The Biggest Crypto Hacks of All Time (Updated 2026)

Why Crypto Gets Hacked at Scale

Tens of billions of dollars in cryptocurrency have been stolen since Bitcoin’s earliest exchanges opened their doors. The pace has not slowed: 2022 was the worst year on record for crypto theft, and 2025 opened with the largest single exchange hack in history when Bybit lost $1.46 billion in a single transaction. Cryptocurrency is uniquely attractive to attackers because transactions are irreversible, identities are pseudonymous, and even a moderately well-funded team can write code that controls hundreds of millions of dollars. Hot wallets at centralized exchanges represent concentrated pools of private keys held online around the clock, and a single compromised key can drain an entire treasury.

Several factors compound the risk. Smart contract code is immutable once deployed, so a single logic flaw becomes a permanent vulnerability. Cross-chain bridges must trust external validators or cryptographic proofs, and either can be manipulated. State-sponsored groups, notably North Korea’s Lazarus Group, have turned crypto theft into a strategic revenue stream, reportedly funding weapons programs with the proceeds. The FBI and multiple blockchain intelligence firms have attributed billions in losses to Lazarus alone, with attacks ranging from social-engineered LinkedIn recruiter scams to sophisticated multisig UI poisoning that tricks human signers into approving malicious transactions.

Every Major Hack, Newest to Oldest

The table below lists the largest confirmed crypto thefts and exploits on record, ordered from most recent to oldest.

This table counts confirmed thefts only. Some of the most alarming recent scares were caught before any funds moved. In June 2026, Zcash developers disclosed a critical counterfeiting flaw in the Orchard shielded pool that had gone undetected for roughly four years, then patched it through an emergency hard fork after a security audit uncovered it. No ZEC was ever proven stolen, yet the price still fell sharply on the news, a reminder that with privacy-preserving systems the mere possibility of an undetectable exploit can be almost as damaging as a confirmed breach.

The Three Favourite Targets

Looking across the full timeline, three categories account for the overwhelming majority of losses. The oldest and most persistent target is the centralized exchange, where private keys protecting pooled customer funds sit online and accessible around the clock. From Mt. Gox in 2014 to Bybit in 2025, the core attack vector has barely changed: obtain the key, drain the wallet. Exchanges have layered in multisig wallets, hardware security modules and withdrawal whitelists, but each additional control also creates a new surface. A compromised signing UI, a social-engineered employee or a stolen API credential can still unravel years of security investment in minutes.

Cross-chain bridges emerged as the dominant loss category in 2022, accounting for billions of dollars in a single year. Bridges present an inherently complex security problem: they must lock assets on one chain and mint representations on another, often relying on a small set of validators or a cryptographic proof mechanism. Compromise any critical link in that chain and the entire locked pool is exposed. The Ronin Network hack, the Wormhole exploit, the Nomad free-for-all and the BNB Chain bridge incident all struck within twelve months of each other. The aggregate losses from bridge hacks across the table run to several billion dollars, more than any other single category.

DeFi protocols round out the three main targets, with flash loans serving as the enabler of choice. Flash loans allow an attacker to borrow tens or hundreds of millions of dollars within a single transaction block, use those funds to manipulate oracle prices or pass governance votes, then repay the loan, pocketing the profit with no upfront capital. The DAO in 2016 established the blueprint with a reentrancy attack; Beanstalk Farms in 2022 demonstrated that governance itself can be weaponized when it lacks flash-loan-resistant vote counting; and Euler Finance in 2023 showed that even audited code can contain logic flaws subtle enough to be missed until someone with a large enough flash loan finds them. Throughout all three categories, Lazarus Group has proved the most prolific single actor, using social engineering, key theft and sophisticated laundering infrastructure to extract and clean funds at a scale no criminal group has matched.

The All-Time Top 5

The five largest individual incidents tell the story of how crypto security threats have evolved over a decade. Mt. Gox, the Tokyo-based exchange that collapsed in February 2014, lost roughly 650,000 BTC to a slow drain that had been running for years before anyone noticed, exposing the catastrophic risk of a single hot wallet with no meaningful monitoring. Coincheck, another Japanese exchange, repeated a strikingly similar failure in January 2018 when $530 million in NEM tokens was taken from a hot wallet that lacked even basic multisig protection. Both incidents triggered major regulatory overhauls in Japan. Then came the bridge era: Poly Network’s $611 million hack in August 2021 became the largest crypto theft ever recorded at the time, only to be eclipsed within a year by the $540 million Ronin Network breach, where Lazarus Group spent six days in control of the bridge before anyone realised the funds were gone. Finally, February 2025 saw Bybit lose $1.46 billion in a single transaction to a UI-layer attack so sophisticated it deceived experienced human signers reviewing what appeared to be a legitimate multisig approval. Each record-breaker has reflected the dominant infrastructure of its era, and each has reshaped how the industry thinks about custody and key management.

How to Protect Your Crypto

• Store long-term holdings on a hardware wallet that keeps private keys offline and requires physical confirmation for every transaction.
• Write your seed phrase on paper and store it securely offline. Never photograph it, type it into any website, or share it with anyone, including support staff.
• Verify website URLs carefully before connecting a wallet or signing any transaction. Bookmark the official addresses of platforms you use and stay alert to phishing sites that differ by a single character or use lookalike domains.
• Enable two-factor authentication using an authenticator app rather than SMS. SIM-swapping attacks have enabled several major thefts, including the unauthorized $477 million FTX wallet drain in November 2022.
• Only keep on an exchange the funds you need for active trading. Assets sitting on a platform rely entirely on that exchange’s security, not yours.
• Revoke unused token approvals regularly. Tools that audit your on-chain permissions can remove access granted to contracts you no longer use, eliminating a common attack surface exploited in hacks like BadgerDAO.
• Before signing any transaction, verify the contract address, the amount and the recipient independently, not only in the wallet UI, which can itself be compromised as the Bybit and BadgerDAO attacks demonstrated.

Bottom Line

By 2026, the crypto security landscape looks meaningfully different from 2014. Mandatory smart contract audits, formal verification, multi-party computation for key management, bug bounty programmes and slower bridge designs with time-locked withdrawals have all become standard at serious projects. Regulators in Japan, the EU and the US have imposed requirements that push exchanges toward cold-storage minimums and insurance reserves. Blockchain analytics firms can trace and freeze stolen funds faster than ever, and state-level attribution of North Korean hacks has moved from speculation to official FBI indictments. Yet the pace of theft has not meaningfully declined, because the value at stake keeps rising and sophisticated attackers adapt to each new control.

The hardest lesson the industry keeps relearning is that crypto’s core property, the irreversibility that makes it valuable as a settlement layer, is also what makes every theft permanent. There is no central authority to reverse a transaction, no deposit insurance scheme to restore funds automatically, no fraud department to call. That responsibility falls on users and builders alike. For individuals, the practical implication is straightforward: the safest crypto is crypto held in self-custody with robust key management, as explored in detail in our guide to the top hardware wallets for cryptocurrency security. The hacks in this table are not cautionary tales about cryptocurrency itself, but about the persistent gap between how securely assets can be held and how carelessly they sometimes are.