The biggest crypto exchange hacks in history, and what happened next

Exchanges hold enormous sums in one place, which makes them the most attractive targets in crypto. Below are ten of the most important exchange hacks. The list shows more than the size of each theft. What happened to customers afterward is often the more useful lesson, and it varies widely.

Ten major exchange hacks at a glance

Dollar amounts are approximate values at the time of each incident. Sources often disagree on exact figures.

The stories behind the numbers

Mt. Gox: the case that defined the risk

In the early 2010s Mt. Gox handled a large share of all bitcoin trading. In February 2014 it halted withdrawals and filed for bankruptcy protection in Tokyo, reporting about 850,000 BTC missing. Later analysis suggested coins had been drained from its hot wallet gradually, starting in late 2011, without anyone noticing. Roughly 200,000 BTC were later found in an old wallet. A repayment plan was not approved until 2021, seven years after the collapse.

Bitfinex: when everyone shares the loss

After the 2016 theft, Bitfinex spread the damage across all users by cutting balances 36% and issuing BFX tokens as an IOU. It redeemed those within eight months. Years later, Ilya Lichtenstein admitted to being the hacker, and US authorities seized billions of dollars of the stolen bitcoin, whose value had soared.

Coincheck: a hot wallet full of NEM

In January 2018 about 500 million NEM tokens were taken from Coincheck, the largest theft to that date. The exchange first suggested it might not be able to compensate everyone, then said it would repay all 260,000 affected users from its own capital. Japan's regulator ordered improvements, and Monex Group bought the company.

WazirX: the slow recovery

India's WazirX lost about $235 million from a multi-signature wallet in July 2024, close to half of its reported reserves. Trading stopped for more than a year. A Singapore court sanctioned a restructuring in October 2025, and users received roughly 85% of their rebalanced holdings. This is what a hack looks like when an exchange can't simply absorb the loss.

Bybit: a record that lasted 20 months

The February 2025 theft of about 400,000 ETH was the largest in crypto history at the time. It was attributed by the FBI to North Korea's TraderTraitor group. Reports point to compromised infrastructure at a third-party wallet provider. Bybit secured emergency funding and rebuilt its reserves within 72 hours.

Bitget and Binance: two major hits in five weeks

In late September 2026 Bitget lost at least $350 million, an estimate later raised to $387.5 million. Its CEO said attackers breached a backend system in its wallet infrastructure and blamed North Korean hackers. Five weeks later Binance lost around $6.3 billion. We cover that attack in detail in The $6.3 billion Binance hack explained.

What these hacks have in common

• Hot wallets are the usual target. Exchanges need online funds to process withdrawals, and those online funds are what most attackers reach.
• People are the weakest link. Phishing, fake job offers and compromised staff laptops appear again and again.
• Third parties matter. Bybit and WazirX both involved outside wallet or custody services.
• North Korea is a repeat actor. Investigators or the companies themselves have linked KuCoin, DMM, WazirX, Bybit, Bitget and Binance to North Korea-linked groups.
• The outcome depends on the balance sheet. Large exchanges have repaid customers. Weaker ones have left them with haircuts, long waits or nothing.

What about FTX?

You may wonder why FTX isn't on this list. Its 2022 collapse was primarily a corporate failure involving customer funds, not an outside hack. For a customer the effect was similar, though: the money in the account wasn't accessible. It's a reminder that hackers are only one of the ways an exchange can fail you.

How to reduce your exposure

You can't control an exchange's security, but you can control how much you keep there. For money you don't plan to trade soon, many people use self-custody. Self-custody has its own risks, which we explain honestly in Exchange or wallet: where should you keep your crypto? When you're ready, follow our step-by-step transfer guide.

Sources

• Crystal Intelligence: The 10 biggest crypto hacks in history
• Wikipedia: Mt. Gox
• Wikipedia: Bitfinex
• Wikipedia: Coincheck
• Wikipedia: KuCoin
• Wikipedia: WazirX
• Wikipedia: Bybit
• Wikipedia: Binance
• BleepingComputer: Bitget resumes bitcoin withdrawals
• CNBC: Binance's $6.3 billion hack