Crypto hacks do not all happen in the same place. An exchange can lose control of its wallets, a smart contract can behave in an unintended way, and a bridge can accept a transfer it should reject. Understanding that difference is more useful than treating every incident as a failure of Bitcoin or Ethereum itself.
These ten incidents are arranged chronologically, not ranked by dollar losses. We selected documented unauthorized thefts or exploits for their scale, consequences, or distinct security lessons, covering exchanges, smart contracts and cross-chain bridges. This is an editorial selection, not an exhaustive list. Market crashes, stablecoin depegs and insolvency or fraud alone do not qualify as hacks.
Research checked October 30, 2026, at 13:57 UTC. The final entry is a developing incident confirmed by Binance, not a completed investigation. Amounts below retain their source’s historical context; they are not today’s valuations. Frozen, returned, reimbursed and permanently lost funds are different measures. The lessons are editorial interpretations, not guarantees that a particular safeguard would prevent every attack.
1. Mt. Gox — theft spanning 2011–2014
Mt. Gox is often reduced to a single “2014 hack,” but that hides the timeline. A U.S. Justice Department case announced in 2023 alleged unauthorized access to its wallet server beginning in September 2011 and theft of at least approximately 647,000 bitcoin through at least May 2014. The exchange ceased operations in 2014. That alleged theft quantity is not interchangeable with every balance-shortfall figure associated with its collapse. DOJ case announcement.
What it exposed: custody risk can accumulate out of sight. An exchange’s customer balances and the assets it actually controls need reliable reconciliation and independent scrutiny; a familiar trading interface is not evidence that those controls work.
2. The DAO — June 2016
The DAO was an investment-oriented smart contract on Ethereum, not an exchange. On June 17, the Ethereum Foundation described a recursive-call vulnerability being used to drain its ether. Ethereum’s technical history records more than 3.6 million ETH affected. The flaw was in the application contract, not a break in Ethereum’s underlying cryptography. Foundation notice; Ethereum’s fork history.
On July 20, a hard fork moved DAO-related funds into a recovery contract. The chain that rejected that intervention continued as Ethereum Classic. Fork completion announcement.
What it exposed: contract security and blockchain governance are separate questions. Code review matters before deployment, while an exceptional community intervention is not a recovery mechanism users can assume will be repeated.
3. Bitfinex — August 2016
Bitfinex lost approximately 120,000 bitcoin in its 2016 exchange hack. The Justice Department’s later account specifies 119,754 BTC moved through more than 2,000 fraudulently authorized transactions. The investigation eventually produced guilty pleas and a 2024 sentencing in the associated money-laundering case. Those later legal events should not be confused with the original theft date or used to revalue its impact at later bitcoin prices. DOJ incident page; 2024 case update.
What it exposed: transaction authorization needs controls beyond a successful login. It also showed that moving assets on a blockchain does not necessarily make their trail disappear, although an investigation or seizure is not the same as a completed victim payout.
4. Coincheck — January 2018
Coincheck’s NEM hot wallet was compromised in January 2018. Its later securities filing records 526.3 million NEM lost and says affected customers were compensated. Using the token quantity avoids mixing contemporaneous market-price headlines with later accounting or reimbursement figures. A hot wallet is connected to online operational systems, making the amount held there an important part of the exposure. Coincheck Group’s 2025 filing.
What it exposed: the way a custodian stores assets can matter as much as which asset it holds. Compensation can shift the financial burden away from customers without meaning that the originally stolen coins were recovered.
5. KuCoin — September 2020
KuCoin later attributed its September 2020 incident to an internal-network intrusion that exposed private keys for several hot wallets. In a February 2021 retrospective, the company said partners helped recover 78% of the affected funds, law enforcement and security institutions helped recover another 6%, and KuCoin and its insurance fund covered the remaining 16%. Those are the company’s reported outcomes, not a claim that every stolen token was returned by the attacker. KuCoin’s retrospective.
What it exposed: recovery is an ecosystem process, but prevention still depends on internal access controls. A response report should separate assets recovered through partners from losses absorbed by the company or an insurance fund.
6. Poly Network — August 2021
On August 10, an attacker exploited the cross-chain protocol Poly Network. In its September retrospective, the project described more than $610 million in assets taken and their subsequent return. Its account also distinguished the release of previously frozen USDT from other returned assets and said it covered trading slippage and fees during restoration. That makes this a particularly clear example of why an initial theft amount is not a final economic loss. Poly Network’s incident retrospective.
What it exposed: bridges connect security assumptions as well as blockchains. Asset issuers, exchanges and protocol operators may all have roles in a response, but an attacker’s eventual cooperation is not a dependable protection for future users.
7. Wormhole — February 2022
Wormhole’s February 2 exploit involved 120,000 wrapped ETH, according to contemporaneous blockchain analysis by TRM Labs. Wrapped assets represent value across networks; they depend on the bridge correctly checking the messages that authorize their creation or release. Kudelski Security’s technical analysis identified a verification flaw in Wormhole’s Solana program. This was a bridge-program failure, not evidence that Solana’s or Ethereum’s base cryptography had been broken. TRM investigation; Kudelski analysis.
What it exposed: a bridge must verify that a claim about another chain is authentic. The security of the connected blockchains does not automatically establish the security of the software linking them.
8. Ronin bridge — March 2022
The Ronin bridge, used by the network supporting Axie Infinity, lost 173,600 ETH and 25.5 million USDC. A U.S. indictment describes attackers obtaining control of five of its nine validator nodes and using that access for unauthorized withdrawals. DOJ-hosted court filing.
When the bridge reopened in June, Ronin said user funds were fully backed again, while separately identifying 56,000 ETH associated with the Axie DAO treasury that remained undercollateralized at that time. Replenishing backing was not the same as recovering the whole theft. Ronin’s June 2022 update.
What it exposed: the number of validators is only part of the security picture. Their operational independence and the ability to halt suspicious withdrawals also matter.
9. Bybit — February 2025
The FBI put the value stolen from Bybit on or about February 21 at approximately $1.5 billion. The incident involved an Ethereum cold-wallet transaction. Forensic investigators at Sygnia found altered JavaScript delivered through the Safe wallet interface used by the signers, demonstrating how transaction presentation can be compromised even when multiple signatures are required. FBI incident alert; Sygnia’s investigation.
What it exposed: “cold wallet” is not a guarantee that every step of a transfer is isolated from online systems. Signers need a trustworthy way to understand what they authorize, not merely confidence in the appearance of a familiar interface.
10. Binance exchange — October 2026, investigation developing
Binance’s October 30 notice confirmed unauthorized withdrawals. Its initial investigation was preliminary; a completed technical postmortem was not available at our review. This is the exchange incident, not the 2022 BNB Chain bridge exploit. Binance’s official update.
What it exposes so far: operational access deserves scrutiny alongside wallet design. The root cause and financial outcome remain unsettled. Frozen assets are not automatically recovered assets, and a promise to cover losses is not proof of completed compensation.
Reading the history without misleading comparisons
These cases show different failures: custody, application logic, bridge verification, validator control and the software people use to approve transactions. They do not establish that any particular exchange, wallet or blockchain is safe today.
For background on the networks themselves, read our guide to ten layer-1 blockchains and their distinctive technology, or browse the Cryptocurrency category.
Cryptocurrency carries security and financial risks. This is historical reporting and general educational information, not financial or investment advice.