{"byYear":{"2014":473000000.0,"2016":132000000.0,"2018":534000000.0,"2020":281000000.0,"2021":807000000.0,"2022":1988000000.0,"2023":197000000.0,"2024":540000000.0,"2025":1986000000.0,"2026":7264500000.0},"credit":"CryptoKeyhole (https://cryptokeyhole.com/crypto-hacks/)","incidents":[{"back":"Binance puts the frozen part at about $3 billion","by":{"date":"2026-10-31","group":"North Korea (TraderTraitor)","quote":"was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026","url":"https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack","who":"FBI"},"cat":"keys","chains":["Bitcoin","Ethereum","XRP Ledger","others"],"coins":"18,270.2 BTC, 167,464 ETH and tokens from its hottest Ethereum wallet, XRP and more","date":"2026-10-29","how":"After a breach of its systems, signed permissions handed its busiest hot wallet to the attacker's code","id":"binance-2026","kind":"Exchange","nodes":{"at":1794184681,"btcAddresses":19,"btcStill":17832.49990088,"btcTaken":18270.19990088,"ethStill":0.0,"ethSwept":167464.25,"frozenUsdc":823000000,"frozenUsdt":1175464713,"walletSends":729},"src":[["FBI alert, 31 Oct 2026","https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack"],["BleepingComputer, 1 Nov 2026","https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/"],["CryptoKeyhole, block by block","/insights/2026-10-30-binance-hack-block-by-block/"]],"usd":6300000000.0,"victim":"Binance"},{"back":"Bitget covered it from its protection fund","cat":"keys","chains":["Bitcoin","Ethereum","Tron","Zcash","others"],"coins":null,"date":"2026-09-24","how":"Hot and warm wallets, through a flaw in a third-party security product","id":"bitget-2026","kind":"Exchange","nodes":null,"src":[["BleepingComputer, Sep 2026","https://bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist"]],"usd":387500000.0,"victim":"Bitget"},{"back":"Arbitrum's Security Council froze 30,766 ETH","cat":"keys","chains":["Ethereum","Arbitrum"],"coins":"116,500 rsETH","date":"2026-04-18","how":"The system that watched the source chain for its bridge was taken over","id":"kelpdao-2026","kind":"Bridge","nodes":null,"src":[["Chainalysis, April 2026","https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"]],"usd":292000000.0,"victim":"KelpDAO"},{"back":null,"cat":"keys","chains":["Solana"],"coins":null,"date":"2026-04-01","how":"Its people were tricked into handing over control of the vaults","id":"drift-2026","kind":"DeFi protocol","nodes":null,"src":[["TRM Labs, 2026 thefts","https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"]],"usd":285000000.0,"victim":"Drift Protocol"},{"back":"Part was frozen or recovered","cat":"code","chains":["Ethereum","others"],"coins":null,"date":"2025-11-03","how":"Rounding in its pool maths, repeated in one transaction","id":"balancer-2025","kind":"DeFi protocol","nodes":null,"src":[["The Block, biggest hacks of 2025","https://www.theblock.co/news/regulation/2026-01-01-biggest-crypto-hacks-2025-380992"]],"usd":128000000.0,"victim":"Balancer"},{"back":"Destroyed, not taken","cat":"keys","chains":["Bitcoin","Ethereum","Tron","others"],"coins":null,"date":"2025-06-18","how":"Wallets emptied to addresses no one can spend from","id":"nobitex-2025","kind":"Exchange","nodes":null,"src":[["The Block, biggest hacks of 2025","https://www.theblock.co/news/regulation/2026-01-01-biggest-crypto-hacks-2025-380992"]],"usd":90000000.0,"victim":"Nobitex"},{"back":"Sui validators froze about $162 million","cat":"code","chains":["Sui"],"coins":null,"date":"2025-05-22","how":"An overflow check in its liquidity maths","id":"cetus-2025","kind":"DeFi protocol","nodes":null,"src":[["The Block, biggest hacks of 2025","https://www.theblock.co/news/regulation/2026-01-01-biggest-crypto-hacks-2025-380992"]],"usd":223000000.0,"victim":"Cetus"},{"back":null,"by":{"date":"2025-02-26","group":"North Korea (TraderTraitor)","quote":"was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025","url":"https://www.ic3.gov/PSA/2025/PSA250226","who":"FBI"},"cat":"keys","chains":["Ethereum"],"coins":"401,347 ETH and staked ether tokens","date":"2025-02-21","how":"The signing screen of its multisig cold wallet was altered, so its signers approved a hidden change","id":"bybit-2025","kind":"Exchange","nodes":{"addresses":51,"at":1794184681,"ethHeld":0.11,"ethTaken":401347},"src":[["Bybit incident update","https://announcements.bybit.com/article/incident-update-unauthorized-activity-involving-eth-cold-wallet-blt292c0ad6c1e7e1a6/"],["FBI public service announcement, 26 Feb 2025","https://www.ic3.gov/PSA/2025/PSA250226"]],"usd":1460000000.0,"victim":"Bybit"},{"back":null,"cat":"keys","chains":["Ethereum","BNB Chain","others"],"coins":null,"date":"2025-01-23","how":"Hot wallets drained","id":"phemex-2025","kind":"Exchange","nodes":null,"src":[["The Block, biggest hacks of 2025","https://www.theblock.co/news/regulation/2026-01-01-biggest-crypto-hacks-2025-380992"]],"usd":85000000.0,"victim":"Phemex"},{"back":null,"cat":"keys","chains":["Ethereum"],"coins":null,"date":"2024-07-18","how":"Its multisig wallet's signing taken over","id":"wazirx-2024","kind":"Exchange","nodes":null,"src":[["Decrypt, largest exploits of 2024","https://decrypt.co/297206/largest-crypto-exploits-hacks-2024"]],"usd":235000000.0,"victim":"WazirX"},{"back":"Its group covered customers; the exchange closed and moved accounts to another exchange","cat":"keys","chains":["Bitcoin"],"coins":"4,502.9 BTC","date":"2024-05-31","how":"Bitcoin taken from the exchange's wallet","id":"dmm-2024","kind":"Exchange","nodes":null,"src":[["Decrypt, largest exploits of 2024","https://decrypt.co/297206/largest-crypto-exploits-hacks-2024"]],"usd":305000000.0,"victim":"DMM Bitcoin"},{"back":"The attacker returned it","cat":"code","chains":["Ethereum"],"coins":null,"date":"2023-03-13","how":"A donation function let the attacker leave a loan undercollateralised and liquidate it","id":"euler-2023","kind":"DeFi protocol","nodes":null,"src":[["Euler, behind the scenes of the recovery","https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery"]],"usd":197000000.0,"victim":"Euler Finance"},{"back":"Validators halted the chain; most of the BNB never left it","cat":"code","chains":["BNB Chain"],"coins":"2 million BNB","date":"2022-10-06","how":"A forged proof the bridge's verifier accepted, minting new BNB","id":"bnbbridge-2022","kind":"Bridge","nodes":null,"src":[["BNB Chain blog","https://www.bnbchain.org/en/blog/bnb-chain-ecosystem-update"],["Protos","https://protos.com/explained-how-600m-was-stolen-from-binances-bnb-chain"]],"usd":570000000.0,"victim":"BNB Chain (BSC Token Hub)"},{"back":"Part was returned by people who took it","cat":"code","chains":["Ethereum","Moonbeam"],"coins":null,"date":"2022-08-01","how":"An upgrade made every message pass as proven, so anyone could copy the withdrawal","id":"nomad-2022","kind":"Bridge","nodes":null,"src":[["SecurityWeek, 2 Aug 2022","https://www.securityweek.com/nearly-200-million-stolen-cryptocurrency-bridge-nomad/"]],"usd":190000000.0,"victim":"Nomad"},{"back":null,"by":{"date":"2023-01-23","group":"North Korea (Lazarus Group and APT38)","quote":"we were able to confirm that the Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony's Horizon bridge","url":"https://www.coindesk.com/policy/2023/01/23/fbi-north-korean-hackers-behind-100-million-horizon-bridge-theft/","who":"FBI"},"cat":"keys","chains":["Ethereum","Harmony"],"coins":null,"date":"2022-06-23","how":"Two of the bridge's five signer keys taken over","id":"harmony-2022","kind":"Bridge","nodes":null,"src":[["CoinDesk, 23 Jan 2023","https://www.coindesk.com/policy/2023/01/23/fbi-north-korean-hackers-behind-100-million-horizon-bridge-theft/"]],"usd":100000000.0,"victim":"Harmony (Horizon bridge)"},{"back":null,"cat":"code","chains":["Ethereum"],"coins":null,"date":"2022-04-17","how":"A flash loan bought enough votes to pass a proposal paying out the protocol","id":"beanstalk-2022","kind":"DeFi protocol","nodes":null,"src":[["Beanstalk, governance exploit","https://bean.money/blog/beanstalk-governance-exploit"]],"usd":182000000.0,"victim":"Beanstalk"},{"back":null,"by":{"date":"2022-04-14","group":"North Korea (Lazarus Group and APT38)","quote":"Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29th","url":"https://www.axios.com/2022/04/14/north-korea-crypto-theft-620","who":"FBI"},"cat":"keys","chains":["Ronin","Ethereum"],"coins":"173,600 ETH and 25.5 million USDC","date":"2022-03-23","how":"Five of the bridge's nine validator keys taken over","id":"ronin-2022","kind":"Bridge","nodes":null,"src":[["Axios, 14 Apr 2022","https://www.axios.com/2022/04/14/north-korea-crypto-theft-620"],["BleepingComputer, 14 Apr 2022","https://www.bleepingcomputer.com/news/security/fbi-links-largest-crypto-hack-ever-to-north-korean-hackers"]],"usd":620000000.0,"victim":"Ronin Network (Sky Mavis)"},{"back":"Jump Crypto replaced the 120,000 ETH the next day","cat":"code","chains":["Solana","Ethereum"],"coins":"120,000 wETH","date":"2022-02-02","how":"A signature check the attacker could skip, so wrapped ether was minted unbacked","id":"wormhole-2022","kind":"Bridge","nodes":null,"src":[["Web3 Is Going Just Great","https://web3isgoinggreat.com/single/wormhole-bridge-hack"]],"usd":326000000.0,"victim":"Wormhole"},{"back":null,"cat":"keys","chains":["Ethereum","BNB Chain"],"coins":null,"date":"2021-12-04","how":"Private keys of two hot wallets","id":"bitmart-2021","kind":"Exchange","nodes":null,"src":[["Digit, top crypto hacks 2020-2025","https://www.digit.in/features/general/coindcx-to-wazirx-top-10-biggest-crypto-hacks-2020-2025.html"]],"usd":196000000.0,"victim":"BitMart"},{"back":"The attacker returned most of it within weeks","cat":"code","chains":["Ethereum","BNB Chain","Polygon"],"coins":null,"date":"2021-08-10","how":"A flaw that let the attacker change who could release funds","id":"polynetwork-2021","kind":"Bridge","nodes":null,"src":[["Analog, a timeline of bridge attacks","https://www.analog.one/blog/a-timeline-and-history-of-recent-cross-chain-bridge-attacks"]],"usd":611000000.0,"victim":"Poly Network"},{"back":"Most of it was later recovered","cat":"keys","chains":["Bitcoin","Ethereum"],"coins":"BTC, ETH and ERC-20 tokens","date":"2020-09-25","how":"Hot wallets breached","id":"kucoin-2020","kind":"Exchange","nodes":null,"src":[["Digit, top crypto hacks 2020-2025","https://www.digit.in/features/general/coindcx-to-wazirx-top-10-biggest-crypto-hacks-2020-2025.html"]],"usd":281000000.0,"victim":"KuCoin"},{"back":"Coincheck repaid about 260,000 customers in yen","cat":"keys","chains":["NEM"],"coins":"523 million NEM (58 billion yen)","date":"2018-01-26","how":"NEM taken from a hot wallet","id":"coincheck-2018","kind":"Exchange","nodes":null,"src":[["Reuters factbox, 1 Feb 2018","https://www.yahoo.com/news/factbox-notable-cryptocurrency-heists-064124656--sector.html"]],"usd":534000000.0,"victim":"Coincheck"},{"back":"Bitfinex repaid its customers by April 2017","cat":"keys","chains":["Bitcoin"],"coins":"119,756 BTC","date":"2016-08-02","how":"Coins taken from customer wallets it ran with a custody partner","id":"bitfinex-2016","kind":"Exchange","nodes":null,"src":[["Reuters factbox, 1 Feb 2018","https://www.yahoo.com/news/factbox-notable-cryptocurrency-heists-064124656--sector.html"]],"usd":72000000.0,"victim":"Bitfinex"},{"back":"Returned to depositors by the Ethereum hard fork of 20 Jul 2016","cat":"code","chains":["Ethereum"],"coins":"3.6 million ETH","date":"2016-06-17","how":"A recursive call in the fund's withdrawal code","id":"thedao-2016","kind":"DeFi protocol","nodes":null,"src":[["Ethereum Foundation, 20 Jul 2016","https://blog.ethereum.org/2016/07/20/hard-fork-completed"]],"usd":60000000.0,"victim":"The DAO"},{"back":"It later found 200,000 BTC for its creditors; the trustee says the repayments are largely done and has moved the deadline for the rest to 31 Oct 2027","cat":"keys","chains":["Bitcoin"],"coins":"850,000 BTC (744,408 of its customers' and 100,000 of its own)","date":"2014-02-28","how":"Coins taken from the exchange's wallets over several years, announced as it stopped withdrawals","id":"mtgox-2014","kind":"Exchange","nodes":null,"src":[["Reuters factbox, 1 Feb 2018","https://www.yahoo.com/news/factbox-notable-cryptocurrency-heists-064124656--sector.html"],["Trustee notice, 16 Oct 2026","https://www.mtgox.com/img/pdf/20261016_b3a13e0f-55f6-4653-913b-be80762390e8_announcement_en.pdf"],["Mt. Gox announcement, 28 Feb 2014","https://www.mtgox.com/img/pdf/20140228-announcement_eng.pdf"]],"usd":473000000.0,"victim":"Mt. Gox"}],"licence":"https://creativecommons.org/licenses/by/4.0/","note":"The largest thefts CryptoKeyhole has checked, not every theft. Amounts in US dollars as stated at the time.","totalUsd":14202500000.0,"updated":1794184680}