Skip to the guide
BTCETHMarket cap (coins we track)BTC dominance (coins we track)
CryptoKeyhole
Log inSign up

The biggest crypto hacks, and where the money went

CryptoKeyhole's ledger of the largest crypto thefts holds 25 thefts since 2014, $14.2 billion at the time they happened. The largest by far is Binance's $6.3 billion on 29 October 2026: at 23:28 UTC our nodes show 17,832.5 BTC of it still unmoved and $2.0 billion of stablecoins frozen.

The largest thefts in crypto, each with its source, and what our own nodes show of the coins now.

The ledger is checked by hand; the node readings refresh every five minutes. Last update 8 November 2026, 23:28 UTC

Every theft on one scale

One theft now outweighs everything before it. Binance lost more on the night of 29 October 2026 than the next ten thefts in the ledger together, and Bybit's, the record until then, was under a quarter of it.

  1. 29 Oct 2026Binance$6.3B
  2. 21 Feb 2025Bybit$1.5B
  3. 23 Mar 2022Ronin Network (Sky Mavis)$620M
  4. 10 Aug 2021Poly Network$611M
  5. 6 Oct 2022BNB Chain (BSC Token Hub)$570M
  6. 26 Jan 2018Coincheck$534M
  7. 28 Feb 2014Mt. Gox$473M
  8. 24 Sep 2026Bitget$387.5M
  9. 2 Feb 2022Wormhole$326M
  10. 31 May 2024DMM Bitcoin$305M
  11. 18 Apr 2026KelpDAO$292M
  12. 1 Apr 2026Drift Protocol$285M
  13. 25 Sep 2020KuCoin$281M
  14. 18 Jul 2024WazirX$235M
  15. 22 May 2025Cetus$223M
  16. 13 Mar 2023Euler Finance$197M
  17. 4 Dec 2021BitMart$196M
  18. 1 Aug 2022Nomad$190M
  19. 17 Apr 2022Beanstalk$182M
  20. 3 Nov 2025Balancer$128M
  21. 23 Jun 2022Harmony (Horizon bridge)$100M
  22. 18 Jun 2025Nobitex$90M
  23. 23 Jan 2025Phemex$85M
  24. 2 Aug 2016Bitfinex$72M
  25. 17 Jun 2016The DAO$60M
Each bar is drawn to the same scale: the amount stated at the time of the theft, in US dollars.

Ask about this page

Our AI analyst answers questions about this page from CryptoKeyhole’s own data and charts. Free with an account.

Asking opens a free account in a few seconds (a username and a password, no email); then the answer appears here.

Where the money is now

For the thefts on chains we run nodes for, and whose addresses are published or are where the victim's own wallet paid the coins, we read what is still there. Totals only: we don't follow coins past those addresses.

Binance, 29 Oct 2026

Read from our nodes at 23:28 UTC on 8 Nov 2026

Bitcoin still where the theft left it
17,832.5 BTC

of 18,270.2 BTC taken, in 19 wallets; 437.7 BTC has moved on

Stablecoins frozen in the thief's wallet
$2.0B

$1.18 billion of USDT and $823 million of USDC, frozen by Tether and Circle within 45 minutes of the sweep

Ether in that wallet now
0.0 ETH

it took 167,464 ETH in the sweep and has sent 729 transactions since

Bitcoin not movedMoved on

Bybit, 21 Feb 2025

Read from our Ethereum node at 23:28 UTC on 8 Nov 2026

Ether still at the FBI's 51 addresses
0.11 ETH

of 401,347 ETH taken: all but a trace has moved on, some of it into bitcoin, the FBI says

Stolen per year

The ledger by the year each theft happened. 2026 already holds more than any year before it: two exchanges, and a bridge and a protocol in April.

  1. $473M20141 theft
  2. –2015
  3. $132M20162 thefts
  4. –2017
  5. $534M20181 theft
  6. –2019
  7. $281M20201 theft
  8. $807M20212 thefts
  9. $2.0B20226 thefts
  10. $197M20231 theft
  11. $540M20242 thefts
  12. $2.0B20255 thefts
  13. $7.3B20264 thefts
Totals of the thefts in the ledger by the year they happened, in US dollars at the time.

How the money was taken

Up to 2022, 46% of the dollars in the ledger went through flaws in the code of bridges and protocols. Since 2023, 95% went through keys, signers and the systems around them: a signing screen, a laptop, a security product, a person.

Up to 2022 · $4.2B in 13 thefts

Keys, signers or the systems around them 54%A flaw in the code 46%

2023 to 2026 · $10.0B in 12 thefts

Keys, signers or the systems around them 95%A flaw in the code 5%

Share of the stolen dollars in the ledger by how they were taken.

The ledger

Newest first. Amounts are what was stated at the time, in US dollars, never revalued. A group is named only where a government authority has said so publicly.

DateOrganisationStated at the timeHowWhat came backNamed by an authoritySources
29 Oct 2026BinanceExchange$6.3BAfter a breach of its systems, signed permissions handed its busiest hot wallet to the attacker's code 18,270.2 BTC, 167,464 ETH and tokens from its hottest Ethereum wallet, XRP and moreBinance puts the frozen part at about $3 billionNorth Korea (TraderTraitor), per the FBI (quoted below)FBI alert, 31 Oct 2026 BleepingComputer, 1 Nov 2026
24 Sep 2026BitgetExchange$387.5MHot and warm wallets, through a flaw in a third-party security productBitget covered it from its protection fundNo authority statement quotedBleepingComputer, Sep 2026
18 Apr 2026KelpDAOBridge$292MThe system that watched the source chain for its bridge was taken over 116,500 rsETHArbitrum's Security Council froze 30,766 ETHNo authority statement quotedChainalysis, April 2026
1 Apr 2026Drift ProtocolDeFi protocol$285MIts people were tricked into handing over control of the vaults–No authority statement quotedTRM Labs, 2026 thefts
3 Nov 2025BalancerDeFi protocol$128MRounding in its pool maths, repeated in one transactionPart was frozen or recoveredNo authority statement quotedThe Block, biggest hacks of 2025
18 Jun 2025NobitexExchange$90MWallets emptied to addresses no one can spend fromDestroyed, not takenNo authority statement quotedThe Block, biggest hacks of 2025
22 May 2025CetusDeFi protocol$223MAn overflow check in its liquidity mathsSui validators froze about $162 millionNo authority statement quotedThe Block, biggest hacks of 2025
21 Feb 2025BybitExchange$1.5BThe signing screen of its multisig cold wallet was altered, so its signers approved a hidden change 401,347 ETH and staked ether tokens–North Korea (TraderTraitor), per the FBI (quoted below)Bybit incident update FBI public service announcement, 26 Feb 2025
23 Jan 2025PhemexExchange$85MHot wallets drained–No authority statement quotedThe Block, biggest hacks of 2025
18 Jul 2024WazirXExchange$235MIts multisig wallet's signing taken over–No authority statement quotedDecrypt, largest exploits of 2024
31 May 2024DMM BitcoinExchange$305MBitcoin taken from the exchange's wallet 4,502.9 BTCIts group covered customers; the exchange closed and moved accounts to another exchangeNo authority statement quotedDecrypt, largest exploits of 2024
13 Mar 2023Euler FinanceDeFi protocol$197MA donation function let the attacker leave a loan undercollateralised and liquidate itThe attacker returned itNo authority statement quotedEuler, behind the scenes of the recovery
6 Oct 2022BNB Chain (BSC Token Hub)Bridge$570MA forged proof the bridge's verifier accepted, minting new BNB 2 million BNBValidators halted the chain; most of the BNB never left itNo authority statement quotedBNB Chain blog Protos
1 Aug 2022NomadBridge$190MAn upgrade made every message pass as proven, so anyone could copy the withdrawalPart was returned by people who took itNo authority statement quotedSecurityWeek, 2 Aug 2022
23 Jun 2022Harmony (Horizon bridge)Bridge$100MTwo of the bridge's five signer keys taken over–North Korea (Lazarus Group and APT38), per the FBI (quoted below)CoinDesk, 23 Jan 2023
17 Apr 2022BeanstalkDeFi protocol$182MA flash loan bought enough votes to pass a proposal paying out the protocol–No authority statement quotedBeanstalk, governance exploit
23 Mar 2022Ronin Network (Sky Mavis)Bridge$620MFive of the bridge's nine validator keys taken over 173,600 ETH and 25.5 million USDC–North Korea (Lazarus Group and APT38), per the FBI (quoted below)Axios, 14 Apr 2022 BleepingComputer, 14 Apr 2022
2 Feb 2022WormholeBridge$326MA signature check the attacker could skip, so wrapped ether was minted unbacked 120,000 wETHJump Crypto replaced the 120,000 ETH the next dayNo authority statement quotedWeb3 Is Going Just Great
4 Dec 2021BitMartExchange$196MPrivate keys of two hot wallets–No authority statement quotedDigit, top crypto hacks 2020-2025
10 Aug 2021Poly NetworkBridge$611MA flaw that let the attacker change who could release fundsThe attacker returned most of it within weeksNo authority statement quotedAnalog, a timeline of bridge attacks
25 Sep 2020KuCoinExchange$281MHot wallets breached BTC, ETH and ERC-20 tokensMost of it was later recoveredNo authority statement quotedDigit, top crypto hacks 2020-2025
26 Jan 2018CoincheckExchange$534MNEM taken from a hot wallet 523 million NEM (58 billion yen)Coincheck repaid about 260,000 customers in yenNo authority statement quotedReuters factbox, 1 Feb 2018
2 Aug 2016BitfinexExchange$72MCoins taken from customer wallets it ran with a custody partner 119,756 BTCBitfinex repaid its customers by April 2017No authority statement quotedReuters factbox, 1 Feb 2018
17 Jun 2016The DAODeFi protocol$60MA recursive call in the fund's withdrawal code 3.6 million ETHReturned to depositors by the Ethereum hard fork of 20 Jul 2016No authority statement quotedEthereum Foundation, 20 Jul 2016
28 Feb 2014Mt. GoxExchange$473MCoins taken from the exchange's wallets over several years, announced as it stopped withdrawals 850,000 BTC (744,408 of its customers' and 100,000 of its own)It later found 200,000 BTC for its creditors; the trustee says the repayments are largely done and has moved the deadline for the rest to 31 Oct 2027No authority statement quotedReuters factbox, 1 Feb 2018 Trustee notice, 16 Oct 2026

What the authorities said

  • Binance, 29 Oct 2026. The FBI said on 31 Oct 2026 that North Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026 (source).
  • Bybit, 21 Feb 2025. The FBI said on 26 Feb 2025 that North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025 (source).
  • Harmony (Horizon bridge), 23 Jun 2022. The FBI said on 23 Jan 2023: we were able to confirm that the Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony's Horizon bridge (source).
  • Ronin Network (Sky Mavis), 23 Mar 2022. The FBI said on 14 Apr 2022: Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29th (source).

How we count

  • Each row is one theft from one organisation, dated when it happened, or when it was announced where it ran over time. The amount is the victim's own figure where it gave one, else an authority's, else the reporting cited.
  • The ledger holds the largest thefts we have checked against those sources, from Mt. Gox on; we add more as we check them. Totals are sums over the ledger, so they understate everything stolen.
  • We name a group only where a government authority has said so in public, and quote it. Private firms' attributions are not used.
  • On our own Bitcoin and Ethereum nodes we read the addresses the FBI published for Bybit, and for Binance the outputs and wallet its own published wallets paid the stolen coins to. We show totals only, and never follow coins past those addresses.
  • Frozen means a stablecoin issuer has blocked the wallet, which our node confirms with the issuer's own contract. Bitcoin and ether can't be frozen.

The ledger as data: /api/v1/hacks (free, no key).

Questions

What is the biggest crypto hack ever?

Binance's on 29 October 2026: about $6.3 billion by Binance's own count, most of it taken in about 20 minutes. The record before it was Bybit's, about $1.5 billion on 21 February 2025.

How much crypto was stolen in 2026?

The thefts in CryptoKeyhole's ledger for 2026 come to $7.26 billion across 4 thefts, led by Binance. The ledger holds the largest thefts only, so the full figure is higher.

Who was behind the Binance and Bybit hacks?

The FBI says North Korea was behind both. For Binance it says North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance", and for Bybit that it "was responsible for the theft of approximately $1.5 billion USD". The FBI calls the group TraderTraitor.

Can stolen crypto be frozen?

Stablecoins can: their issuers can block a wallet. Our Ethereum node shows $2.0 billion of USDT and USDC frozen in the Binance thief's wallet, blocked within 45 minutes of the theft. Bitcoin and ether can't be frozen, so they come back only if the thief returns them, as at Poly Network and Euler, or a chain's own validators step in.

Where is the bitcoin stolen from Binance?

At 23:28 UTC on 8 Nov 2026, 17,832.5 of the 18,270.2 BTC was still in the wallets the theft split it into in block 973,732; 437.7 BTC had moved on.

Exchange reserves, liveThe ledger as dataAll free tools

The ledger is compiled by CryptoKeyhole from the victims' and authorities' statements and the reporting cited; node readings are calculated from its own nodes. Nothing here is investment advice.