Finder makes money from featured partners, but editorial opinions are our own.

Biggest Crypto Hacks of All Time

The methods keep changing, but one thing remains constant: billions can disappear remarkably fast.

Key takeaways

  • Bybit suffered the largest recorded crypto theft, with approximately $1.4 billion in cryptocurrency stolen in February 2025.
  • Ronin Network, Poly Network and BNB Bridge are among the largest crypto hacks on record, with approximately $624 million, $611 million and $586 million stolen or exploited, respectively.
  • Recent attacks increasingly target the infrastructure surrounding blockchain networks, including transaction-signing systems, private keys, wallets and bridge software, rather than the underlying blockchains themselves.

A crypto hack is a broad term for the unauthorized theft or movement of cryptocurrency through a compromised exchange, wallet, smart contract, bridge or other crypto infrastructure. This includes attacks that exploit software vulnerabilities as well as breaches involving private keys, transaction-signing systems or other security controls.

The Bybit hack in February 2025 is currently the largest recorded crypto theft, with approximately $1.4 billion to $1.5 billion in cryptocurrency stolen.(1) But the biggest attacks have changed significantly over time.

While early crypto hacks often targeted exchanges and wallets, more recent incidents have exploited smart contracts, cross-chain bridges, private-key infrastructure, signing processes and other systems surrounding blockchain networks.

Great for copy trading

27a1d51c-5114-4e22-bf0c-4cc0ec165377-
  • Trade leading cryptocurrencies including BTC and ETH
  • Copy top crypto investors with eToro's innovative CopyTrader
  • Access ready-made portfolios built by eToro experts for instant investment direction

Great for beginners

69343352-7538-4efe-b479-c23cdb9a2915-
  • Bank, borrow, invest and trade crypto in one app without moving funds between platforms.
  • Trade 27 major cryptocurrencies, including BTC, ETH, SOL, ADA and XRP.
  • Benefit from SoFi’s chartered-bank safeguards, including compliance controls.
  • Access 24/7 support through chat, phone and email for troubleshooting and live human assistance.
Disclaimer
CRYPTOCURRENCY AND OTHER DIGITAL ASSETS ARE NOT FDIC INSURED • ARE NOT BANK GUARANTEED • MAY LOSE VALUE

Cryptocurrency and digital assets are not insured by the FDIC, not bank guaranteed, and may lose value. See account agreement for additional terms and conditions.

Advanced crypto trading

a2c6b5e1-1caf-4f34-8aac-0b2a722c2971-
  • Buy/sell 170+ cryptocurrencies
  • 24/7 customer support
  • Supports EUR, USD, GBP, CAD, AUD, CHF and JPY

Disclaimer: This page is not financial advice or an endorsement of digital assets, providers or services. Digital assets are volatile and risky, and past performance is no guarantee of future results. Potential regulations or policies can affect their availability and services provided. Talk with a financial professional before making a decision. Finder or the author may own cryptocurrency discussed on this page.

Biggest crypto hacks at a glance

The table below highlights the biggest crypto hacks by the approximate value of cryptocurrency stolen or exploited at the time of each attack.

HackDateAmount stolenAttack typeFunds recovered?
BybitFeb. 2025~$1.436BWallet/signing compromiseLimited
Ronin NetworkMar. 2022~$624MPrivate-key/validator compromisePartial
Poly NetworkAug. 2021~$611MSmart-contract exploitMostly returned
BNB BridgeOct. 2022~$586MBridge exploitSignificant funds frozen
FTXNov. 2022~$477MWallet compromisePartial/unclear
WormholeFeb. 2022~$326MBridge/smart-contract exploitReplenished
Liquid NetworkSept. 2026~$320MSoftware/bridge exploit~85% returned
DMM BitcoinMay 2024~$304MPrivate-key compromiseCustomers reimbursed

Methodology note: Amounts and rankings are based on Rekt’s historical hack leaderboard, using the approximate USD value of assets stolen or exploited at the time of the incident. Figures can vary between sources depending on how losses and recovered funds are calculated.

1. Bybit — approximately $1.4 billion

In February 2025, attackers exploited the transaction-signing process for one of Bybit’s Ethereum (ETH) cold wallets, stealing approximately $1.4 billion in cryptocurrency in what remains the largest recorded crypto theft.(1)

DateFebruary 21, 2025
Amount stolenApproximately $1.436 billion
Attack typeWallet/signing compromise
TargetBybit-controlled Ethereum cold wallet
RecoveryLimited

What happened?

  • Attackers compromised a Safe developer’s computer and used malicious JavaScript to manipulate the Safe wallet interface used by crypto exchange Bybit. The interface showed signers what appeared to be a routine transfer while concealing the malicious transaction.
  • Bybit’s signers unknowingly approved a transaction that changed the cold wallet’s smart-contract logic, giving the attackers control of the wallet.
  • The attackers drained approximately 401,000 ETH, along with stETH, cmETH and mETH, worth approximately $1.46 billion at the time.(4)
  • The stolen assets were split across numerous intermediary wallets before attackers converted significant portions of the ETH into other cryptocurrencies, including bitcoin and DAI.

Why it matters

  • It is the largest recorded cryptocurrency theft, surpassing the previous record by hundreds of millions of dollars.(2)
  • The attack demonstrated that multisig and cold-storage systems can still be compromised through the software and interfaces used to manage them, rather than by directly breaking the underlying blockchain or wallet cryptography.
  • It highlighted the importance of independently verifying transaction details before signing, particularly when managing large amounts of cryptocurrency through third-party wallet infrastructure.

2. Ronin Network — approximately $624 million

The Ronin Network bridge was compromised in March 2022 after attackers obtained enough validator keys to authorize fraudulent withdrawals, draining 173,600 ETH and 25.5 million USD Coin (USDC).(5)

DateMarch 23, 2022
Amount stolenApproximately $624 million
Attack typePrivate-key/validator compromise
TargetRonin Network bridge
RecoveryPartial

What happened?

  • The Ronin bridge required five of nine validator signatures to approve withdrawals. Attackers compromised four validator keys belonging to Sky Mavis and gained access to a fifth through a previously granted Axie DAO signing authorization.
  • With five keys under their control, the attackers forged two legitimate-looking withdrawal transactions and drained 173,600 ETH and 25.5 million USDC from the bridge.(6)
  • The theft went undetected for six days. It was discovered on March 29 after a user reported being unable to withdraw 5,000 ETH from the bridge.(6)
  • The FBI later attributed the attack to North Korea’s Lazarus Group, and investigators traced portions of the stolen cryptocurrency through various wallets and mixing services.

Why it matters

  • Concentrated validator control created a major security risk. Although the bridge used a nine-validator system, compromising five keys was enough to authorize withdrawals.
  • The attack highlighted the security risks of cross-chain bridges, where large pools of assets are held in contracts and controlled by a relatively small number of validators.

3. Poly Network — approximately $611 million

In August 2021, an attacker exploited a flaw in Poly Network’s cross-chain smart contracts to gain control of the protocol’s transaction-authorization system and drain approximately $611 million in cryptocurrency.(7)

DateAugust 10, 2021
Amount stolenApproximately $611 million
Attack typeSmart-contract/access-control exploit
TargetPoly Network
RecoveryMost funds returned

What happened?

  • The attacker exploited a flaw in Poly Network’s smart contracts that allowed them to gain control of the protocol’s transaction authorization system.
  • They used that access to move approximately $611 million in tokens across Ethereum, BNB Chain (BNB) and Polygon.(7)
  • The attacker began returning the funds within days, and Poly Network ultimately recovered the assets stolen during the incident.

Why it matters

  • A single smart-contract vulnerability can put hundreds of millions of dollars at risk.
  • Cross-chain bridges are particularly attractive targets because they can control large pools of assets across multiple blockchains.

4. BNB Bridge — approximately $586 million

In October 2022, attackers exploited a vulnerability in BNB Chain’s cross-chain bridge to forge transaction proofs and create roughly 2 million BNB, although most of the tokens were frozen before they could be moved off the network.(8)

DateOctober 6, 2022
Amount stolen/exploitedApproximately $586 million
Attack typeCross-chain bridge/proof-verification exploit
TargetBNB Bridge (BSC Token Hub)
RecoverySignificant funds frozen

What happened?

  • The attacker exploited a bug in the BSC Token Hub bridge that allowed them to forge a proof of a legitimate cross-chain transaction.
  • The forged proof allowed the attacker to withdraw approximately 2 million BNB, worth about $568–$586 million at the time.(8)
  • BNB Chain validators suspended the network and froze a large portion of the newly created BNB. Estimates suggest roughly $100–$110 million ultimately left the BNB Chain.(9)

Why it matters

  • The attack demonstrated the risks of cross-chain bridges, which can become major targets because they control large pools of assets and rely on complex transaction-verification systems.
  • It also showed why bridge transactions need robust proof verification: the attacker did not need to steal users’ existing BNB; exploiting the bridge allowed them to create new tokens.

5. FTX wallet breach — approximately $477 million

Hours after FTX filed for bankruptcy, hundreds of millions of dollars in cryptocurrency were transferred from wallets controlled by the exchange in what became one of the largest exchange wallet breaches on record. Chainalysis estimated that approximately $400 million was stolen in the immediate aftermath.(10)

DateNovember 12, 2022
Amount stolenApproximately $477 million
Attack typeWallet compromise/unauthorized withdrawals
TargetFTX-controlled wallets
RecoveryPartial/unclear

What happened?

  • Attackers moved cryptocurrency from FTX-controlled wallets shortly after the exchange filed for bankruptcy, with approximately $400 million initially identified as stolen.(10)
  • The stolen assets were transferred to external wallets and subsequently moved through multiple blockchains and cryptocurrency services, making the funds more difficult to trace and recover.
  • The timing and unusual nature of the transactions led to uncertainty about whether the withdrawals were the work of an external attacker or an insider. FTX itself reported unauthorized transactions as the breach unfolded.

Why it matters

  • The incident shows the risks of centralized crypto custody, particularly when an exchange is experiencing a major operational crisis.
  • It also demonstrates why the FTX collapse and the wallet breach should be treated as separate events: the exchange’s collapse involved alleged financial misconduct and misuse of customer funds, while this incident involved unauthorized transfers from FTX-controlled wallets.

6. Wormhole — approximately $326 million

In February 2022, an attacker exploited a vulnerability in Wormhole’s Solana smart contract to mint roughly 120,000 ETH worth of unbacked tokens, resulting in one of the largest DeFi bridge hacks on record.(11)

DateFebruary 2, 2022
Amount stolenApproximately $326 million
Attack typeBridge/smart-contract exploit
TargetWormhole bridge
RecoveryFunds replenished

What happened?

  • The attacker exploited a vulnerability in Wormhole’s Solana contract that allowed them to bypass the bridge’s Guardian signature verification and make it appear that ETH had been deposited on Ethereum.
  • Using the fraudulent verification, the attacker minted approximately 120,000 wrapped ETH (whETH) on Solana without depositing the equivalent ETH on Ethereum.(11)
  • The attacker moved about 93,750 ETH back to Ethereum, while converting much of the remaining whETH into other assets on Solana. Jump Crypto, which helped investigate the attack, subsequently replenished the missing ETH so the bridge could continue operating.(12)

Why it matters

  • The attack demonstrated how a vulnerability in cross-chain bridge software can create hundreds of millions of dollars in losses.
  • It also showed the risks of relying on automated cross-chain verification: if a bridge incorrectly accepts a message as legitimate, an attacker can potentially mint or release assets that were never deposited on the source blockchain.

7. Liquid Network — approximately $320 million

In September 2026, attackers exploited a bug in Liquid Network’s transaction-validation software to create unbacked L-BTC and redeem it for approximately $320 million in real bitcoin.(3)

DateSeptember 6, 2026
Amount stolenApproximately $319–$320 million
Attack typeSoftware/bridge exploit
TargetLiquid Network validator infrastructure
RecoveryApproximately 85% returned

What happened?

  • A vulnerability in Liquid’s Elements validation software allowed the attackers to create approximately 4,000 unbacked L-BTC without depositing the equivalent amount of bitcoin (BTC) into Liquid’s reserves.(3)
  • The attackers redeemed the newly created L-BTC through Liquid’s peg-out process, resulting in roughly 4,000 BTC worth about $320 million being withdrawn from the federation’s reserve wallet. Liquid said its signing keys were not compromised.(13)
  • The attackers later described themselves as white hats and returned 3,400 BTC, or about 85% of the stolen funds, after the vulnerability was patched. Approximately 598.5 BTC, worth about $47 million, remained with the attackers.(3)

Why it matters

  • It was the largest crypto theft of 2026 so far, according to TRM Labs.(3)
  • The attack didn’t require a stolen private key: a software vulnerability allowed the attackers to create the asset they later exchanged for real bitcoin.
  • It highlights the risks of infrastructure supporting cross-chain transactions, where a flaw in transaction validation can expose large reserves even when the underlying Bitcoin network and signing keys remain secure.

8. DMM Bitcoin — approximately $304 million

In May 2024, attackers compromised infrastructure connected to Japanese exchange DMM Bitcoin and transferred 4,502.9 BTC, worth approximately $304–$308 million at the time, from the exchange’s wallet.(14)

DateMay 30, 2024
Amount stolenApproximately $304 million
Attack typePrivate-key/signing compromise
TargetDMM Bitcoin wallet
RecoveryCustomers reimbursed

What happened?

  • Attackers gained access to infrastructure used by DMM Bitcoin and manipulated transaction requests, resulting in 4,502.9 BTC being transferred to an unauthorized wallet.(15)
  • The stolen bitcoin was subsequently moved through multiple intermediary addresses, including a CoinJoin mixing service and bridging services, making the funds more difficult to trace.
  • DMM Bitcoin restricted some services following the breach and said it would fully reimburse customers’ lost bitcoin using funds from its group companies.

Why it matters

  • The attack again illustrates the risks of centralized exchange custody: compromising systems that authorize transactions can expose hundreds of millions of dollars in customer assets.
  • It also highlights the importance of private-key and transaction-signing security. Chainalysis found that private-key compromises accounted for 43.8% of stolen crypto in 2024.(16)

Methodology: How we ranked the biggest crypto hacks

We ranked these hacks using Rekt’s historical leaderboard and the approximate US dollar value of cryptocurrency stolen or exploited at the time of each incident. This means we don’t recalculate historical thefts based on today’s crypto prices, and the amount stolen may differ from the eventual net loss if some funds were frozen, recovered or returned.

Crypto hack figures can also change as investigations uncover new information, so amounts should be treated as estimates rather than exact figures.

We use Rekt consistently for the ranking and supplement individual entries with statements from the affected company or protocol, Chainalysis, TRM Labs, CertiK and law-enforcement agencies where available.

Compare crypto exchanges

5 of 17 results
Finder Score Fiat currencies Cryptocurrencies Deposit methods Disclaimer
8.6Great
50
1086
Cryptocurrency, PayPal, P2P
Not available for US citizens
Go to site

Capital at risk

More info
Compare product selection
8Great
73
281
Bank transfer, Credit card, Cryptocurrency, Debit card, P2P
Disclaimer: Highly volatile investment product. Your capital is at risk. Not available for US citizens
Go to site

Capital at risk

More info
Compare product selection
8.4Great
141
753
Bank transfer, Credit card, Cryptocurrency, Debit card, Apple Pay, Google Pay
Not available for US citizens
Go to site

Capital at risk

More info
Compare product selection
OKX logo
9.4Excellent
OKX Cryptocurrency Exchange
9.4Excellent
1
181
Bank transfer (ACH), Debit card, Wire transfer, Apple Pay, Google Pay, Plaid
Go to site

Capital at risk

More info
Compare product selection
eToro logo
8.2Great
eToro USA LLC Cryptocurrency Trading
Finder Award
8.2Great
26
105
Bank transfer, Debit card, PayPal, Wire transfer
Crypto Trading is offered via eToro USA LLC (NMLS ID: 1769299). This entity is not a registered broker-dealer or FINRA member and your cryptocurrency holdings are not FDIC or SIPC insured. Investments are subject to market risk, including the possible loss of principal.
Important information
Cryptocurrency is offered by eToro USA LLC (“the MSB”) (NMLS: 1769299) and is not FDIC or SIPC insured. Investing involves risk, and content is provided for educational purposes only, does not imply a recommendation, and is not a guarantee of future performance. [website domain name] is not an affiliate and may be compensated if you access certain products or services offered by the MSB.
Go to site

Capital at risk

More info
Compare product selection
loading
Showing 5 of 17 results
Disclaimer: Cryptocurrencies are speculative, complex and involve significant risks – they are highly volatile and sensitive to secondary activity. Performance is unpredictable and past performance is no guarantee of future performance. Consider your own circumstances, and obtain your own advice, before relying on this information. You should also verify the nature of any product or service (including its legal status and relevant regulatory requirements) and consult the relevant Regulators' websites before making any decision. Finder, or the author, may have holdings in the cryptocurrencies discussed.

Bottom line

Crypto hacks have evolved from attacks on exchanges and wallets to sophisticated exploits targeting smart contracts, bridges, private keys and transaction-signing systems.

While blockchain networks themselves may remain secure, the technology and infrastructure built around them can create significant vulnerabilities, making security a critical consideration for anyone holding or using cryptocurrency.

To reduce the risk of a crypto hack, brush up on common crypto scams and consider using a top-rated crypto hardware wallet to store the private keys to your digital assets offline.

Frequently asked questions

Sources

More resources on Finder

Ask a question

Finder.com provides guides and information on a range of products and services. Because our content is not financial advice, we suggest talking with a professional before you make any decision.

By submitting your comment or question, you agree to our Privacy and Cookies Policy and finder.com Terms of Use.

Questions and responses on finder.com are not provided, paid for or otherwise endorsed by any bank or brand. These banks and brands are not responsible for ensuring that comments are answered or accurate.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Go to site