$15 Billion Vanished: The 10 Largest Crypto Heists in History
From exchange breaches to bridge exploits, the biggest thefts shifted from code bugs to compromised keys, people and permissions.
$15.0B
Combined estimated loss across the top 10
42%
Share of the total from one breach: Binance, $6.36B
57%
Of value traced to North Korea-linked groups ($8.5B, 3 heists)
$1.8B
Lost across 3 cross-chain bridge exploits
Section 01 · The Leaderboard
Ranked by estimated loss
Binance’s $6.36B is 1.8x the next-largest loss and 42% of all ten combined.
01
BinanceExchange infrastructure breach · 2026
$6.36B
02
LuBianLargest historical loss in the 9cv9 table · 2020
$3.5B
03
BybitSafe Wallet UI compromise · 2025
$1.5B
04
Ronin NetworkCross-chain bridge exploit · 2022
$624M
05
Poly NetworkCross-chain bridge hack · 2021
$611M
06
BNB BridgeBSC Token Hub bridge hack · 2022
$570M
07
CoincheckNEM hot-wallet theft · 2018
$534M
08
Mt. GoxExchange hack and collapse · 2014
$470M
09
FTXUnauthorized wallet transfers · 2022
$450M
10
BitgetMulti-chain signing service hack · 2026
$388M
Estimated losses at time of incident, as listed in the 9cv9 comparison table. Figures are approximate and differ between investigators.
Section 02 · Case Files
How the biggest heists were pulled off
Eight of the ten have a documented attack chain in the source article.
EVIDENCE #01Oct 29, 2026
Binance
$6.36B
Attack vector
Suspected compromised DevOps workstation gave access to withdrawal and signing systems; Ethereum EIP-7702 delegation abused via 50 pre-signed authorizations.
Attribution
TraderTraitor (North Korea-linked, per TRM Labs; an intelligence assessment)
Outcome
~$2.7B to $3B frozen; Binance pledged to cover customer losses
EVIDENCE #03Feb 21, 2025
Bybit
~$1.5B
Attack vector
Safe Wallet supply-chain attack: malicious JavaScript hid a delegatecall from signers and handed over the cold wallet (401,347 ETH).
Attribution
TraderTraitor, per FBI attribution (Feb 26, 2025)
Outcome
Bybit absorbed the loss; customer assets stayed fully backed
EVIDENCE #04Mar 23, 2022
Ronin Network
$624M
Attack vector
Spear-phishing exposed 4 validator keys; an expired but unrevoked Axie DAO permission supplied the 5th of 5-of-9. Detected after about 6 days.
Compromised wallet servers and keys enabled repeated transfers over years; weak reconciliation hid ~850,000 missing BTC.
Attribution
Two Russian nationals charged by US DOJ in 2023 (allegations)
Outcome
~200,000 BTC found in 2014; creditor repayments began Jul 2024
EVIDENCE #09Nov 11-12, 2022
FTX
$450M
Attack vector
Suspected SIM-swapping and account compromise led to unauthorized wallet access; the full chain was never established.
Attribution
Not named in this case
Outcome
Tether and Paxos froze selected assets; rest moved to cold storage
Section 03 · Recovery
How much came back?
Recovery ranged from nearly everything to almost nothing. Share of stolen value recovered, frozen or contained.
Poly NetworkReturned or frozen within days
~100%
BNB BridgeContained by chain halt
82.5%
BinanceFrozen so far; probe ongoing
42-47%
Mt. Gox200k of ~850k BTC found
~24%
Ronin Network~$35.7M of $624M recovered
~6%
Approximate, from article figures. Binance hatched segment shows the range of $2.7B to $3B frozen (42% to 47%). Company reimbursements are not counted as recovery.
Section 04 · Root Causes
Five failure patterns repeat
Recent losses come more from custody, signing and operational access than from pure smart-contract bugs.
