Biggest Crypto Hacks of All Time: Timeline & Statistics

Quick Answer

The biggest publicly confirmed crypto hack is the February 2025 Bybit theft, in which about $1.5 billion in virtual assets was stolen. A retrospectively alleged 2020 theft from LuBian may have involved 127,426 bitcoin worth roughly $3.5 billion at the time, but the event was not contemporaneously confirmed and later U.S. court filings complicate ownership and custody. This ranking therefore separates confirmed incidents from disputed cases, values assets in U.S. dollars at the incident date, and distinguishes gross stolen value from realized outflow, frozen funds, reimbursement, recovery, and net unresolved loss.

Biggest Crypto Hacks at a Glance

The FBI attributed Bybit’s approximately $1.5 billion theft on February 21, 2025, to North Korean TraderTraitor activity. It remains the largest publicly confirmed, contemporaneously disclosed crypto hack in the evidence reviewed for this article.

For deeper context on the actor ecosystem behind several large service thefts, see DeepStrike’s analysis of North Korean crypto theft campaigns.

Arkham Intelligence later described an alleged December 2020 theft of 127,426 BTC from LuBian, worth about $3.5 billion then. Because neither side publicly confirmed the event at the time and later DOJ filings concern related bitcoin as alleged criminal proceeds, LuBian belongs in a separate retrospective tier.

The yearly totals depend on the dataset. Chainalysis estimated more than $3.4 billion stolen during 2025, including personal-wallet compromises.

TRM Labs reported $2.87 billion across nearly 150 hacks and exploits under a different methodology. For H1 2026, TRM recorded 207 hacks and $972 million in losses. More incidents did not mean more value stolen: Drift Protocol and KelpDAO alone accounted for most of the half-year loss.

That concentration also changed the headline attack surface: smart-contract exploits remained numerous, but signing and off-chain infrastructure failures drove the largest losses.

How We Ranked the Biggest Crypto Hacks

An incident qualifies when credible evidence supports unauthorized acquisition, creation, or transfer of digital assets through compromised systems, credentials, keys, signing workflows, code, or protocol logic. Scams, rug pulls, insolvency, lost keys, market collapses, ransomware payments, and ordinary fraud without a verified cyber compromise are excluded.

The confirmed ranking has a reproducible floor: approximately $190 million in gross value at the incident date. It covers every reviewed, sufficiently evidenced event meeting that floor. Smaller but historically important events remain in the timeline or recovery discussion. Cases with nominal token mints that could not be realized near the quoted market value, unresolved cyber classification, or conflicting first-party and third-party values are documented outside the ranking.

The ranking uses the best-supported U.S.-dollar value at the incident date, not the assets’ present value. “Hack,” “exploit,” “theft,” and “heist” are convenient labels, but the table identifies the actual failure layer wherever evidence permits.

DeepStrike’s editorial Loss Normalization Framework separates six states:

1. Nominal or gross event value: the value created, exposed, or transferred at the event-time price.
2. Realized attacker outflow: what moved beyond immediate containment.
3. Frozen or blocked value: assets stopped from moving but not necessarily restored.
4. Returned, recovered, or seized value: assets restored or lawfully recovered.
5. Reimbursement or recapitalization: replacement value supplied by a company, insurer, treasury, or backer.
6. Net unresolved value: a cautious residual only when assets, dates, ownership, and definitions are compatible.

This is an editorial normalization method, not a universal accounting standard. Reimbursement and recapitalization can protect users while leaving the stolen assets unrecovered.

Source: DeepStrike Loss Normalization Framework; BNB Chain’s October 11, 2022 response for the BSC Token Hub example.

The Biggest Confirmed Crypto Hacks Ranked

The table uses rounded event-time estimates and includes only confirmed qualifying incidents at or above the approximate $190 million floor. A dash means a compatible value could not be established from the reviewed evidence.

Source: Event-specific government, first-party, and forensic sources cited in the article; evidence cutoff August 2, 2026.

Bybit: the largest publicly confirmed crypto hack

On February 21, 2025, an attacker manipulated a transaction-signing process associated with a cold-wallet transfer. The Safe Ecosystem Foundation said a compromised Safe{Wallet} developer machine produced a disguised malicious transaction. The FBI attributed the approximately $1.5 billion theft to North Korean TraderTraitor activity. The lesson is not that cold storage is useless; it is that the transaction a signer sees, the intent independently verified, the interface used, and the transaction ultimately executed must remain cryptographically and operationally bound.

Ronin: concentrated validator authority

The Ronin bridge lost 173,600 ETH and 25.5 million USDC after compromised validator keys enabled fraudulent withdrawals. The U.S. Treasury linked the receiving address to Lazarus Group. The incident shows how a threshold can appear decentralized while operational practices still allow one compromise path to accumulate enough approvals.

Chainalysis reported that law enforcement seized more than $30 million in cryptocurrency stolen from Ronin in September 2022. That dated seizure is separate from bridge recapitalization and does not establish a final unresolved-loss total.

DeepStrike’s Lazarus Group profile provides broader actor context without treating every suspected incident as a finalized government attribution.

Poly Network: a huge gross theft with an unusual return

An attacker exploited cross-chain contract logic and removed roughly $612 million. Chainalysis reported that about $578.6 million had been returned and $33.4 million in USDT frozen by August 12, 2021. Poly Network demonstrates why a gross-event ranking and a net-loss ranking can produce different answers.

BSC Token Hub: nominal value versus realized outflow

The exploit created and withdrew two million BNB, worth nearly $570 million at the time. BNB Chain said validators and partners contained most of it, while roughly $100 million moved off-chain and remained unrecovered at that point. Ranking only the nominal mint would overstate the attacker’s accessible proceeds.

Coincheck and Mt. Gox: exchange custody at scale

Coincheck lost 58 billion yen in NEM held in a hot wallet and later used company funds to reimburse about 46.6 billion yen to affected customers. Reuters contemporaneously documented the theft, hot-wallet exposure, and repayment process. Reimbursement reduced customer impact but did not recover the stolen NEM.

Mt. Gox’s collapse involved a multi-year loss, inconsistent early counts, and later U.S. charges alleging approximately 647,000 BTC were stolen. The DOJ describes the server compromise and theft allegations, but bankruptcy and civil-rehabilitation distributions cannot be converted into a clean event-time recovery percentage.

A July 31, 2024 notice from the Mt. Gox Rehabilitation Trustee said Bitcoin and Bitcoin Cash repayments had been made to more than 17,000 rehabilitation creditors. Those distributions use a later legal and valuation basis, so they are not treated as recovered incident-time value.

Wormhole and Nomad: bridge verification failures

Wormhole’s verification flaw allowed an attacker to mint 120,000 wrapped ETH without the required backing. Chainalysis valued the event above $320 million. Jump Crypto later supplied 120,000 ETH to replenish the bridge; that was recapitalization, not recovery of the attacker-held assets.

Nomad’s faulty initialization caused messages to be accepted without proper validation, and copycats rapidly repeated the withdrawal pattern. Google’s Mandiant team documented more than $190 million removed and more than $36 million returned by its November 2022 analysis. Bridges concentrate risk because they combine locked collateral, cross-chain validation, privileged upgrades, and fast-moving liquidity.

DMM Bitcoin: a trusted transaction was manipulated

The FBI, Japan’s National Police Agency, and the U.S. Defense Department Cyber Crime Center said TraderTraitor actors compromised a wallet-software employee, used session information to access communications, and manipulated a legitimate DMM transaction request. The episode connected social engineering, endpoint compromise, third-party trust, and transaction integrity.

Human-layer controls should be informed by current social engineering statistics, but training alone cannot replace transaction verification, device security, or separation of duties.

KelpDAO and Drift: 2026’s concentration problem

TRM Labs reported that the April 2026 KelpDAO and Drift incidents totaled $577 million and dominated H1 2026 losses.

Chainalysis described KelpDAO as an off-chain infrastructure compromise that fed false source-chain data to a single-verifier bridge configuration. It reported approximately $292 million released, more than 30,000 ETH frozen, and a second attempted transfer of about $95 million blocked.

Elliptic estimated Drift’s loss at $286 million and described the DPRK link as suspected. Its preliminary cause discussion cited a possible compromise of administrator private keys, so the ranking preserves the attribution and root-cause qualifiers.

These cases also fit DeepStrike’s broader analysis of state-sponsored hacking, while the confirmed ranking avoids upgrading a private forensic assessment into a government finding.

KuCoin, WazirX, and Mixin: centralized dependencies differ

KuCoin said a long-running APT compromised its internal network and exposed hot-wallet private keys. In a later first-party recap, KuCoin valued the affected assets at about $285 million, reported $239.45 million recovered through industry and law-enforcement cooperation, and said insurance covered the remainder.

WazirX reported a multisignature wallet discrepancy and more than $230 million in affected assets. Its preliminary incident report described conflicting displayed and signed transaction data. Later restructuring or distributions are kept separate from recovered-assets accounting.

Mixin said its cloud service provider’s database was attacked. Elliptic reported the platform’s approximate $200 million figure and announced compensation plan. The incident shows that a product described as decentralized can still depend on centralized operational infrastructure.

Cetus and Euler: code-level failures with very different outcomes

Halborn traced the Cetus loss to a flawed integer-overflow check in the protocol’s liquidity calculations and estimated that the attacker drained about $223 million.

Cetus’s relaunch plan separated reclaimed assets, treasury funding, a Sui Foundation loan, and token compensation; affected pools reopened at 85%–99% of prior liquidity.

Euler lost about $197 million through vulnerable protocol logic around leveraged positions and liquidation. The Euler Foundation reported that all recoverable funds were returned. The return is a genuine recovery outcome under Euler’s definition, but it does not make the original exploit immaterial.

Retrospective, Disputed, and Hard-to-Classify Cases

LuBian: potentially larger than Bybit, but not equally established

Arkham Intelligence reported in 2025 that 127,426 BTC, worth about $3.5 billion in December 2020, appeared to have been stolen from LuBian after weak private-key entropy. The event was not publicly disclosed by LuBian or an attacker at the time.

Later DOJ filings described roughly 127,271 BTC as proceeds and instrumentalities of alleged fraud and money-laundering schemes tied to Chen Zhi and said the bitcoin was in U.S. custody. An indictment contains allegations, not a final adjudication, and those statements do not automatically prove or disprove Arkham’s theft narrative.

The defensible answer is two-part: Bybit is the largest publicly confirmed, contemporaneously disclosed hack; LuBian is the largest retrospectively alleged on-chain theft identified in the reviewed evidence. It should not silently take first place until the ownership, theft mechanism, and relationship to the forfeiture case are resolved.

FTX unauthorized transfers

Elliptic estimated $477 million in unauthorized transfers from FTX wallets in November 2022. The timing overlapped with the exchange’s bankruptcy, and public reporting mixed the wallet incident with the company’s broader fraud and insolvency. FTX is excluded because a finalized cyber root cause and stable boundary between the theft and bankruptcy activity were not established from authoritative evidence.

PlayDapp and BitMart

Elliptic valued 1.79 billion unauthorized PlayDapp PLA token mints at $290 million, but also warned that the newly minted supply far exceeded prior circulation and might not be saleable near the pre-incident price. The event is excluded from the comparable ranking because nominal mint value is not a reliable realized-loss measure here.

BitMart’s first-party disclosure placed its December 2021 hot-wallet theft at approximately $150 million, below this article’s floor, while a third-party estimate reached about $196 million. The stronger first-party value controls inclusion, so BitMart is documented but not ranked.

Bitfinex: below the floor, still a major recovery case

The 2016 Bitfinex theft involved 119,754 BTC worth about $71 million at the time. DOJ case records document the theft, later seizures, guilty pleas, and sentencing. Bitfinex remains historically important because most of the bitcoin was later seized, but present-day seizure value must not replace the event-time amount in an all-time ranking.

Crypto Hacks Timeline: From Exchange Wallets to Bridges and Signing Infrastructure

The attack surface did not move neatly from “old” to “new.” Smart-contract flaws still occur, but the largest losses increasingly show that identity, operational infrastructure, signing intent, and third-party dependencies can bypass strong cryptography.

Crypto Hack Statistics and Trends

Chainalysis reported about $2.2 billion stolen across 303 incidents in 2024, up approximately 21.07% from 2023. It attributed about $1.34 billion across 47 incidents to DPRK-linked hackers. Preserving that full-year baseline matters because it shows both the rebound and state-linked concentration before Bybit reshaped the next year.

DeepStrike’s broader crypto crime trends provide adjacent context, while this page remains the owner for all-time hack ranking and incident-loss methodology.

Chainalysis estimated more than $3.4 billion stolen in 2025 and said the top three service hacks represented 69% of service losses. TRM Labs reported $2.87 billion across nearly 150 hacks and exploits for the same year. Those figures are not interchangeable: providers differ in incident scope, wallet-victim inclusion, address clustering, price timestamps, recoveries, and classification.

For H1 2026, TRM recorded 207 incidents and $972 million in losses, compared with 83 incidents and $2.3 billion in H1 2025. Smart-contract exploits made up 125 of the 207 incidents, but two large infrastructure or operational compromises Drift and KelpDAO concentrated most stolen value. Frequency and total loss can move in opposite directions.

The reviewed provider summaries do not supply a directly comparable global mean and median for these same incident populations. This article therefore does not infer them from partial lists; it uses incident count, aggregate value, and concentration only within each provider’s stated scope.

This distinction matters for risk decisions. The median or typical incident can fall while tail risk remains severe. Security programs should measure probable loss and catastrophic transaction paths, not only vulnerability counts.

What the Largest Crypto Hacks Reveal About Security

DeepStrike’s Crypto Control-Failure Chain maps five connected layers:

1. People and identity: recruiting lures, impersonation, compromised sessions, privileged access, and weak separation of duties.
2. Developer and supply chain: endpoints, source control, dependencies, build systems, front ends, and deployment approvals.
3. Keys and signing: custody, signer devices, transaction intent, quorum design, policy enforcement, and emergency authority.
4. Protocol and business logic: bridges, message verification, oracles, arithmetic, invariants, access control, and upgrades.
5. Monitoring and recovery: value limits, anomaly detection, pausing, tracing, exchange coordination, communications, and rehearsed response.

An attacker may enter at one layer and cash out through another. A secure contract cannot compensate for a compromised administrator; a hardware wallet cannot protect a signer who approves a misrepresented transaction; a fast pause cannot help if nobody monitors the right behavioral signal.

Developer and supply-chain controls benefit from scoped web application penetration testing that includes authorization, transaction integrity, deployment paths, and third-party trust boundaries.

Centralized services should emphasize custody segmentation, independent transaction verification, privileged-access controls, withdrawal limits, and cloud penetration testing that covers identity, secrets, management planes, logging, and resilient configuration.

DeFi and bridge teams need invariant testing, upgrade safety, independent verification, economic and adversarial review, and bounded value at risk. Security leaders across both models need rehearsed response, cross-organization contacts, evidence preservation, and clear recovery communications.

Source: NIST SP 800-57, CISA TraderTraitor advisory AA22-108A, OWASP Smart Contract Top 10, and the event-specific sources cited in the article. Framework: DeepStrike editorial analysis.

Attack Pattern to Security Control Map

A Practical Security Checklist for Crypto Platforms

• Define ownership for custody, protocol, bridge, cloud, identity, and response risk.
• Keep key generation, storage, rotation, backup, revocation, and destruction auditable.
• Use hardware-backed signing where appropriate and verify transaction intent independently of the initiating interface.
• Enforce separation of duties and thresholds that cannot be bypassed by one team, device, or vendor.
• Protect source control, dependencies, build pipelines, releases, and front-end deployment paths.
• Review smart contracts and bridge integrations for authorization, validation, upgrade, oracle, arithmetic, and business-logic risk.
• Test invariants, malformed and replayed messages, unsafe initialization, arithmetic boundaries, and emergency-control behavior.
• Simulate transactions and impose rate, destination, asset, and value limits.
• Monitor privileged changes, signer behavior, bridge flows, reserve backing, and cross-chain anomalies in real time.
• Rehearse pausing, evidence preservation, legal escalation, partner notification, tracing, and customer communications.
• Retest material fixes and governance changes before restoring full value at risk.

No checklist, audit, or penetration test guarantees safety. The objective is to reduce feasible attack paths, cap loss, and shorten detection and recovery time.

A continuous penetration testing program can help teams retest exposed systems and material changes between major point-in-time assessments.

Authorized adversary simulation can test whether identity, communications, signing, monitoring, and escalation controls work together under realistic pressure.

Frequently Asked Questions

What is the biggest confirmed crypto hack of all time?

The February 2025 Bybit theft is the largest publicly confirmed crypto hack reviewed here, at approximately $1.5 billion at the incident date. The FBI attributed it to North Korean TraderTraitor activity.

Was the LuBian incident bigger than the Bybit hack?

Potentially. Arkham alleged that 127,426 BTC worth about $3.5 billion was stolen from LuBian in 2020. Because the event was discovered retrospectively, was not contemporaneously confirmed, and intersects with later U.S. forfeiture allegations, it is not ranked alongside confirmed incidents.

How much crypto was stolen in hacks in 2025?

There is no single universal total. Chainalysis estimated more than $3.4 billion in stolen funds, while TRM Labs reported $2.87 billion across nearly 150 hacks and exploits. Their scope and methods differ, so the figures should be shown separately.

Which crypto hacks qualify for the main ranking?

The table includes reviewed, publicly confirmed cyber incidents with an event-time gross value of approximately $190 million or more and a sufficiently comparable valuation. Disputed, retrospective, below-threshold, or nominal-mint cases are documented separately.

Are stolen crypto funds ever recovered?

Yes. Poly Network returned most funds, Euler reported all recoverable funds returned, and U.S. authorities seized most of the bitcoin from Bitfinex years later. Recovery, freezing, reimbursement, and protocol recapitalization are different outcomes and should not be combined.

Why are cross-chain bridges frequent targets?

Bridges often secure large pools of collateral while translating state or messages between systems. A flaw in validation, signer governance, upgrades, or mint-and-burn logic can create a direct path to high-value assets.

Conclusion

The largest crypto hacks are not one technical category. They include compromised exchange infrastructure, validator keys, bridge verification, arithmetic and business logic, third-party communications, privileged access, and signing workflows. Measuring them responsibly requires event-time valuation and a clear distinction between gross theft, realized outflow, frozen funds, recovery, reimbursement, and unresolved loss.

For crypto and fintech teams evaluating these attack paths, DeepStrike can discuss a scoped, authorized penetration test covering applications, cloud, identity, signing workflows, and operational infrastructure. The objective is evidence-led risk reduction not a guarantee that every incident can be prevented.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.