or seized, almost all of it stablecoins (Tether froze over $1.56 billion of USDT; Circle over $800 million of USDC). Roughly $3.3 billion remained in attacker-controlled wallets as of November 2, with mixing already under way. For users, Binance says the loss is the company's: it set aside more than $6.34 billion from its SAFU fund and corporate resources, reported 98% of affected assets replaced by November 3, published a user-verifiable proof of reserves for its October 31 snapshot showing the ten biggest tokens backed at 100% or better, and reopened withdrawals in phases from November 1. Whether the coverage holds is checkable. Where the stolen crypto ends up is still an open chase.

What this list actually says

Read the ten root causes in a row and the year's lesson is uncomfortable for an industry that sells audits. Seven of the ten failures started with a person, a key, or a vendor: an engineer's laptop at Binance, a security supplier at Bitget, a socially engineered developer and a one-verifier bridge at Kelp, a six-month con at Drift, a phone call to one whale, a fake investor call at Step, seven keys on one infected machine at Humanity. By value, that is about $7.68 billion of the $8.23 billion total. The three genuine code-and-design failures — Liquid's cache bug, Coldcard's broken randomness, Tectonic's bendable thin market — split what is left. Hacken's quarterly data tells the same story at industry scale: in the second quarter, smart-contract bugs were the most common incident type but produced only about 11% of the losses, while compromised keys, signers, and infrastructure produced 88.3%.

The most-audited failure of the year did not even make this list. Resolv Labs had been through eighteen audits and still lost roughly $23–25 million in March when one cloud signing key was enough to mint $80 million of unbacked stablecoins — it ranks eleventh here. Audits review the code. The attackers reviewed the org chart.

For yield, the translation is blunt. A 20% APY is a claim about a system's future; an exploit is a claim on its present, and the present wins. One bad night is a 100% loss that no plausible yield outruns, which is why the questions that matter are the boring operational ones. Who holds the admin keys, and how many people have to agree before they move? If the bridge has one verifier, the bridge is one person. How big is the bug bounty next to the value it protects — note that 10% is becoming the going rate attackers demand, from Liquid's retained $47 million to Drift's posted recovery bounty. Has the protocol been hit before, and what actually changed afterwards? The venues that came through 2026 untouched are not the ones with the cleverest code; our Kraken review covers an exchange whose clean record is built on exactly that boring operational discipline. It is also why the Scoreboard scores every yield by where the money actually comes from, and why any staking or lending plan is worth running through the Yield Calculator next to a simple stress test: subtract one total loss, once, and see what is left of the yield. In 2026, that was not a paranoid scenario. It was the median outcome at the top of this list.

Check it yourself: links and sources

Key sources, all checked November 3, 2026: Elliptic and TRM Labs on the Binance theft; Binance's and Bitget's official incident and recovery updates; Mandiant and SlowMist investigation findings as reported; Chainalysis estimates for Drift ($285M) and Resolv (~$23M); LayerZero's Kelp incident report and Aave's governance incident report; Galaxy Research's Coldcard tally (1,778.84 BTC, $112.7M confirmed); the Cronos post-mortem on Tectonic via Certora and Nexus Mutual; Hacken's Q1, Q2 and Q3 2026 security reports; PeckShield's Humanity Protocol tally ($31M); ZachXBT's and ZeroShadow's reconstruction of the January 10 social-engineering theft ($282M). Where sources disagreed on an amount, this post uses the more conservative widely reported figure and the ranking counts gross losses at the time of each incident, before recoveries.

Not financial advice.

Comments

Post a Comment