Crypto Hacks
The biggest crypto hacks of all time
The ten largest crypto hacks ever, then the top 10 of every year since 2015, ranked by the dollar value taken, with what each year cost in total.
Last updated · Data last changed · Checked daily
Top 10 biggest crypto hacks of all time
1
Binance
Oct 29, 2026CEXEthereumBitcoinTRON+4 chains$6.36BAttackers gained access to Binance’s internal systems and signing privileges, then made unauthorized withdrawals across multiple blockchains. Some stolen assets were frozen or intercepted, and Binance said it would cover the losses.
Our coverage: Binance’s Fake Job Interview Used One Trust-building TrickSourceRekt report
2
LuBian
Dec 28, 2020OtherBitcoin$3.5BAn attacker exploited weak key generation in LuBian’s infrastructure to guess private keys and steal 127,426 BTC from its mining pool.
3
Bybit
Feb 21, 2025CEXEthereum$1.4B returned$1.4BAttackers tricked Bybit signers into approving a masked transaction that changed the hot wallet’s security rules, using a spoofed Safe interface. This enabled the theft of over $1.4 billion in ETH and other assets.
4
BeautyChain
Apr 22, 2018TokenEthereum$1BAn integer overflow in BeautyChain’s batchTransfer function let attackers create an enormous number of BEC tokens, which they sent to two addresses and sold. Exchanges later halted BEC and SMT trading, limiting the loss.
5
Ronin Network
Mar 23, 2022DeFi ProtocolBridgeEthereum$624MAttackers obtained enough Ronin validator keys to approve fake bridge withdrawals, taking 173,600 ETH and 25.5 million USDC. The breach was discovered six days later.
Our coverage: Largest-Ever DeFi Hack: $624M Stolen From Ronin NetworkSourceRekt report
6
Poly Network
Aug 10, 2021DeFi ProtocolBridgeEthereumBSCPolygon$611MAttackers exploited access-control and cryptography flaws in Poly Network’s cross-chain bridge contracts, taking over $610 million across Ethereum, BSC and Polygon. The attacker later returned nearly all the funds, keeping only transaction fees.
7
BNB Bridge
Oct 6, 2022DeFi ProtocolBridgeBSC$570MAn incomplete check of Merkle proofs in BNB Chain’s Token Hub bridge let an attacker forge proofs and mint 2 million BNB. The chain was paused; about $137 million was moved out before the attack was contained, while $433 million remained frozen.
8
Coincheck
Jan 26, 2018CEXNEM$534MAttackers stole customers’ NEM coins from Coincheck’s internet-connected hot wallet, which used a single key rather than requiring multiple approvals. The exchange began reimbursing affected customers.
Our coverage: CoinCheck Hacking Brings Consumer Protection To The ForeSource
9
Vires Finance
Apr 5, 2022$530MVires Finance suffered reported losses exceeding $530 million, but the description does not establish how the funds left. Its founder denied allegations that his wallet was linked to the outflow.
Our coverage: “Infamous” Vires Finance Governance Vote FailedSource
10
MtGox
Feb 7, 2014CEXBitcoin$470MAttackers gained access to Mt. Gox’s hot wallet and siphoned bitcoins over several years. About 850,000 BTC belonging to customers and the company went missing.
Crypto stolen in hacks, per year
Top 10 crypto hacks of 2026
$9.04B stolen in 440 incidents
1
Binance
Oct 29, 2026CEXEthereumBitcoinTRON+4 chains$6.36BAttackers gained access to Binance’s internal systems and signing privileges, then made unauthorized withdrawals across multiple blockchains. Some stolen assets were frozen or intercepted, and Binance said it would cover the losses.
Our coverage: Binance’s Fake Job Interview Used One Trust-building TrickSourceRekt report
2
Bitget
Sep 24, 2026CEXEthereumXRPTron+1 chains$387MAttackers used access obtained through a third-party security product to issue fraudulent withdrawal commands from Bitget hot and warm wallets. About $387.5 million was transferred to attacker-controlled addresses; Bitget said private keys and cold wallets were not compromised and the incident was contained.
3
Liquid Network
Sep 6, 2026ChainBridgeLiquid$320MA vulnerability in Liquid’s underlying Elements software let an attacker create unbacked L-BTC and use SideSwap’s normal withdrawal service to make the federation release about 3,996 BTC. The attacker later returned 3,400 BTC and retained about 598.5 BTC; no keys were compromised.
4
Drift Protocol
Apr 1, 2026DeFi ProtocolSolana$295MAttackers tricked Drift Protocol security council members into pre-signing transactions that gave them administrative control. They listed a worthless fake token as collateral, deposited it, and withdrew about $285 million in real assets.
5
Kelp DAO
Apr 18, 2026DeFi ProtocolBridgeEthereumArbitrum$293MAttackers compromised RPC nodes used to verify Kelp DAO’s rsETH bridge messages and made the single-verifier setup accept forged messages. This enabled about $290 million in losses; LayerZero said its protocol and other applications were not affected.
6
Crédit Mutuel Arkéa
Nov 1, 2026$133MAn attacker accessed a third-party service provider’s platform and used Crédit Mutuel Arkéa’s accounts to transfer funds to other financial institutions; some may later have been converted to cryptocurrency. The bank said customer assets were unaffected, while the final loss remained under assessment.
7
Tectonic
Aug 30, 2026DeFi ProtocolCronos$124MThe attacker repeatedly borrowed and redeposited TONIC, then sent TONIC directly to its receipt-token contract to inflate the collateral value; an unreliable price feed compounded the effect. Tectonic’s lending markets lost about $120 million, but a Cronos rollback recovered most of it; about $9.19 million remains unrecovered.
8
Coldcard
Jul 31, 2026WalletBitcoin$116MA Coldcard firmware flaw bypassed the hardware random-number generator during seed creation, leaving some wallet keys weak enough to guess offline. Attackers used this to drain bitcoin from many addresses without accessing the devices.
9
Ledger (Supply Chain)
Oct 9, 2026Wallet$93MGenuine Ledger hardware wallets were secretly modified to capture recovery phrases during setup and send them over cellular connections. Attackers used the phrases to access and drain customers’ crypto; Ledger said its core systems were not compromised.
10
Nesa
Aug 24, 2026ChainNesa$50MNesa confirmed an exploit involving a Cosmos EVM vulnerability, and reports said an attacker bridged 257.7 million NES to Ethereum. Nesa did not publish transaction-level details of the exploit; the reported mechanism resembles a balance-accounting bug affecting other Cosmos EVM chains.
Top 10 crypto hacks of 2025
$2.8B stolen in 252 incidents
1
Bybit
Feb 21, 2025CEXEthereum$1.4B returned$1.4BAttackers tricked Bybit signers into approving a masked transaction that changed the hot wallet’s security rules, using a spoofed Safe interface. This enabled the theft of over $1.4 billion in ETH and other assets.
2
Cetus
May 22, 2025DeFi ProtocolSui$223MA math error in Cetus’s liquidity calculations let attackers create positions showing large amounts of fake liquidity with minimal deposits, then withdraw real pool assets. Sui validators froze some of the funds, while others escaped.
3
Balancer V2
Nov 3, 2025DeFi ProtocolEthereumArbitrumBase+3 chains$128MA rounding flaw in Balancer V2’s stable-pool swap calculations let attackers manipulate pool values and withdraw assets for far less than they were worth. The exploit affected pools across several chains; mitigation efforts protected or recovered some funds.
4
Bitget
Apr 20, 2025CEX$100MBitget’s market-making bot entered a predictable trading loop on the VOXEL/USDT futures pair. Traders used high leverage to extract about $100 million before Bitget froze accounts and rolled back trades.
5
Phemex
Jan 23, 2025CEXEthereumSolanaXRP+10 chains$85MAttackers compromised Phemex’s hot-wallet private keys and signing systems, draining wallets across multiple blockchains. Reported losses ranged from about $69 million to $85 million.
6
Nobitex
Jun 18, 2025CEXTronEthereumBSC+4 chains$82MCompromised hot-wallet keys let attackers steal roughly $82–90 million from Nobitex across multiple blockchains. The attackers sent the stolen assets to inaccessible addresses, destroying rather than keeping them.
7
UPCX
Apr 1, 2025DeFi ProtocolEthereum$70MUsing a compromised private key, an attacker upgraded UPCX’s ProxyAdmin contract and used an admin withdrawal function to move 18.4 million UPC from three management accounts. UPCX later said it still controlled the tokens while it investigated.
8
Infini
Feb 24, 2025DeFi ProtocolEthereum$49.5MA former Infini developer who retained vault-draining privileges used admin access to drain the contract. The stolen USDC was converted into ETH.
9
BtcTurk
Aug 14, 2025CEXEthereumAvalancheArbitrum+4 chains$48MBtcTurk’s hot wallets were hit across seven blockchains after private keys were compromised, with reports estimating losses in the tens of millions of dollars. The exchange acknowledged unusual wallet activity and suspended deposits and withdrawals.
10
CoinDCX
Jul 19, 2025CEX$44.2MA server breach exposed the private key for CoinDCX’s operational hot wallet, and the attacker stole about $44 million in corporate funds, moving assets from Solana to Ethereum. Customer funds in cold storage were unaffected.
Top 10 crypto hacks of 2024
$1.95B stolen in 417 incidents
1
DMM Bitcoin
May 31, 2024CEXBitcoin$305M returned$305MAttackers compromised a DMM Bitcoin employee and intercepted legitimate transactions to drain the exchange’s hot wallet, taking about 48.2 billion yen worth of bitcoin.
2
PlayDapp
Feb 9, 2024DeFi ProtocolEthereum$290MAfter PlayDapp’s deployer key was compromised, an attacker added themselves as a PLA token minter and minted large quantities of tokens in two transactions. PlayDapp later paused the token contract.
3
WazirX
Jul 18, 2024CEXEthereum$235MAttackers compromised a WazirX multisignature wallet held with Liminal, causing a loss of more than $230 million in tokens. A multisignature wallet requires approval from multiple signers to move funds.
4
Chris Larsen
Jan 31, 2024$113MUnauthorized access to Chris Larsen’s personal XRP accounts led to the theft of 213 million XRP. Some affected addresses were frozen after exchanges were notified.
5
Munchables
Mar 26, 2024GamingBlast$62.5MA developer used control of Munchables’ upgradeable proxy—a contract that can be updated—to assign themselves funds and drain about $62.5 million. The developer later returned the funds, which were secured in a multisig wallet.
6
BitForex
Feb 23, 2024$56.5MBitForex experienced suspicious fund outflows across multiple blockchains, after which the exchange restricted access and stopped processing withdrawals. The reports describe a suspected exit scam, but do not confirm who took the funds or what happened to them.
7
BtcTurk
Jun 22, 2024CEX$54MAttackers compromised private keys to BtcTurk’s hot wallets and stole cryptocurrency, mainly targeting Avalanche holdings. Binance froze $5.3 million in recovered funds, and the exchange halted deposits and withdrawals while investigating.
8
Radiant Capital
Oct 16, 2024DeFi ProtocolBSCArbitrum$50MAttackers used malware to compromise devices belonging to three Radiant contributors, then deceived multisig signers into approving malicious transactions that gave the attackers control of lending markets on BNB Chain and Arbitrum, which they drained.
9
Hedgey
Apr 19, 2024DeFi ProtocolArbitrumEthereum$44.7MAttackers exploited missing checks in Hedgey’s `createLockedCampaign` function, using flash loans to bypass access controls and create fraudulent approvals. Vault funds were stolen from the Ethereum and Arbitrum networks.
10
BingX
Sep 20, 2024CEXEthereum$43.3MAttackers breached BingX’s hot wallets and drained about $43 million in cryptocurrency. BingX said it would reimburse affected users from its reserves.
Our coverage: BingX Promises User Compensation After $43 Million HackSourceRekt report
Top 10 crypto hacks of 2023
$1.84B stolen in 402 incidents
1
Mixin Network
Sep 23, 2023OtherMixin$200MAttackers breached a cloud provider’s database containing Mixin Network hot-wallet credentials and drained wallets holding ETH, BTC, and USDT, with about $200 million involved.
Our coverage: Mixin Network Suspends Withdrawals Following $200 Million Loss In HackSourceRekt report
2
Euler Finance
Mar 13, 2023DeFi ProtocolEthereum$240M returned$197MAn attacker used flash loans and a flaw in Euler’s reserve-donation and liquidation logic to drain DAI, USDC, stETH, and WBTC. The attacker later returned all the stolen funds.
3
Poloniex
Nov 10, 2023CEXTronEthereumBitcoin$126MAttackers compromised Poloniex hot-wallet private keys, draining funds across Ethereum, Tron, and Bitcoin. The cause was reported as possibly malware or social engineering, and Justin Sun committed to full reimbursement.
4
Multichain
Jul 7, 2023DeFi ProtocolBridgeMoonriverBSCFantom$126MAbout $126 million in assets were withdrawn from Multichain bridge reserves on Fantom, Moonriver and Dogechain. The team said it did not know what had happened and urged users to stop using the service.
5
Atomic
Jun 3, 2023WalletEthereumTronBSC+3 chains$100MAtomic Wallet users lost funds after the wallet application was compromised. Reports described about 5,500 affected wallets, but the cause had not been officially confirmed.
6
HTX & Heco
Nov 22, 2023DeFi ProtocolBridgeEthereum$86.6MThe HECO Chain bridge to Ethereum and HTX were hacked after an operator account was compromised, allowing unauthorized withdrawals. Reports differed on the combined losses, and the funds’ destination is not specified.
7
Orbit Chain
Dec 31, 2023DeFi ProtocolBridgeEthereum$81.7MAttackers compromised seven of Orbit Bridge’s ten multisig signers’ private keys, allowing them to forge withdrawal approvals and drain the Ethereum vault. Orbit Chain asked exchanges to freeze the stolen assets.
8
Curve Finance
Jul 30, 2023DeFi ProtocolEthereum$61.7MA bug in Vyper’s reentrancy locks, which are meant to block repeated contract calls, let attackers drain several Curve pools. Some of the stolen funds were later returned.
9
Alphapo
Jul 26, 2023CEXEthereumTron$60MAlphapo’s hot-wallet keys were compromised, and attackers drained funds across Ethereum, Tron and Bitcoin. The stolen cryptocurrency was moved between networks, and the total reported loss reached about $60 million.
10
CoinEx
Sep 12, 2023CEXEthereumBSCBitcoin+9 chains$55MAttackers accessed CoinEx’s hot-wallet private keys and drained funds across multiple blockchains. Loss estimates ranged from $31 million to $70 million; CoinEx suspended deposits and withdrawals while it investigated.
Our coverage: CoinEx Exchange Suspected Of Being HackedSourceRekt report
Top 10 crypto hacks of 2022
$4.39B stolen in 307 incidents
1
Ronin Network
Mar 23, 2022DeFi ProtocolBridgeEthereum$624MAttackers obtained enough Ronin validator keys to approve fake bridge withdrawals, taking 173,600 ETH and 25.5 million USDC. The breach was discovered six days later.
Our coverage: Largest-Ever DeFi Hack: $624M Stolen From Ronin NetworkSourceRekt report
2
BNB Bridge
Oct 6, 2022DeFi ProtocolBridgeBSC$570MAn incomplete check of Merkle proofs in BNB Chain’s Token Hub bridge let an attacker forge proofs and mint 2 million BNB. The chain was paused; about $137 million was moved out before the attack was contained, while $433 million remained frozen.
3
Vires Finance
Apr 5, 2022$530MVires Finance suffered reported losses exceeding $530 million, but the description does not establish how the funds left. Its founder denied allegations that his wallet was linked to the outflow.
Our coverage: “Infamous” Vires Finance Governance Vote FailedSource
4
FTX
Nov 12, 2022CEXEthereumSolana$450MFTX’s crypto wallets were compromised during the company’s bankruptcy, and more than $600 million in assets was reported stolen. Reports differed on the amount and how the wallets were accessed.
5
Wormhole
Feb 2, 2022DeFi ProtocolBridgeSolana$326M returned$326MAttackers exploited outdated signature verification on Wormhole to mint 120,000 wrapped ETH on Solana without locking equivalent ETH on Ethereum, then exchanged it for real ETH.
6
Nomad
Aug 1, 2022DeFi ProtocolBridgeEthereum$190MA setup error made Nomad’s bridge accept messages without verifying them, allowing attackers to forge instructions and drain about $190 million. More than $36 million was later returned.
7
Beanstalk
Apr 17, 2022DeFi ProtocolEthereum$181MAn attacker borrowed funds to gain enough temporary voting power to pass malicious Beanstalk proposals, then drained protocol assets. They also sent funds to a Ukraine charity; reports differ on the total stolen and how much the attacker kept.
Our coverage: Can Beanstalk Recover From The Most Recent DeFi Hack?SourceRekt report
8
Wintermute
Sep 20, 2022OtherEthereum$160MAttackers derived Wintermute’s DeFi wallet key by exploiting a weak seed used by the Profanity vanity-address generator, which creates custom wallet addresses. The compromised wallet held funds for DeFi operations; other operations were not affected.
9
Mango
Oct 11, 2022DeFi ProtocolSolana$115MThe attacker used large MNGO purchases to inflate the token’s price reported by price feeds, making their collateral appear far more valuable. They then borrowed and withdrew about $100 million in assets from Mango’s lending pools.
10
Elrond
Jun 5, 2022DeFi ProtocolElrond$113MA newly added blockchain function let an attacker create and take nearly 1.65 million EGLD, converting some into unbacked WEGLD. The team recovered and burned the illegal tokens, and said nearly all stolen funds were recovered.
Top 10 crypto hacks of 2021
$3.13B stolen in 236 incidents
1
Poly Network
Aug 10, 2021DeFi ProtocolBridgeEthereumBSCPolygon$611MAttackers exploited access-control and cryptography flaws in Poly Network’s cross-chain bridge contracts, taking over $610 million across Ethereum, BSC and Polygon. The attacker later returned nearly all the funds, keeping only transaction fees.
2
BitMart
Dec 4, 2021CEXEthereumBSC$196MAttackers compromised BitMart’s Ethereum and BNB Chain hot wallets and stole cryptocurrency from them. Other wallets were reported unaffected.
Our coverage: BSC Wallets Compromised As Well – Damages In The Bitmart Hack Grow To 196 Million USDSourceRekt report
3
Compound
Sep 29, 2021DeFi ProtocolEthereum$147MAn off-by-one error in Compound V2’s COMP distribution logic caused users to claim far more tokens than intended after a governance proposal took effect. Deposits and borrowed funds were reported not to be at risk.
4
Vulcan Forged
Dec 13, 2021DeFi ProtocolEthereumPolygon$140MAn attacker compromised Venly’s semi-custodial servers and obtained credentials to access Vulcan Forged users’ wallets, stealing more than 4.5 million PYR. The project later returned most or all of the stolen tokens to affected wallets.
5
BXH
Oct 30, 2021DeFi ProtocolBSC$139MAn attacker obtained BXH’s administrative private key and used it to authorize a transaction transferring tokens from the protocol’s Binance Smart Chain assets to the attacker’s account. The reported amount was $139 million.
6
Cream Finance
Oct 27, 2021DeFi ProtocolEthereum$130MAttackers used flash loans to manipulate the price of yUSD and exploit accounting across Cream Finance’s connected lending and trading protocols. They created unbacked tokens and took about $130 million in assets.
7
BadgerDAO
Dec 2, 2021DeFi ProtocolEthereum$120MAn attacker used a compromised Cloudflare API key to add malicious code to BadgerDAO’s website, tricking users into approving token transfers. Assets were taken from about 200 accounts, including bitcoin and ether.
8
Venus
May 18, 2021DeFi ProtocolBSC$100MAn attacker drove up XVS’s price on exchanges, then used the inflated token as collateral to borrow large amounts of Bitcoin and Ether from Venus. The price later fell, leaving the protocol with about $77 million in losses.
9
Liquid
Aug 19, 2021CEXEthereum$91.4MAttackers compromised Liquid Global’s warm wallets, using information from a previous breach to break into its MPC wallet system. They stole various cryptocurrencies, and the exchange suspended deposits and withdrawals while investigating.
10
Mirror Protocol
Oct 8, 2021DeFi ProtocolTerra$90MAttackers exploited a flaw in Mirror Protocol’s collateral-unlock logic, using duplicate IDs to unlock more collateral than they were entitled to. They drained about $89.7 million before the exploit was detected.
Top 10 crypto hacks of 2020
$4.42B stolen in 111 incidents
1
LuBian
Dec 28, 2020OtherBitcoin$3.5BAn attacker exploited weak key generation in LuBian’s infrastructure to guess private keys and steal 127,426 BTC from its mining pool.
2
KuCoin
Sep 29, 2020CEXEthereum$281MAttackers obtained the keys to KuCoin’s hot wallets and stole cryptocurrency, including Bitcoin and tokens. KuCoin recovered most of the funds through tracking, contract changes, and law enforcement cooperation, and said it would cover users’ losses.
3
YFValue
Aug 24, 2020$170MA flaw in YFValue’s staking pool let malicious users reset the pool’s timer. The team said funds worth about $170 million were at risk of being locked, and an attacker tried to use the flaw to blackmail it; no funds were reported stolen.
4
Compounder.Finance
Dec 1, 2020$80MCompounder.Finance project owners transferred large amounts of tokens to their own accounts, causing the project to lose tokens worth about 80 million yuan.
5
Saffron Finance
Nov 30, 2020$50MA flaw in Saffron Finance’s redemption contracts left deposits from its first cycle locked for eight weeks. The team was working on a fix and a transition to the next cycle.
6
Josh Jones
Feb 22, 2020$45MJosh Jones had about $45 million in digital currency stolen after his SIM card was hacked.
7
Ravencoin
Jul 3, 2020$40MA vulnerability in Ravencoin allowed unknown parties to create extra RVN, amounting to 1.5% of the planned total supply. The tokens may have been sold, but the report does not give a confirmed loss amount.
8
Lendf.Me
Apr 19, 2020DeFi ProtocolEthereum$25MAn attacker exploited a reentrancy flaw in Lendf.Me, repeatedly moving tokens before the protocol updated its balances, and stole funds. Law enforcement and exchanges helped recover the funds within days.
9
Harvest Finance
Oct 26, 2020DeFi ProtocolEthereum$24MAn attacker used a flash loan to manipulate prices in Curve’s stablecoin pool, repeatedly minting and redeeming Harvest Finance tokens to drain funds. The attacker later returned about $2.5 million, reducing users’ losses.
10
Electrum
Oct 12, 2020$22MHackers stole Bitcoin from Electrum wallet users by tricking them into installing fake software updates. Older versions of the app remained vulnerable.
Top 10 crypto hacks of 2019
$277M stolen in 119 incidents
1
Upbit
Nov 27, 2019CEXEthereum$49.3MAttackers compromised Upbit’s Ethereum hot wallet and stole 342,000 ETH. The exchange froze deposits and withdrawals, moved its remaining hot-wallet funds to cold storage, and said it would cover the loss.
Our coverage: Hackers Steal Almost 50 Million Dollars From UpBitSource
2
Binance
May 7, 2019CEXBitcoin$40MAttackers obtained Binance user credentials and other information through methods including phishing and malware, then withdrew 7,000 BTC. Binance reimbursed affected customers from its insurance fund.
Our coverage: Binance Hack: What Went Wrong And Where They Stand?Source
3
CoinBene
Mar 25, 2019CEXEthereum$40MCoinbene’s hot wallet was compromised, and ERC-20 tokens were drained to unknown addresses. Reports described large amounts of Coinbene and Maximine tokens being stolen and sold.
4
BitPoint
Jul 12, 2019CEXBitcoinEthereumLitecoin+1 chains$27.6MAttackers breached BitPoint’s hot wallets and stole several cryptocurrencies, including BTC, BCH, ETH and LTC. The exchange later recovered some funds from overseas platforms and reimbursed customers.
5
Coinbin
Feb 20, 2019CEXEthereum$26MCoinbin’s former CEO stole more than 100 ETH from an Ethereum wallet, claiming the key had been lost. Employee embezzlement and growing debts left the exchange filing for bankruptcy.
6
Bithumb
Mar 29, 2019CEXEthereumRipple$19MBithumb’s internet-connected wallet was accessed using private keys, and EOS and XRP were stolen; reports differed on the amount of EOS taken. The exchange suspected insider involvement, and said customer funds were in cold storage.
Our coverage: Bithumb Experienced Major Hack Costing Over $19M Worth In CryptosSource
7
Cryptopia
Jan 14, 2019CEXEthereum$16MAttackers compromised Cryptopia’s hot-wallet keys and made unauthorized transfers, stealing cryptocurrency from customer holdings. The exchange later reported another breach and theft before entering liquidation.
8
Kraken
Jun 2, 2019CEXBitcoin$10.5MA hacker took control of a large Kraken account, then sold 1,200 BTC into a thinly traded BTC/CAD market, driving down the price and triggering liquidations of other users’ positions. The hacker reportedly gained about $10.45 million from those liquidations.
9
GateHub
Jun 6, 2019CEXRipple$9.5MAttackers gained access to GateHub API permissions and stole 23.2 million XRP from about 100 user accounts; users’ private keys were reported secure. About 13.1 million XRP was laundered through exchanges before recovery efforts.
10
CoinTiger
Aug 17, 2019CEXEthereum$9.2MAttackers breached CoinTiger’s cold wallet, which lacked multi-signature protection, and stole PTT tokens. Some entered markets and drove the price down, while the Proton Chain project froze others.
Top 10 crypto hacks of 2018
$2.33B stolen in 84 incidents
1
BeautyChain
Apr 22, 2018TokenEthereum$1BAn integer overflow in BeautyChain’s batchTransfer function let attackers create an enormous number of BEC tokens, which they sent to two addresses and sold. Exchanges later halted BEC and SMT trading, limiting the loss.
2
Coincheck
Jan 26, 2018CEXNEM$534MAttackers stole customers’ NEM coins from Coincheck’s internet-connected hot wallet, which used a single key rather than requiring multiple approvals. The exchange began reimbursing affected customers.
Our coverage: CoinCheck Hacking Brings Consumer Protection To The ForeSource
3
Gate
Apr 21, 2018CEX$235MAttackers compromised Gate.io’s private keys and drained Bitcoin, Ethereum, Dogecoin, and other tokens from the exchange. The breach was not publicly revealed until 2024.
4
BitGrail
Feb 12, 2018CEXNano$170MA flaw in BitGrail’s withdrawal system let attackers withdraw the same funds repeatedly, stealing Nano from the exchange’s hot wallets.
5
SmartMesh
Apr 24, 2018TokenEthereum$140MAn integer-overflow flaw in SmartMesh’s transferProxy function let attackers create counterfeit tokens; some were traded on exchanges before trading was halted.
6
ZAIF
Sep 14, 2018CEXBitcoin$60MAttackers gained access to Zaif’s hot-wallet keys and stole Bitcoin, Bitcoin Cash, and MonaCoin. The Bitcoin Cash amount was not specified.
7
Blockchain.info
Feb 19, 2018$50MA hacking group used Google search ads for cryptocurrency-related terms to direct users to fake Blockchain.info websites, stealing more than $50 million in cryptocurrency.
8
Coinrail
Jun 10, 2018CEXEthereum$37.2MAttackers broke into Coinrail’s systems and stole more than $40 million in altcoins, including NPXS and Aston X. Partner exchanges helped recover about two-thirds of the stolen assets.
Our coverage: Bitcoin This Week: CFTC Subpoenas Major Crypto Exchanges, Coinrail Hacked, Bitcoin Prices And MoreSource
9
Bithumb
Jun 21, 2018CEXEthereum$31MAttackers gained access to Bithumb’s online wallet system and stole cryptocurrency, including about 35,000 ETH and other tokens.
10
Bancor
Jul 9, 2018DeFi ProtocolEthereum$23.5MAttackers gained access to a wallet linked to Bancor's BancorConverter contract, apparently using a compromised private key, and drained about $23.5 million in tokens.
Top 10 crypto hacks of 2017
$289M stolen in 12 incidents
1
Parity Multisig
Nov 9, 2017DeFi ProtocolEthereum$150MA user reinitialized Parity’s shared wallet library and then destroyed it, permanently disabling more than 500 multisig wallets containing about 500,000 ETH.
2
Nicehash
Dec 8, 2017CEXBitcoin$64MAttackers obtained NiceHash employee credentials through phishing and accessed the company’s payment wallet, stealing more than 4,700 BTC. NiceHash later repaid affected users.
Our coverage: NiceHash CEO Confirms Theft Of More Than 4,700 BitcoinsSource
3
Tether
Nov 19, 2017TokenBitcoin$31MAn external attacker took USDT from Tether’s Treasury wallet and sent it to an unauthorized address. Tether blocked the tokens from circulating or being redeemed and worked with the Omni Foundation on changes to reclaim them.
Our coverage: Under-pressure Tether Alleges $30 Million Loss To HackSource
4
Parity
Jul 1, 2017WalletEthereum$30MA flaw in Parity’s multisignature-wallet library let an attacker take ownership of wallets and drain them. A white-hat group used the same flaw to rescue funds from other vulnerable wallets.
5
Coindash
Jul 18, 2017ICOEthereum$7.7MAn attacker compromised CoinDash’s ICO website and replaced its deposit address with one they controlled. Investors sent ETH to that address before the sale was stopped; the attacker retained some of the funds.
6
Yapizon
Apr 27, 2017CEXBitcoin$4.8MAttackers breached Yapizon’s system and stole bitcoin from four hot wallets. The exchange replaced users’ lost balances with Fei tokens, which represented IOUs.
7
EtherDelta
Dec 20, 2017CEXEthereum$1.4MAttackers hijacked EtherDelta’s website address and redirected users to a phishing site that captured their login details, leading to theft from users.
Top 10 crypto hacks of 2016
$136M stolen in 5 incidents
1
Bitfinex
Aug 2, 2016CEXBitcoin$72MAn attacker compromised Bitfinex’s hot-wallet keys and used them to transfer about 119,755 BTC without authorization. Bitfinex halted trading and withdrawals while investigating.
2
The DAO
Jun 17, 2016DeFi ProtocolEthereum$60MThe attacker repeatedly called a withdrawal function before the DAO contract updated the account balance, taking 3.6 million ETH.
3
Gatecoin
May 14, 2016CEXEthereum$2MAttackers exploited a disruption during a server reboot to redirect deposits from cold storage—offline wallets—to a vulnerable hot wallet. Gatecoin lost approximately 250 BTC and 185,000 ETH.
4
Bitcurex
Oct 13, 2016CEXBitcoin$1.5MAttackers stole 2,300 BTC from Bitcurex, which shut down after the loss. The exchange later tried to restart but closed permanently weeks afterward.
5
ShapeShift
Apr 7, 2016CEXBitcoin$230KAn employee stole funds from ShapeShift, then sold security credentials to outside attackers who made further thefts. The report says customers lost no funds because the exchange did not hold customer assets.
Top 10 crypto hacks of 2015
$9.93M stolen in 6 incidents
1
Bitstamp
Jan 5, 2015CEXBitcoin$5.2MPhishing emails led an employee to install malware, giving attackers access to Bitstamp’s hot-wallet systems and wallet files. The attackers stole 19,000 bitcoins from its operating wallets.
2
BTER
Feb 17, 2015CEXBitcoin$1.75MBTER’s cold wallet was breached and 7,170 BTC was stolen; the exchange suspended operations.
3
BTER
Aug 15, 2015CEXBitcoin$1.65MAttackers compromised BTER’s servers and stole 50 million NXT from its hot wallets. The exchange suspended operations afterward.
4
KipCoin
Feb 18, 2015CEXBitcoin$728KAttackers accessed KipCoin’s server and copied its wallet.dat file, which holds wallet keys. Months later, they began moving more than 3,000 BTC.
5
Bitfinex
May 22, 2015CEXBitcoin$329KAttackers compromised Bitfinex’s hot wallets, the exchange’s online storage, and stole about 1,460 BTC.
6
796
Jan 27, 2015CEXBitcoin$270KA flaw in 796’s withdrawal system let an attacker change a withdrawal address, and exchange staff failed to catch the change. As a result, 1,000 BTC went to the attacker instead of the customer.
