Crypto Hacks
Top 10 crypto hacks of 2026
So far in 2026, attackers have taken $9.04B in 440 crypto hacks and thefts. The biggest was Binance on Oct 29, 2026, at $6.36B. The 10 largest account for 90% of the year's losses.
Last updated · Data last changed · Checked daily
The 10 biggest crypto hacks of 2026, ranked
1
Binance
Oct 29, 2026CEXEthereumBitcoinTRON+4 chains$6.36BAttackers gained access to Binance’s internal systems and signing privileges, then made unauthorized withdrawals across multiple blockchains. Some stolen assets were frozen or intercepted, and Binance said it would cover the losses.
Our coverage: Binance’s Fake Job Interview Used One Trust-building TrickSourceRekt report
2
Bitget
Sep 24, 2026CEXEthereumXRPTron+1 chains$387MAttackers used access obtained through a third-party security product to issue fraudulent withdrawal commands from Bitget hot and warm wallets. About $387.5 million was transferred to attacker-controlled addresses; Bitget said private keys and cold wallets were not compromised and the incident was contained.
3
Liquid Network
Sep 6, 2026ChainBridgeLiquid$320MA vulnerability in Liquid’s underlying Elements software let an attacker create unbacked L-BTC and use SideSwap’s normal withdrawal service to make the federation release about 3,996 BTC. The attacker later returned 3,400 BTC and retained about 598.5 BTC; no keys were compromised.
4
Drift Protocol
Apr 1, 2026DeFi ProtocolSolana$295MAttackers tricked Drift Protocol security council members into pre-signing transactions that gave them administrative control. They listed a worthless fake token as collateral, deposited it, and withdrew about $285 million in real assets.
5
Kelp DAO
Apr 18, 2026DeFi ProtocolBridgeEthereumArbitrum$293MAttackers compromised RPC nodes used to verify Kelp DAO’s rsETH bridge messages and made the single-verifier setup accept forged messages. This enabled about $290 million in losses; LayerZero said its protocol and other applications were not affected.
6
Crédit Mutuel Arkéa
Nov 1, 2026$133MAn attacker accessed a third-party service provider’s platform and used Crédit Mutuel Arkéa’s accounts to transfer funds to other financial institutions; some may later have been converted to cryptocurrency. The bank said customer assets were unaffected, while the final loss remained under assessment.
7
Tectonic
Aug 30, 2026DeFi ProtocolCronos$124MThe attacker repeatedly borrowed and redeposited TONIC, then sent TONIC directly to its receipt-token contract to inflate the collateral value; an unreliable price feed compounded the effect. Tectonic’s lending markets lost about $120 million, but a Cronos rollback recovered most of it; about $9.19 million remains unrecovered.
8
Coldcard
Jul 31, 2026WalletBitcoin$116MA Coldcard firmware flaw bypassed the hardware random-number generator during seed creation, leaving some wallet keys weak enough to guess offline. Attackers used this to drain bitcoin from many addresses without accessing the devices.
9
Ledger (Supply Chain)
Oct 9, 2026Wallet$93MGenuine Ledger hardware wallets were secretly modified to capture recovery phrases during setup and send them over cellular connections. Attackers used the phrases to access and drain customers’ crypto; Ledger said its core systems were not compromised.
10
Nesa
Aug 24, 2026ChainNesa$50MNesa confirmed an exploit involving a Cosmos EVM vulnerability, and reports said an attacker bridged 257.7 million NES to Ethereum. Nesa did not publish transaction-level details of the exploit; the reported mechanism resembles a balance-accounting bug affecting other Cosmos EVM chains.
