I wanted to put it in context: the biggest hacks on record, how each one happened, who was behind them, and what happened to the money afterwards. The pattern is remarkably consistent. The blockchains themselves are rarely broken; the keys, the people who hold them and the software around them are. North Korea has become the largest single source of thefts. And while several big exchanges have covered their customers' losses, most of the stolen money itself is never recovered.
The Binance figures are as of 6:30 p.m. Pacific on October 29, 2026, a few hours after the theft, and will be updated as the exchange publishes confirmed numbers. All other figures are dated where they appear; dollar amounts are at the time of each theft unless stated otherwise.
Jump to: The ten biggest · The full list · What was recovered · Latest on Binance
01What We Know About the Binance Hack
At 1:20 p.m. Pacific on Thursday, October 29, 2026, a single transaction on Ethereum carried 50 authorizations for one of Binance's hot wallets, the online wallets an exchange keeps for day-to-day withdrawals. Three minutes and 24 seconds later that wallet, labeled "Binance 14" on blockchain explorers, was emptied in one sweep: 167,464 ether, about 1.6 billion USDT and 63 other tokens. Money kept leaving other Binance addresses through the afternoon.
Confirmed
- Binance confirmed a security incident, paused withdrawals on several networks, then suspended all deposits and withdrawals while it investigates (5:13 p.m. Pacific).
- Binance said the verified total frozen was about $3 billion at 5:52 p.m. Pacific, up from $2.54 billion at 4:22 p.m., and could rise. Tether froze more than 1.567 billion USDT and Circle more than $800 million of USDC; Ripple, World Liberty Financial and Arbitrum's security council froze smaller amounts.
- "Binance will cover all losses," the company said, a promise co-CEO Yi He repeated. It has not said whether its SAFU emergency fund, about $1 billion and held in bitcoin, will pay.
- Binance has not published a loss figure. It says it will share only confirmed numbers, and a full post-mortem once the investigation is complete.
Estimated
- Chainalysis put the theft at about $5.9 billion, roughly four times Bybit. Arkham counted about $5.9 billion across 65 tokens in the attacker's addresses; Blockaid, looking only at hot wallet outflows on three chains, about $3.3 billion. Chainalysis has not published a breakdown, and some analysts caution that the larger tallies include bitcoin and Tron outflows not yet tied to the attacker.
- Founder Changpeng Zhao, who no longer runs Binance but is its largest shareholder, said the net loss after freezes might be "slightly over $1 billion." That is his estimate, not the company's.
- How: the early read from security firms is abuse of EIP-7702, an Ethereum feature that lets a wallet hand control to a smart contract, but only with that wallet's own signature. Blockaid's CEO said that points to a compromise of Binance's signing systems rather than a leaked key, and called it "very, very similar" to Bybit. Binance has not said how it happened.
- Who: no government agency has made an attribution. Blockaid's CEO said the attack resembles known North Korean operations.
Times are Pacific, October 29, 2026, from Binance's and executives' posts, issuer statements and blockchain records as reported by CoinDesk, The Block, TechCrunch, Cointelegraph and PANews.
If the estimates hold, this is the largest theft in the history of crypto by a wide margin. Even the amount already frozen is larger than everything taken from Bybit. It is not Binance's first breach: in May 2019 thieves took 7,000 bitcoin, about $40 million, from one of its hot wallets, and Binance covered it from SAFU. In October 2022 a bug in a bridge on BNB Chain, the blockchain Binance launched, let an attacker mint about $570 million of BNB, though only about $100 million got away.
The rest of this article is the history Binance just joined: who held the record before, how the thieves got in, who they were, and what happened to the money.
02The Record Book
For most of crypto's history, the record for the biggest theft moved up in steps. Mt. Gox held it from 2014, Coincheck took it in January 2018, Poly Network in August 2021, Ronin in March 2022 and Bybit in February 2025, which more than doubled the old record. The race below replays the list year by year.
One theft is missing from most lists. In December 2020, 127,426 bitcoin, then worth about $3.5 billion, left the wallets of LuBian, a Chinese mining pool, apparently because its keys were generated so weakly that they could be guessed. Nobody noticed in public until Arkham Intelligence found it in August 2025. In October 2025 the Justice Department filed to seize 127,271 of those bitcoin, saying they belong to Chen Zhi, the founder of the Prince Group, and China has accused the United States of taking them in a state hack. Because who owned the coins, and whether it was a hack at all, is in dispute, I have left LuBian out of the ranking; if it counted, it would be second only to Binance.
What counts. The rankings in this article cover thefts from crypto businesses and products: exchanges, bridges, DeFi protocols, wallet makers and similar services, including attacks like Coldcard's where a flaw in one product let thieves drain many users at once. They leave out thefts from a single person's own wallet, which are usually scams rather than hacks. Two of those would otherwise make the top 30: about 3,520 bitcoin, roughly $330 million, taken from an elderly American in April 2025 by social engineering and swapped into Monero, and more than 4,100 bitcoin, worth about $245 million, taken from a Washington, D.C. resident in August 2024 by callers posing as Google and Gemini support. Malone Lam pleaded guilty to a racketeering conspiracy charge over the second theft in September 2026.
03Every Major Hack, on One Line
Each circle is one theft, placed on the date it happened and sized by the dollars taken; hover over or tap a circle for its name and size. Two things stand out. The big ones cluster after 2020, when DeFi and the bridges between blockchains filled up with money. And the largest thefts are getting larger: Binance, Bitget and Liquid Network, three of the eleven largest counting Binance, all happened in 2026, and 2026 accounts for 5 of the top 30 before Binance.
The 30 largest thefts plus 5 notable smaller ones and Binance, in US dollars at the time. Mt. Gox is placed at its collapse in February 2014, although the coins were taken over several years.
04The Ten Biggest, Case by Case
Before Binance, these were the ten largest thefts from crypto businesses and products, ranked by dollars at the time. Three of them, Poly Network, Wormhole and Liquid Network, look much smaller once you count what was returned, and the BNB Chain figure is mostly tokens that never left the chain.
1. Bybit
Malicious code planted through a wallet software supplier made Bybit's own signers approve a transfer that handed over its cold wallet.
Who: North Korea (FBI)
Bybit stayed open and covered the gap within days with loans and purchases; only a few percent was ever frozen.
2. Ronin (Axie Infinity bridge)
A fake job offer gave attackers five of the nine keys guarding the bridge. Nobody noticed for six days.
Who: North Korea (FBI)
Sky Mavis raised $150 million and repaid users; about $36 million was seized or returned.
3. Poly Network
A flaw let the attacker replace the key that authorizes cross-chain withdrawals with their own.
Who: Unknown; the hacker gave it back
Almost all of it was returned within two weeks.
4. BNB Chain bridge
A forged proof let the attacker mint 2 million BNB out of thin air.
Who: Unattributed
The chain was halted; only about $100 million to $127 million actually got away.
5. Coincheck
About 523 million NEM tokens sat in a single internet-connected hot wallet that was drained after malware reached staff computers.
Who: Suspected North Korea (never charged)
Coincheck repaid about 260,000 customers about 46 billion yen in cash and was bought by Monex.
6. FTX (the hack only)
Hours after FTX filed for bankruptcy, thieves hijacked an employee's phone number and drained its wallets.
Who: A US SIM-swap ring (indicted 2024)
Separate from the fraud at FTX. The Justice Department put the theft at more than $400 million.
7. Mt. Gox
Keys to Mt. Gox's hot wallet were stolen around 2011 and coins were drained for years while the books still showed them.
Who: Two Russians charged (2023)
Bankrupt in 2014. Repayments began in July 2024 and the deadline now runs to October 31, 2027.
8. Bitget
A flaw in a third-party security product gave attackers internal credentials, and Bitget's own system signed their fake withdrawals.
Who: Suspected North Korea (Bitget's CEO; not confirmed)
Bitget says its user protection fund covers the loss.
9. Wormhole
A signature check was bypassed, minting 120,000 unbacked wrapped ether.
Who: Unattributed
Jump Crypto replaced the 120,000 ETH the next day, then clawed much of it back in 2023.
10. Liquid Network
A software bug let unbacked tokens be redeemed for real bitcoin.
Who: Self-described white hats
About 3,400 of the 4,000 BTC came back after a fix; the attackers kept about $47 million.
05How They Got In
Code exploits get the attention, but in this top 30 the biggest share of the dollars went another way. Stolen keys and tricked signers account for 59% of the dollars: someone got hold of the keys to a wallet, or fooled the people who hold them into approving a transaction they did not understand. Code bugs, the classic DeFi exploit, are a big part of the story too, at 27% of the dollars and 8 of the 30 thefts.
Stolen keys or tricked signers
Share of dollarsCode bugs
Share of dollarsPrice or vote manipulation
Share of dollarsInfrastructure and insiders
Share of dollarsOur classification of the 30 largest thefts in the table below, by dollars at the time. Bridges appear under code bugs when a flaw in the bridge was the way in, and under keys when the bridge's keys were stolen, as at Ronin.
The industry's own counts point the same way. Chainalysis found that private key compromises accounted for 43.8% of crypto stolen in 2024. In the first half of 2026, CertiK counted 204 code-vulnerability incidents costing $151.6 million, against 33 wallet compromises costing $444.5 million: the code bugs are far more common, but each key theft is far bigger. The playbook North Korea's hackers favor is social: a fake job offer at Ronin, a "coding test" from a fake recruiter at DMM Bitcoin, malicious code planted through a supplier at Bybit. The weak point is usually people and their computers, not the blockchain.
06The Annual Toll
Chainalysis, the blockchain analysis firm, has tracked hacking losses on a consistent basis since 2021. Its numbers below include its own revisions, which move earlier years as thefts are traced and attributed. The purple part of each column is the amount it attributes to North Korea.
Chainalysis Crypto Crime Reports, latest revision of each year (2025 runs through early December). *2026 is CertiK's count through September 30, 2026, which is not directly comparable and does not include Binance. Percentages are North Korea's share, our calculation from Chainalysis's figures.
North Korea's share has climbed from about one dollar in eight in 2021 to about three in five in 2024 and 2025. Add up Chainalysis's figures for 2022 through 2025 and North Korea took about $5.7 billion of the $11.1 billion stolen: roughly half, by our calculation. Chainalysis puts North Korea's total crypto theft at $6.75 billion or more.
That money has a purpose. A United Nations panel of experts reported in March 2024 that member states had told it cyberattacks bring in about half of North Korea's foreign currency and fund about 40% of its weapons of mass destruction programs, and the US Treasury has said the thefts pay for its nuclear weapons and ballistic missiles. For comparison, Chainalysis noted that North Korea's entire exports in 2020 were worth $142 million. Treasury has sanctioned crypto mixers and addresses tied to these hackers; the Sanctions Tracker follows every addition to the list.
07Then and Now
Dollar values at the time of a theft hide how much the stolen coins came to be worth. Mt. Gox lost about 850,000 bitcoin, then worth roughly $460 million. At Bitcoin's close on October 28, 2026, the day before the Binance hack, those coins were worth about $69 billion. The thefts paid in ether went the other way: Bybit's haul was worth less at the same date than when it was taken.
The coins taken (the full amount stolen, before any recoveries), valued at the time and at the October 28, 2026 daily close (bitcoin $81,340, ether $2,360). Most of these coins were never recovered and many were sold long ago, so the second set of figures shows what the stolen coins themselves became worth, not what the thieves made. Coincheck's NEM and the multi-token thefts are left out. Price history: Bitcoin price history.
Bitfinex is the most striking case. About 119,750 bitcoin, worth some $72 million when they were taken in 2016, were worth about $3.6 billion when the Justice Department seized about 94,600 of them in February 2022, then the largest financial seizure in its history. A court ordered them returned to Bitfinex. On October 8, 2026, the government moved about 12,267 of them, roughly $1 billion, to unlabeled wallets without saying why.
08What Happens to the Money
Getting customers paid back and getting the stolen money back are two different things. Some exchanges covered losses within days from their own money or investors'; other victims waited years for a partial repayment. Pick a theft to see how much was recovered or returned, how much was frozen, and how much simply got away.
Binance (2026, estimate): $5.91B taken. Binance's verified frozen total of about $3 billion (5:52 p.m. Pacific, October 29) against Chainalysis's preliminary estimate of about $5.9 billion taken. Frozen is not yet recovered. Customers: Binance says it will cover all losses.
Across the industry, the share that comes back has been small in most years, though the counts are not directly comparable. Immunefi counted 5.2% of losses recovered in 2022 and 7.7% in 2024; PeckShield put 2023 at about 25%, a year lifted by several hackers who returned funds in exchange for a bounty. Each figure is measured when its report was published, so recoveries that come years later, as at Bitfinex, are not in them. None of them count an exchange paying customers back from its own money: that is reimbursement, not recovery.
The getaway itself follows a pattern, especially for North Korea's crews. Stolen tokens are swapped for plain ether on decentralized exchanges within hours, then moved across bridges into bitcoin; Bybit's thieves pushed about $1.2 billion, 84% of the haul, through THORChain alone, by Bybit's own count in April 2025. From there the coins go through mixers and finally to over-the-counter brokers, many of them Chinese-language networks, which turn them into cash in small amounts over weeks or months. Stablecoins are the exception, because Tether and Circle can freeze them, which is why so much of the Binance freeze was in USDT and USDC.
The authorities have tried to close the mixers. Treasury sanctioned Blender in May 2022, the first mixer ever sanctioned, and Tornado Cash in August 2022, saying it had laundered more than $7 billion including over $455 million stolen by North Korea. A federal appeals court ruled in November 2024 that the Tornado Cash sanctions went too far, and Treasury lifted them in March 2025. Tornado Cash developer Roman Storm was convicted on one count in August 2025.
09The Full List
The 30 largest thefts from crypto businesses and products on record, plus Binance at its preliminary estimate and 5 notable smaller cases. Search by name, chain or attacker, filter by type or method, click a column to sort, or download the list.
| # | Victim and method | Date | Type | Taken | Attributed to |
|---|---|---|---|---|---|
| est. | BinanceNot yet known (preliminary reports point to its signing systems). Amount is a preliminary estimate of outflows | October 29, 2026 | Exchange | $5.91B | Not attributed yet |
| 1 | BybitStolen keys or tricked signers | February 21, 2025 | Exchange | $1.46B | North Korea (FBI) |
| 2 | Ronin (Axie Infinity bridge)Stolen keys or tricked signers | March 23, 2022 | Bridge | $625M | North Korea (FBI) |
| 3 | Poly NetworkCode bugs | August 10, 2021 | Bridge | $611M | Unknown; the hacker gave it back |
| 4 | BNB Chain bridgeCode bugs. Amount is BNB minted; about $100M left the chain | October 6, 2022 | Bridge | $570M | Unattributed |
| 5 | CoincheckStolen keys or tricked signers | January 26, 2018 | Exchange | $534M | Suspected North Korea (never charged) |
| 6 | FTX (the hack only)Stolen keys or tricked signers | November 11, 2022 | Exchange | $477M | A US SIM-swap ring (indicted 2024) |
| 7 | Mt. GoxStolen keys or tricked signers. Amount is coins lost over several years, valued at the 2014 collapse | February 2014 (stolen from 2011) | Exchange | $460M | Two Russians charged (2023) |
| 8 | BitgetStolen keys or tricked signers | September 24, 2026 | Exchange | $388M | Suspected North Korea (Bitget's CEO; not confirmed) |
| 9 | WormholeCode bugs | February 2, 2022 | Bridge | $326M | Unattributed |
| 10 | Liquid NetworkCode bugs | September 6, 2026 | Bridge | $320M | Self-described white hats |
| 11 | DMM BitcoinStolen keys or tricked signers | May 31, 2024 | Exchange | $305M | North Korea (FBI and Japanese police) |
| 12 | Kelp DAOInfrastructure and insiders | April 18, 2026 | Bridge | $292M | Likely North Korea (LayerZero, preliminary) |
| 13 | Drift ProtocolStolen keys or tricked signers | April 1, 2026 | DeFi | $285M | North Korea (TRM Labs, preliminary) |
| 14 | KuCoinStolen keys or tricked signers | September 25, 2020 | Exchange | $281M | North Korea (Chainalysis) |
| 15 | WazirXStolen keys or tricked signers | July 18, 2024 | Exchange | $235M | North Korea (US, Japan and South Korea) |
| 16 | Cetus ProtocolCode bugs | May 22, 2025 | DeFi | $223M | Unattributed |
| 17 | Mixin NetworkInfrastructure and insiders | September 23, 2023 | Other | $200M | Suspected North Korea |
| 18 | Euler FinanceCode bugs | March 13, 2023 | DeFi | $197M | Anonymous; returned the funds |
| 19 | BitMartStolen keys or tricked signers | December 4, 2021 | Exchange | $196M | Unattributed |
| 20 | NomadCode bugs | August 1, 2022 | Bridge | $190M | Many copycats; a suspect was extradited to the US in 2025 |
| 21 | BeanstalkPrice or vote manipulation | April 17, 2022 | DeFi | $182M | Unattributed |
| 22 | BitGrailInfrastructure and insiders | February 8, 2018 | Exchange | $170M | Unattributed; the owner's role was disputed |
| 23 | WintermuteStolen keys or tricked signers | September 20, 2022 | Other | $160M | Unattributed |
| 24 | Vulcan ForgedStolen keys or tricked signers | December 13, 2021 | Other | $140M | Unattributed |
| 25 | Cream FinancePrice or vote manipulation | October 27, 2021 | DeFi | $130M | Unattributed |
| 26 | BalancerCode bugs | November 3, 2025 | DeFi | $128M | Unattributed |
| 27 | MultichainInfrastructure and insiders | July 6, 2023 | Bridge | $126M | Unclear; the CEO had been detained in China |
| 28 | TectonicPrice or vote manipulation | August 30, 2026 | DeFi | $120M | Unattributed |
| 29 | PoloniexStolen keys or tricked signers | November 10, 2023 | Exchange | $120M | Suspected North Korea |
| 30 | Badger DAOInfrastructure and insiders | December 2, 2021 | DeFi | $120M | Unattributed |
| - | Coldcard wallet usersCode bugs | July 30, 2026 | Other | $116M | Unattributed |
| - | BitfinexStolen keys or tricked signers | August 2, 2016 | Exchange | $72M | Ilya Lichtenstein (pleaded guilty) |
| - | Harmony bridgeStolen keys or tricked signers | June 23, 2022 | Bridge | $100M | North Korea (FBI) |
| - | Atomic WalletInfrastructure and insiders | June 3, 2023 | Other | $100M | North Korea (Elliptic) |
| - | Binance (2019)Stolen keys or tricked signers | May 7, 2019 | Exchange | $41M | Unattributed |
US dollars at the time of each theft, as taken, unless the row says otherwise; ranges and disputed figures are explained in the text above, and what was recovered is in What Happens to the Money. Binance is a preliminary estimate (Chainalysis, October 29, 2026). Attributions are those made by governments, the companies hit or named analytics firms; "suspected" means no formal attribution.
Size Them Up
Crypto's biggest thefts keep getting bigger, and they keep happening the same way: not through some flaw in the blockchain, but through the keys, the signers and the computers that sit around it. North Korea is behind about half of the money taken in recent years. Several big exchanges, Bybit and KuCoin among them, covered their customers' losses within weeks; Mt. Gox's creditors waited more than a decade for part of theirs. Most of the stolen money itself is never recovered, although a few thefts, such as Poly Network and Bitfinex, were largely reversed. Binance says it will cover every dollar. How much it actually lost, and how it happened, will only be clear once it publishes its post-mortem.
More on DaveManuel.com: Bitcoin price history · the Sanctions Tracker · the 50 largest corporate bankruptcies
§Sources
- Binance hack, October 29, 2026: The Block; TechCrunch; CoinDesk; Cointelegraph (Blockaid); Finbold (frozen total); Chainalysis estimate, via InvestingLive; CryptoTicker (transaction timeline)
- Binance 2019 and BNB Chain 2022: TechCrunch; K33 Research
- FBI: North Korea responsible for $1.5 billion Bybit hack (February 26, 2025); DMM Bitcoin; Harmony bridge
- US Department of Justice: Bitfinex seizure (February 8, 2022); Mt. Gox charges (June 2023)
- Chainalysis: 2026 Crypto Crime Report, hacking; 2025 report; 2024 report; KuCoin
- 2026 totals: CertiK and PeckShield via Cointelegraph (October 1, 2026); TRM Labs on Drift; CoinDesk on Kelp DAO; Blockhead on Bitget; Security Affairs on Liquid Network
- LuBian: The Block, citing Arkham; Cointelegraph
- Recoveries and outcomes: Mt. Gox deadline; Bybit closes its deficit; AGBI on Bybit recoveries; Ronin recoveries; Wormhole; Cetus; WazirX
- Recovery rates: Immunefi 2022; Immunefi 2024; PeckShield 2023
- Laundering and sanctions: Treasury on Tornado Cash (August 8, 2022); Venable on the court ruling and delisting; Roman Storm verdict; The Block on the Bybit laundering
- North Korea: UN Panel of Experts, via Korea Times (March 2024); US Treasury (May 2023)
- Prices: KuCoin daily market report (October 28, 2026 close)
- Binance frozen total, 5:52 p.m.: FinanceFeeds; Cyber Kendra
- Bitfinex coins moved October 8, 2026: CoinCentral
- 2026 cases: TRM Labs on Coldcard; Decrypt on Coldcard estimates; Cronos reverses $111 million after Tectonic; Tectonic, unrecovered
- Other cases: rekt.news leaderboard (including Vulcan Forged, December 2021) and the post-mortems it links