Crypto exchanges have suffered dozens of major hacks over their history, with cumulative losses exceeding $20 billion. This article walks through the biggest incidents of the past decade by date and loss amount. The short version first: the largest single theft in history was the Bybit hack in February 2025 ($1.46 billion); the most catastrophic collapse was Mt. Gox in 2014 (850,000 BTC, worth $450 million at the time, and 70+ billion dollars at 2026 prices); the most transparently handled reimbursement was Binance's 2019 hack (fully covered by the SAFU fund). For a primary-plus-backup account setup, you can register through the Binance Official Site, install the Official Binance App on Android, and iOS users switching to an overseas Apple ID can follow the Download Page to install the main Binance app.
Ranked by loss amount at the time:
| Rank | Incident | Date | Loss (at the time) | Loss (2026 value) | Reimbursement |
|---|---|---|---|---|---|
| 1 | Bybit Ethereum cold wallet hack | 2025-02-21 | $1.46B (400,000 ETH) | $1.46B | Fully reimbursed within 24 hours |
| 2 | Mt. Gox | 2014-02 | $450M (850,000 BTC) | $70B+ | Partial (still being processed in 2025) |
| 3 | Coincheck (Japan) | 2018-01-26 | $530M (500M NEM) | $680M | 100% reimbursed |
| 4 | KuCoin hot wallet hack | 2020-09-26 | $285M | $285M | 84% recovered + 16% covered by the platform |
| 5 | Bitfinex | 2016-08-02 | $72M (120,000 BTC) | $8.9B | Partially recovered + reimbursed in LEO tokens |
| 6 | Poly Network | 2021-08-10 | $610M (cross-chain) | $610M | Hacker voluntarily returned 99% |
| 7 | FTX collapse (misuse of funds, not a hack) | 2022-11 | $8-10B (misappropriated user funds) | $8-10B | Partially recovered (in bankruptcy proceedings) |
| 8 | Ronin Network bridge hack | 2022-03-23 | $625M | $625M | Reimbursed by Sky Mavis from its own funds |
| 9 | Wormhole bridge hack | 2022-02-02 | $320M | $320M | Fully reimbursed via a Jump Crypto capital injection |
| 10 | Bitstamp (Europe) | 2015-01-04 | $5.1M (19,000 BTC) | $1.75B | 100% reimbursed from company funds |
Q: Why was the 2025 Bybit hack the largest in history?
On February 21, 2025, North Korea's Lazarus Group hacked the front-end of Bybit's multisig custody service (Safe{Wallet}). When Bybit CEO Ben Zhou signed a routine transfer, malicious code altered the destination address behind the scenes. The result was $1.46 billion in ETH (roughly 400,000 ETH) redirected to the attackers' wallet.
Within 24 hours, Bybit announced it would fully reimburse users using "its own funds plus emergency third-party loans," preventing a bank run. Bybit subsequently worked with Cobo Custody and Fireblocks to upgrade its multisig process, adding a three-layer verification model spanning front-end, back-end, and hardware.
Mt. Gox (Magic: The Gathering Online Exchange) was the most catastrophic collapse in crypto exchange history back in 2014:
Mt. Gox's collapse had a profound impact on the crypto industry:
Q: How much did Mt. Gox users eventually get back?
Under the bankruptcy settlement, Mt. Gox users got back roughly 85% of their original BTC count (note: that's the coin count, not the dollar value at the time). In other words, someone who lost 1 BTC in 2014 (worth $530 then) got back 0.85 BTC in 2024-2025 (worth roughly $68,000 at a 2025 price of around $80,000/BTC). The long wait ended up handing users an unexpected "passive gain" from Bitcoin's price appreciation — a genuinely surprising outcome.
On September 26, 2020, KuCoin's hot wallet was hacked for roughly $285 million. How the incident was handled is widely seen as a "model response" in the industry:
What made the KuCoin incident a "model response" came down to:
Q: Can you still trust KuCoin after that incident?
The way KuCoin handled the incident earned it industry credibility, and it hasn't been hacked again in the 6 years since. That said, KuCoin's overall security tier still lags behind Binance, OKX, Coinbase, and Kraken:
KuCoin works well as a secondary account for small-cap tokens, but isn't ideal for large, long-term holdings.
On May 7, 2019, Binance's hot wallet was hacked for roughly 7,000 BTC (worth about $40 million at the time). The timeline:
The SAFU fund was set up by Binance in July 2018, funded by setting aside 10% of the platform's spot trading fee revenue. At the time of the hack, SAFU held roughly $550 million — more than enough to cover the $40 million loss from 7,000 BTC.
By April 2026, the SAFU fund (publicly verifiable on-chain) had grown to $1 billion, making it the best-known "user insurance fund" in the crypto industry.
Q: Can the SAFU fund really cover every possible loss?
In theory, the $1 billion SAFU fund can cover a mid-sized Binance hack (under $1 billion). But SAFU isn't a legal reimbursement obligation — it's a voluntary commitment from Binance. If a much larger incident happened (say, $5 billion+), and SAFU couldn't cover it, Binance could choose to reimburse only partially or in tokens instead of cash.
The safest strategy: spread your long-term holdings across 2-3 licensed exchanges plus hardware-wallet cold storage, rather than relying on any single platform's "voluntary reimbursement promise."
2022 was a peak year for cross-chain bridge hacks:
| Incident | Date | Loss | Attack Vector |
|---|---|---|---|
| Wormhole | 2022-02-02 | $320M | Smart contract signature verification flaw |
| Ronin Network | 2022-03-23 | $625M | Multisig private keys phished |
| Harmony Horizon | 2022-06-23 | $100M | Multisig private keys compromised |
| Nomad | 2022-08-01 | $190M | Smart contract logic flaw |
| BNB Chain Bridge | 2022-10-06 | $570M (most recovered) | Forged cross-chain message proof |
A cross-chain bridge is a smart contract system connecting two blockchains, and its attack surface is broad — spanning smart contracts, multisig, and cross-chain messaging. In 2022 alone, total losses from bridge hacks exceeded $2 billion, making bridges that year's biggest source of DeFi risk.
From 2023-2026, bridge security got a major upgrade: zero-knowledge cross-chain proofs (zkBridge), light-client verification, and separating multisig from hardware signing. Major incidents have dropped sharply since.
Q: Are cross-chain bridges safe to use today?
As of April 2026, mainstream bridges (LayerZero, the upgraded Wormhole, Connext, Across) have significantly improved security. Still, it's worth:
The FTX collapse in November 2022 was one of the most severe events in crypto history, but FTX wasn't hacked:
The FTX collapse exposed the biggest risk of an opaque exchange: misuse of user funds. In its wake, the industry pushed Proof of Reserves (PoR) toward becoming standard practice (Binance, OKX, Bybit, and others now publish PoR regularly).
Q: How can you tell if an exchange is misusing user funds?
Core indicators of an exchange's financial integrity:
Binance, OKX, Bybit, Coinbase, and Kraken all publish verifiable PoR, and their transparency is far higher than FTX's was in 2022.
Beyond hacks, exchanges "blowing themselves up" is also a major risk:
| Incident | Date | Loss | Nature |
|---|---|---|---|
| QuadrigaCX (Canada) | 2019-01 | $190M | CEO death + lost private keys (suspected misappropriation) |
| Cryptopia (New Zealand) | 2019-01 | $23M | Hack + bankruptcy |
| Celsius Network | 2022-07 | $4.7B | Lending platform collapse (DeFi leverage liquidation) |
| Voyager Digital | 2022-07 | $1.3B | Lending platform collapse |
| BlockFi | 2022-11 | $355M | Lending platform collapse (tied to the FTX collapse) |
| Genesis | 2023-01 | $3.3B | Tied to DCG group + lending collapse |
The 2022-2023 "crypto credit crisis" was a systemic collapse across the industry. Celsius, Voyager, BlockFi, and Genesis were all lending platforms that promised high yields while actually lending user funds to high-risk institutions (such as Three Arrows Capital).
Q: Are high-yield lending platforms trustworthy?
Be wary of any platform promising more than 10% annualized "stable" returns:
A genuinely sustainable stable yield on USDC/USDT is around 4-6% (sourced from US Treasury yields). Any stablecoin yield promising over 10% should raise serious questions about where that return is actually coming from.
As of April 2026, here's the "incident-free record" breakdown:
| Exchange | Founded | Major Hacks | User Fund Losses |
|---|---|---|---|
| Kraken | 2011 | 0 | 0 |
| Coinbase | 2012 | 0 (core wallets) | 0 |
| Bitstamp | 2011 | 1 (2015, 100% reimbursed) | 0 (after reimbursement) |
| Binance | 2017 | 1 (2019, fully covered by SAFU) | 0 (after reimbursement) |
| OKX | 2017 | 0 | 0 |
| Bybit | 2018 | 1 (2025, fully reimbursed) | 0 (after reimbursement) |
| KuCoin | 2017 | 1 (2020, 84% recovered + 16% platform-covered) | 0 (after reimbursement) |
| Mt. Gox | 2010 | Defunct | Users got back 85% of their coin count (2024-2025 payout) |
| FTX | 2019 | Defunct | Partial reimbursement (at bankruptcy-time dollar value) |
The longest incident-free records belong to Kraken (14 years) and Coinbase (13 years) — widely regarded as the industry's two "safest" exchanges.
Q: How much weight should security carry when picking an exchange?
How much weight to give security depends on your portfolio size:
Q: Is a hardware wallet really safer than an exchange?
Hardware wallets (like Ledger or Trezor) are far more secure than exchanges — the private key never leaves the device, so even a hacked computer can't touch it. But hardware wallets carry their own seed-phrase-loss risk — if your seed phrase is stolen or lost, your assets are 100% gone, with no one to reimburse you.
Hardware wallets are best for long-term holdings you don't trade often. Assets you trade daily should still stay on an exchange.
Q: Are bigger exchanges always safer?
Generally yes, but not absolutely:
The safest bet: choose an exchange with full regulatory licensing, a clean history, and transparent PoR.
Q: Can you actually trust an exchange's Proof of Reserves?
PoR is a "snapshot" proof, not a real-time one. In theory, an exchange could temporarily move funds in before the snapshot to make its books look better. But compared to FTX's "zero disclosure at all," PoR is still real industry progress.
The best form of PoR is "zero-knowledge plus on-chain verifiable" (used by OKX), with a standard Merkle Tree approach (used by Binance) a step behind that.
Q: How quickly does the public find out about a hack?
Hacks are typically spotted and posted about by on-chain analysts (like PeckShield or SlowMist) within 6-24 hours. If an exchange suddenly halts withdrawals and its Twitter activity looks off, you should withdraw your funds immediately to avoid risk.
Q: If an exchange collapses, can I get my money back?
It depends on:
Long-term diversification plus hardware-wallet storage is the only reliable hedge.
Q: What is the Lazarus Group?
Lazarus Group is a North Korean state-backed hacking group that has repeatedly targeted the crypto industry since 2017. Known operations include:
Lazarus has stolen over $3 billion in crypto assets cumulatively, making it the industry's single largest threat actor. After the Bybit incident, the industry began mandating multisig cold wallets combined with hardware-signature separation to counter Lazarus.
Q: Are exchange bug bounty programs worth participating in?
Yes. Binance, OKX, and Coinbase all run bug bounty programs, with rewards up to $100,000-$1,000,000 for critical vulnerabilities.
But this is really only appropriate for serious white-hat researchers — ordinary users shouldn't casually attempt to "find vulnerabilities," as doing so improperly can carry legal risk.
Risk disclaimer: This article is an independent third-party overview and does not constitute investment advice. All data reflects April 2026. Trading and holding crypto carries significant risk — diversification and hardware-wallet cold storage remain the most important security strategies.