$0

LuBian

Dec 28, 2020 · Weak Key Generation

$3.50B

OtherWeak Key Generation

On December 28, 2020, LuBian Bitcoin mining pool (6% of network hashrate in 2020) was hacked

CEXSigner PhishingNorth KoreaPoC

Bybit

Feb 21, 2025 · Signer Phishing

$1.40B

On February 21, 2025, Lazarus Group phished Bybit's DevOps engineer and spoofed the Safe UI to trick signers into blind-signing a masked transaction that deployed a rogue hot-wallet policy
5 billion in ETH and assets

04BC

Beauty Chain

Apr 22, 2018

$900M

DeFiInteger OverflowPoC

Ronin Bridge

Mar 23, 2022

$624M

BridgeValidator Key CompromisedNorth KoreaPoC

5 million USDC ($624M total)
The breach was discovered six days later on March 29

Poly Network

Aug 10, 2021

$611M

BridgeImproper Access ControlPoC

Poly Network was exploited for $611M on August 10, 2021 across Ethereum ($273M), BSC ($253M) and Polygon ($85M) via an access control and cryptography vulnerability in cross-chain bridge contracts
The attacker voluntarily returned nearly all funds within 15 days, keeping only transaction fees

EthereumBSCPolygon

Binance Bridge

Oct 6, 2022

$570M

BridgeProof Verifier Bug

On October 4-6, 2022 the BNB Chain's BSC Token Hub bridge (connecting BEP2 and BEP20) was exploited via incomplete Merkle proof verification in the bridge contract, allowing an attacker to forge proofs and mint 2 million BNB (~$570 million)
Binance paused the chain on October 6; roughly $137M bridged out before containment; $433M remained frozen

Coincheck

Jan 26, 2018

$534M

On January 26, 2018, Coincheck announced hackers stole 523 million NEM coins from its internet-connected hot wallet, which lacked adequate security controls
The exchange began reimbursing approximately 260,000 affected users

NEM

CEXPrivate Key Compromised

Mt. Gox

Feb 7, 2014

$470M

12y ago

Gox, the world's largest Bitcoin exchange, collapsed when it revealed that 850,000 BTC belonging to customers and the company were missing
The exchange had been incrementally hacked since at least 2011 when attackers gained access to the hot wallet, with hackers siphoning BTC over several years

FTX

Nov 12, 2022

$450M

CEXPhishing

On November 11-12, 2022, a SIM-swapping gang stole approximately $450M in crypto from FTX by walking into AT&T stores with fake IDs, hijacking employee phone accounts, intercepting 2FA codes sent to FTX users, and draining their wallets during the company's bankruptcy

EthereumSolana

Bitget

Sep 24, 2026

$387M

1mo ago

Bitget detected unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24
5M transferred to attacker-controlled addresses across Ethereum and other EVM networks, XRP Ledger, Zcash and Tron

EthereumXRPTron+1

Portal

Feb 2, 2022

$326M

BridgeSignature Verification Flaw

On February 2, 2022, attackers exploited Wormhole Portal by using a deprecated insecure signature verification function to mint 120,000 wrapped ETH on Solana without locking equivalent collateral on Ethereum, then redeemed for real ETH

Solana

BridgeUnbacked Cross-Chain MintNorth Korea

Liquid Network

Sep 6, 2026

$320M

2mo ago

An actor exploited a software vulnerability in Elements, the software underlying Liquid, to create approximately 4,000 L-BTC without corresponding BTC backing
The unbacked L-BTC was transferred to SideSwap’s peg-out service, where it was indistinguishable from legitimately backed L-BTC

Liquid

DMM Bitcoin

May 31, 2024

$305M

CEXPhishingNorth Korea

On May 31, 2024, DMM Bitcoin lost 48 billion yen ($305M) in bitcoin when North Korean Lazarus Group attackers compromised an employee, intercepted legitimate transactions, and drained the hot wallet
The exchange ultimately shut down and transferred to SBI VC Trade

Drift Trade

Apr 1, 2026

$295M

7mo ago

DeFiProxy Upgrade Hijack

On April 1, 2026, Drift Protocol on Solana was exploited for ~$295M when attackers tricked Security Council members into pre-signing transactions via Solana durable nonces, handing over admin control
Attackers whitelisted a worthless fake token (CVT) as collateral, deposited 500M CVT, and withdrew $285M in real assets (USDC, SOL, ETH) in ~12 minutes

Solana

BridgeCross-Chain Message Spoofing

Kelp

Apr 18, 2026

$293M

6mo ago

On April 18, 2026, Kelp DAO's rsETH bridge was exploited for $293 million when attackers compromised LayerZero's RPC nodes via social engineering and injected fraudulent cross-chain messages
Kelp's 1-of-1 verifier configuration created a single point of failure, affecting validation across 20 chains

EthereumArbitrum

PlayDapp

Feb 9, 2024

$290M

DeFiHot Wallet Key Compromised

The PlayDapp deployer key was compromised via spear-phishing attack
79 billion tokens across two transactions (Feb 9 and Feb 12), valued at $290M

CEXHot Wallet Key CompromisedNorth Korea

KuCoin

Sep 29, 2020

$281M

6y ago

On September 25-26, 2020, attackers obtained the private keys to KuCoin's hot wallets and stole approximately $280 million
The Lazarus Group, working on behalf of North Korea, was attributed as the attacker

Gate

Apr 21, 2018

$235M

CEXPrivate Key Compromised

io lost ~$230M on April 21, 2018 when North Korean hackers compromised exchange private keys
8K BTC, ~219K ETH, ~100M DOGE and other tokens

WazirX: India

Jul 18, 2024

$235M

CEXSigner PhishingNorth Korea

9M in 190+ tokens from a Liminal-custodied multisig wallet
Attackers created a fake WazirX account, accessed the hot wallet, then exploited the smart contract controlling the multisig to gain full control without the original keys

Cetus CLMM

May 22, 2025

$223M

DeFiArithmetic Error

Cetus CLMM on Sui suffered a math error in its checked_shlw function where an incorrect overflow threshold (0xffffffffffffffff << 192 instead of 1 << 192) allowed attackers to craft positions with phantom liquidity
Using flashloans to manipulate prices and create tight tick ranges, attackers minted enormous liquidity while depositing minimal real tokens, then withdrew actual reserves

Sui

Mixin Network

Sep 23, 2023

$200M

OtherDatabase Breach

On September 23, 2023, Mixin Network suffered a $200M hack when a cloud service provider's database containing hot wallet credentials was breached, allowing attackers to drain wallets of ETH, BTC, and USDT

Mixin

23E

- EulerFinance

Mar 13, 2023

$200M

DeFiBusiness Logic FlawPoC

Euler V1

Mar 13, 2023

$197M

DeFiDonation Attack

On March 13, 2023, Euler Finance was exploited via flash loan attack on the donateToReserves function
The attacker stole ~$197M in DAI, USDC, stETH, and WBTC via account balance inflation without actual collateral

BitMart

Dec 4, 2021

$196M

BitMart's hot wallets were compromised on December 4, 2021, resulting in theft of $196M: $100M on Ethereum and $96M on Binance Smart Chain

EthereumBSC

Nomad

Aug 1, 2022

$190M

BridgeForged ProofNorth KoreaPoC

On August 1, 2022, Nomad bridge was exploited when the protocol initialization set trusted roots to 0x00, matching the untrusted root value
This caused the Replica contract to accept any messages as valid, enabling 300+ copycat attackers to drain $190M total

Beanstalk

Apr 17, 2022

$181M

DeFiFlashloan Governance AttackPoC

An attacker flashloaned $1B+ from Aave, Uniswap, and SushiSwap to gain 2/3 governance voting power and execute malicious proposals (Bip18 to drain the protocol, Bip19 to donate to Ukraine as cover), stealing $181M in non-Bean assets

BitGrail

Feb 12, 2018

$170M

CEXImproper Access Control

On February 9-12, 2018, BitGrail exchange suffered a massive breach affecting 17M Nano coins (~$170M)
The exploit involved a flaw in the withdrawal mechanism that allowed repeated withdrawals of the same funds

Nano

Wintermute

Sep 20, 2022

$160M

OtherPhishingNorth Korea

On September 20, 2022, Wintermute's $160M DeFi hot wallet was compromised
Attacker brute-forced the private key using a weak 32-bit seed from the Profanity vanity address generator; only DeFi operations were affected

Parity Multisig

Nov 9, 2017

$150M

DeFiUninitialized ProxyPoC

On November 8, 2017, a user called 'devops199' accidentally exploited a vulnerability in Parity's multi-sig wallet library contract by calling initWallet then kill(), permanently disabling over 500 multi-sig wallets containing approximately 500,000 ETH
The library lacked protection against reinitialization and destruction by non-owners

Compound V2

Sep 29, 2021

$147M

DeFiArithmetic Error

Compound V2's Comptroller had a conditional logic bug when Proposal 62 activated on September 29-30, 2021
An off-by-one error (> instead of >=) in the COMP distribution calculation allowed users to claim far more tokens than intended

Vulcan Forged

Dec 13, 2021

$140M

DeFiHot Wallet Key Compromised

On December 13, 2021, Vulcan Forged's NFT marketplace suffered a $140M hack affecting 96 high-value wallets when Venly's semi-custodial servers were compromised
5M PYR tokens from customer wallets

EthereumPolygon

BXH

Oct 30, 2021

$139M

DeFiPrivate Key Compromised

Attacker gained access to BXH's administrative private key, allowing digital signature of a transaction transferring $139 million in tokens directly to the attacker's account
The details suggest an insider or compromised system with access to the admin key storage, making this likely an inside job or successful targeted malware infection

CREAM Lending

Oct 27, 2021

$130M

DeFiSpot Price Manipulation

On October 27, 2021, CREAM Finance was exploited for $130 million via flashloan-enabled oracle manipulation
Attacker used flashloans from MakerDAO and Aave to manipulate yUSD price, then minted unbacked yUSD and crYUSD by exploiting vault accounting and composability across Curve and Aave

35C

CreamFinance

Oct 27, 2021

$130M

DeFiPrice ManipulationPoC

Balancer V2

Nov 3, 2025

$128M

DeFiRounding ErrorPoC

On November 3, 2025, Balancer V2's Composable Stable Pools were exploited for $128M via a rounding-down flaw in batchSwap invariant calculation
Minuscule discrepancies in each transaction compounded across rapid successive swaps, gradually deflating pool reserves across chains

EthereumArbitrumBase+3

Poloniex

Nov 10, 2023

$126M

CEXMalwareNorth Korea

Poloniex hot wallet private keys compromised on November 10, 2023, draining $126M across Ethereum, Tron, and Bitcoin
Compromise likely via malware or social engineering

TronEthereumBitcoin

Multichain

Jul 7, 2023

$126M

BridgeValidator Key Compromised

Multichain lost ~$126M on July 6-7, 2023 from bridge reserves on Fantom, Moonriver and Dogechain (WBTC, WETH, USDC, USDT, DAI, LINK and more)
CEO Zhaojun, who held the MPC signing keys, had been detained since May 2023; project shut down days later

MoonriverBSCFantom

Tectonic

Aug 30, 2026

$124M

2mo ago

DeFiDonation Attack

The attacker built a leveraged TONIC/tTONIC collateral position through 98 recursive operations, then transferred TONIC directly into the tTONIC contract twice without minting corresponding tTONIC, increasing the tTONIC exchange rate outside the normal deposit path
com Exchange pricing without smoothing or a circuit breaker

Cronos

Badger DAO

Dec 2, 2021

$120M

DeFiCDN Compromise

On December 2, 2021, Badger DAO suffered a $120M hack when an attacker used a compromised Cloudflare API key to inject malicious code into the frontend
Users unknowingly approved token transfers via spoofed UI, allowing the attacker to drain approximately 2,100 BTC and 151 ETH from ~200 accounts

WalletWeak Key Generation

COLDCARD

Jul 31, 2026

$116M

3mo ago

0+ (March 2021 onward), where a firmware bug bypassed the dedicated hardware RNG during key generation, cutting effective key strength to as little as 40 bits and allowing offline brute-forcing

Mango Markets V3

Oct 11, 2022

$115M

DeFiSpot Price Manipulation

Attacker used $5M initial capital to take a MANGO-PERP position and pumped spot price via large purchases on another account, creating artificial collateral worth $423M to borrow $110-116M
Protocol relied on liquidity-sensitive price feeds vulnerable to large single-account manipulation

Solana

Elrond

Jun 5, 2022

$113M

DeFiInfinite Mint

65M EGLD (~$113M) and convert 917k to WEGLD, creating unbacked WEGLD in circulation
The team recovered the illegal WEGLD and burned it, restoring the 1:1 backing ratio with two mainnet upgrades

Elrond

Bitget

Apr 20, 2025

CEXMarket Maker Bot Exploited

Bitget's market-making bot on the VOXEL/USDT futures pair malfunctioned on April 20, 2025, entering a predictable buy-low/sell-high loop
Traders exploited the pattern with high leverage to extract ~$100M before Bitget froze accounts and rolled back trades

45HB

Harmony Bridge

Jun 23, 2022

BridgeValidator Key CompromisedNorth Korea

Harmony's Horizon Bridge was hacked on June 23, 2022, stealing ~$100M across ETH, BNB, USDT, USDC, and DAI on Ethereum and BSC
Lazarus Group / APT38 (North Korea-affiliated) compromised validator private keys; the insufficient 2-of-5 validator quorum enabled the theft

EthereumBSC

Atomic Wallet

Jun 3, 2023

WalletSupply Chain AttackNorth Korea

On June 3, 2023, Atomic Wallet users lost over $100 million when attackers compromised the wallet application through a supply chain attack that injected malicious code to exfiltrate private keys
Approximately 5,500 wallets were affected across multiple chains

EthereumTronBSC+3

47VP

Venus Protocol

May 18, 2021

DeFiSpot Price Manipulation

An attacker manipulated XVS spot price via low liquidity on centralized exchanges, driving it from $70 to $143 and back to $76
Using inflated XVS collateral, they borrowed 2,000 BTC and 5,700 ETH

48HH

Harmony's Horizon Bridge

Jun 24, 2022

DeFiPrivate key compromisedNorth KoreaPoC

WalletSupply Chain Attack

49LS

Ledger (Supply Chain)

Oct 9, 2026

$93.0M

27d ago

Attackers purchased genuine Ledger hardware wallets, installed concealed components capable of capturing recovery phrases, and redistributed the modified devices through resellers
The implants monitored the wallets’ displays during initialization and transmitted captured recovery phrases through cellular connections

50LG

Liquid Global

Aug 19, 2021

$91.3M

CEXHot Wallet Key CompromisedNorth Korea

On August 19, 2021, Japanese cryptocurrency exchange Liquid Global's warm wallets were compromised, resulting in the theft of approximately $91-97 million in various cryptocurrencies including BTC, ETH, TRX, and XRP
The attack leveraged data from a prior November 2020 breach to compromise the MPC wallet system

Mirror

Oct 8, 2021

$90.0M

DeFiImproper Access Control

Mirror Protocol was exploited from October 8, 2021 through May 17, 2022 (discovered) via duplicate ID vulnerability in collateral unlock logic, allowing excessive unlocks without proportional validation
7M before detection due to limited Terra monitoring

Terra

52HB

Heco Bridge

Nov 22, 2023

$86.6M

BridgeHot Wallet Key CompromisedNorth Korea

6M when the operator's account was compromised, enabling unauthorized asset withdrawals

Phemex

Jan 23, 2025

$85.0M

CEXHot Wallet Key CompromisedNorth Korea

1M to $85M
The hot wallet private keys and signing infrastructure were compromised

EthereumSolanaXRP+10

Nobitex

Jun 18, 2025

$82.0M

CEXMalware

Nobitex hot wallet private keys compromised on June 18, 2025, leading to $82-90M theft across blockchains
Attackers deliberately destroyed the stolen funds by sending to inaccessible addresses as a political statement

TronEthereumBSC+4

Orbit Bridge

Dec 31, 2023

$81.7M

BridgeSignature Verification FlawNorth Korea

5M across its Ethereum vault when 7 of 10 multisig signer private keys were compromised, enabling fraudulent withdrawal signatures

Qubit

Jan 28, 2022

$80.0M

BridgeMissing Input ValidationPoC

On January 27-28, 2022 an attacker drained $80 million from Qubit Finance's QBridge cross-chain bridge by calling the deposit function with a zero address token and no ETH, exploiting improper use of call() instead of SafeERC20 verification to bypass input validation
5M in BTC-B, and stablecoins

Rari Capital

May 1, 2022

$80.0M

DeFiReentrancyPoC

Rari Capital's Fuse lending pools were exploited via a reentrancy vulnerability in exitMarket() when an attacker used a Balancer flashloan to deposit collateral, then recursively borrowed assets and withdrew collateral before borrow records were updated, stealing approximately 28,380 ETH and related assets

EthereumArbitrum

58A

AscenDEX

Dec 11, 2021

$77.0M

On December 11, 2021, AscendEX exchange discovered unauthorized transfers of $77 million from its hot wallets across Ethereum, BSC, and Polygon due to compromised private keys, likely via phishing or malware

EthereumBSCPolygon

59SF

StakeHound / Fireblocks

Jun 21, 2021

$72.0M

DeFiKey Brute ForcedNorth Korea

StakeHound's 38,178 ETH became inaccessible when a 3-of-4 threshold signature key backup procedure failed
Fireblocks lost custody of 2 key shards during a machine failure in March 2021, and StakeHound failed to execute disaster recovery or verify the backup through third-party services

Bitfinex

Aug 2, 2016

$72.0M

10y ago

Bitfinex suffered a security breach when an attacker compromised hot wallet private keys, stealing 119,756 bitcoins (~$72 million)
The exchange halted trading and withdrawals while investigating

61U

UPCX

Apr 1, 2025

$70.0M

DeFiProxy Upgrade Hijack

4M UPC tokens (~$70M) from three management accounts

62N

NiceHash

Dec 8, 2017

$64.0M

CEXKey Leaked via Infrastructure

On December 6-7, 2017, NiceHash's payment wallet was compromised after attackers obtained employee credentials via phishing
The attacker accessed the wallet and stole 4,700+ BTC (~$64M)

Munchables

Mar 26, 2024

$62.5M

OtherProxy Upgrade Hijack

5 million exploit by a rogue developer (pseudonym 'Werewolves0943') hired to write the smart contracts who deliberately built in vulnerabilities, using control of the upgradeable proxy to assign themselves 1 million ETH and drain the protocol

Blast