Crypto Exchange Hacks: 11 Major Cases Since Mt. Gox

On the evening of October 29, 2026, crypto worth several billion dollars left Binance’s wallets within about 20 minutes. In the end the loss was about $6.3 billion, the largest known theft from a crypto exchange. That is more than four times the Bybit hack of February 2025, which held the record until then. The world’s largest exchange then suspended withdrawals.

The first big case is twelve years old. In this article I go through the major cases from Mt. Gox to Binance: what was stolen, how the attackers got in and what happened to customer money. Every figure comes from the exchange, a court, the FBI or the analytics firms TRM Labs and Chainalysis. At the end you find how to protect your balance.

Crypto exchange hacks in 30 seconds

• Largest case: Binance on October 29, 2026, with about $6.3 billion. The old record was Bybit with $1.46 billion in February 2025.
• Attackers: the FBI and analytics firms attribute a large part of the stolen value to North Korea. The FBI named the group TraderTraitor for Bybit, DMM Bitcoin and Binance. According to TRM Labs, $7.4 billion of the $8.7 billion in crypto stolen in 2026 up to October 30 went to North Korean hackers.
• Outcome for customers: in six of eleven major cases the exchange covered the loss without bankruptcy and without sharing it out among customers; Binance has pledged to do so in a seventh. Bitfinex first shared out the loss and later bought back the IOUs. Mt. Gox only started repaying in 2024, and the deadline now runs to October 31, 2027.
• No deposit insurance: in the US, the FDIC does not insure crypto, and SIPC protection concerns eligible assets at a failing SIPC-member brokerage, not ordinary crypto exchange balances.
• Protection: keep your holdings in your own wallet, test the withdrawal route with a small amount and keep only your trading capital on an exchange.

What is a crypto hack?

A crypto hack is an attack in which outsiders gain control of the keys or the approval systems of a wallet and move the crypto in it to their own addresses.

An exchange holds its customers’ coins in two kinds of wallets. The hot wallet holds the part that is connected to the internet for ongoing withdrawals. Most coins usually sit in a cold wallet, whose keys are stored offline. Some exchanges use a warm wallet in between that is only connected at times. At Binance and Bitget in 2026, the attack hit the hot wallets, according to the exchanges.

Bybit shows that a cold wallet can fall too. There, the signers of a multisig wallet, where several people must approve each withdrawal, were fooled by a fake interface. They approved a transaction that looked different from what it really did. No encryption was broken. Many big cases of recent years started with a person: a compromised laptop, a fake recruiter, a hijacked phone contract.

This list only covers attacks on crypto exchanges. Some well-known cases are missing on purpose. The Ronin hack of March 2022 with $620 million hit a bridge between two blockchains. At Poly Network in August 2021, over $610 million left a DeFi protocol and, according to Poly Network, all of it was restored. At Coinbase in May 2025, criminals stole customer data, according to its filing with the SEC, but no coins from the exchange’s wallets; our Coinbase review covers that case.

Eleven major crypto exchange hacks at a glance

Eleven cases have shaped the industry, from the collapse of Mt. Gox to the Binance hack. They are a selection of major cases, not a complete ranking. The table sorts them by date. The loss is shown the way the exchange, a court or the FBI put it. For Mt. Gox, Bitfinex and Coincheck there is no official dollar value at the time, so the table shows the stolen amount.

Date and exchange	Loss	Outcome for customers
2014, Mt. Gox	about 850,000 BTC	bankruptcy, repayments since July 2024
Aug 2016, Bitfinex	119,754 BTC	shared out among all customers, bought back in 2017
Jan 2018, Coincheck	about ¥58 billion in NEM	repaid in yen
May 2019, Binance	7,000 BTC, about $40 million	covered from the SAFU fund
Sep 2020, KuCoin	about $285 million	covered, 84% recovered
Nov 2022, FTX	over $400 million	part of the bankruptcy, payouts since 2025
May 2024, DMM Bitcoin	$308 million	covered, accounts moved to SBI VC Trade
Jul 2024, WazirX	over $230 million	restructuring, first distribution planned at about 85% of claims
Feb 2025, Bybit	$1.46 billion	covered, gap closed within 72 hours
Sep 2026, Bitget	about $388 million	covered from the protection fund
Oct 2026, Binance	about $6.3 billion	cover pledged, about 98% replenished

The chart shows the scale and the outcome at a glance. The Binance hack of 2026 is larger than all other cases with a dollar value combined. Green means the exchange says it covered the customers’ loss; hatched is a pledge that is still being carried out. Orange stands for a bankruptcy or restructuring in court, red for a loss that customers first had to carry themselves.

The cases one by one, from Mt. Gox to Binance

Mt. Gox 2014: twelve years and still not over

Mt. Gox was a bitcoin exchange in Tokyo, and its collapse in 2014 has still not been fully settled. In early 2014 the exchange reported the loss of about 850,000 bitcoin, of which about 750,000 came from customer holdings. On March 7, 2014, 199,999.99 BTC turned up again in an old wallet. According to the Mt. Gox announcement, the loss fell to about 650,000 BTC.

The theft did not happen in one night but over years. According to the indictment of the US Department of Justice of 2023, two Russian nationals stole at least about 647,000 BTC from September 2011. They had access to the exchange’s server and moved the coins to their own addresses.

For customers, a process began that is still running. Mt. Gox went into civil rehabilitation under the trustee Nobuaki Kobayashi. Only since July 2024 has he been repaying in bitcoin and bitcoin cash. Anyone who has not completed their paperwork is still waiting. On October 16, 2026, the trustee moved the deadline by one year to October 31, 2027, according to his announcement.

Bitfinex 2016: when all customers shared the loss

On August 2, 2016, 119,754 bitcoin disappeared from Bitfinex. According to the US Department of Justice, the attacker broke into the exchange’s network and approved more than 2,000 unauthorized transactions. Afterwards he deleted access credentials and logs.

Bitfinex spread the loss across all customers, including those whose coins were not affected. For each dollar lost they received a BFX token, an IOU of the exchange. On April 3, 2017, Bitfinex bought back all outstanding tokens at their face value of one dollar, according to its own announcement. For eight months, customers had to rely on the exchange’s word.

The attackers were caught only six years later. In February 2022, US authorities arrested Ilya Lichtenstein and Heather Morgan and seized more than 94,000 BTC, then worth more than $3.6 billion. Lichtenstein was sentenced to five years in prison in November 2024, according to the Justice Department.

Coincheck 2018: compensation in yen instead of coins

On January 26, 2018, about 523 million NEM left the Japanese exchange Coincheck. Japan’s financial regulator, the FSA, put the value at about ¥58 billion; it gave no dollar figure. Coincheck itself names 526.3 million NEM. According to Coincheck, malware on an employee’s computer opened access to the internal network and so exposed the private key.

Coincheck compensated all affected customers, but in yen, not in NEM. According to the Coincheck FAQ, the exchange paid ¥88.549 per unit and credited the money by March 12, 2018. Anyone who wanted to keep the coins had to buy them again at the market price of that day.

Binance 2019: the first use of the SAFU fund

On May 7, 2019, attackers took 7,000 bitcoin from Binance, then worth about $40 million. According to Binance founder Changpeng Zhao, they used the exchange’s API, two-factor codes and gaps in the withdrawal checks.

Binance covered the full loss from its SAFU fund. SAFU is an emergency fund that the exchange fills from its own money. According to the Binance recap, no customer lost money. For the 2026 hack, Binance names its corporate funds as a source next to the fund.

KuCoin 2020: most of the money came back

On September 25 and 26, 2020, 154 different tokens worth about $285 million left KuCoin. Chainalysis puts the figure at more than $275 million. In 2021, the analytics firm attributed the attack to North Korea’s Lazarus Group.

What is unusual is how much came back. According to the letter of KuCoin’s CEO, the exchange recovered 78% with partners and another 6% through law enforcement. KuCoin and an insurance fund covered the remaining 16%. No user suffered a loss, the letter says.

FTX 2022: the hack on the night of the collapse

FTX was hacked while the exchange was already collapsing. On November 11 and 12, 2022, around the bankruptcy filing, more than $400 million left the exchange, according to a US indictment. The analytics firm Elliptic puts it at $477 million.

The way in was a hijacked phone contract. With a fake ID, the attackers had an employee’s SIM card moved to their own device and intercepted the confirmation codes. The indictment of 2024 only names the victim “Victim Company-1”; the link to FTX comes from Elliptic.

For customers, the hack became part of the bankruptcy. The collapse had other causes. Since February 2025, the FTX Recovery Trust has been paying out. For the fifth distribution on July 31, 2026, FTX announced a cumulative 105% of allowed claims for eligible customer claims in classes 5A and 5B (Dotcom and US customers), more than three and a half years after the collapse. A court-approved conversion table sets the value of each claim in US dollars. It matches neither the original number of coins nor their later market value.

DMM Bitcoin 2024: the fake recruiter

On May 31, 2024, the Japanese exchange DMM Bitcoin lost 4,502.9 bitcoin. DMM put that at about ¥48.2 billion. According to the FBI, it was worth $308 million at the time of the attack.

The attack started two months earlier on LinkedIn. According to the FBI and Japan’s National Police Agency, a North Korean hacker posed as a recruiter. He sent an employee of the wallet software provider Ginco a supposed hiring test that contained malicious code. In late May the attackers used this access to manipulate a real DMM transaction. The FBI attributes the case to the group TraderTraitor.

DMM replaced its customers’ bitcoin in full, with money from its own group. The exchange did not carry on afterwards. In December 2024 it agreed to move the accounts and customer assets to the exchange SBI VC Trade.

WazirX 2024: partial repayment after restructuring

On July 18, 2024, an attack hit a multisig wallet of the Indian exchange WazirX. With such a wallet, several key holders must approve a withdrawal together. According to WazirX’s own account, digital assets worth more than $230 million were lost. The wallet ran on the custody technology of the provider Liminal.

WazirX could not cover the loss from its own funds and went to court. It proposed a scheme of arrangement, a restructuring plan that creditors vote on and the High Court in Singapore must approve. According to Business Standard, the court approved the scheme on October 13, 2025, after a revote of the creditors. WazirX itself marked “one year since the WazirX restart” in its October 2026 product update.

The plan pays creditors only part of their claims in a first step. According to WazirX’s explanation of the first distribution, creditors receive about 85.25% of their gross claim, valued at the prices of the January 17, 2025 rebalancing, to be paid within ten business days after the scheme takes effect. For possible further recoveries they receive recovery tokens, which do not guarantee full repayment. We found no WazirX notice that confirms the completed payout, so this describes the plan.

Bybit 2025: $1.46 billion through a fake interface

On February 21, 2025, a routine transfer from a cold wallet was due at Bybit. The signers saw a normal transaction on their wallet interface. In fact the attackers had faked the interface, and the approval changed the wallet’s logic. According to the Bybit timeline, 401,347 ETH and other ether variants were lost, together $1.46 billion.

Five days later the FBI named the attacker. In a public service announcement, it attributed the attack to North Korea, more precisely the group TraderTraitor. The FBI itself speaks of about $1.5 billion.

For customers, the hack caused no loss. On the same day, Bybit said all customer assets were backed 1:1. The exchange closed the ether gap within 72 hours through loans and over-the-counter purchases. That an exchange can raise $1.46 billion that fast is not a given.

Bitget 2026: the gap at a supplier

From 18:31 UTC on September 24, 2026, attackers took about $388 million from Bitget. The exchange’s first notice said $351.6 million; the final figure is on the Bitget incident page. The attack hit hot and warm wallets; according to Bitget, the cold wallets were not touched.

The entry point was not Bitget itself but a supplier. A previously unknown flaw in a security product of a third party gave the attackers internal credentials. With them they sent fake withdrawal orders. Private keys were not affected, the exchange says. Chainalysis attributes the attack to North Korea.

Bitget covered the loss from its protection fund. Withdrawals restarted in stages from September 28 and were fully open on October 2. So for eight days, customers could not fully access their money.

Binance 2026: the largest known crypto hack

At 20:05 UTC on October 29, 2026, Binance’s hot wallets were compromised, according to the exchange. In its Security Incident Update #2, Binance put the loss at about $6.3 billion. TRM Labs arrives at $6.36 billion, Chainalysis at about $6.4 billion. According to TRM, the outflows ran over ten blockchains, most of it over Ethereum and Bitcoin. 18,270 BTC were lost alone.

How the attackers got in is not yet fully clear. In its first update on October 30, Binance named the possibly compromised laptop of a DevOps engineer, through which the attacker could submit withdrawals. In the second update the exchange speaks of additional points of breach. TRM Labs considers control over the signing system of the hot wallets the most likely explanation.

TRM Labs, Chainalysis and the FBI attribute the attack to North Korea’s TraderTraitor group. Chainalysis relies mainly on the fact that the loot was mixed in real time with funds from the Bitget hack. Binance itself names no attacker. The FBI confirmed the attribution on October 31, 2026, in a public alert that speaks of more than $6 billion.

For customers, Binance’s promise to carry the full loss itself applies. According to its second update of October 30, the exchange set aside more than $6.34 billion, of which $5 billion was already held in the stolen tokens. About $3 billion had been frozen on the blockchain by then, mostly stablecoins, tokens pegged to the US dollar that their issuers Tether and Circle blocked. Binance said withdrawals would start to resume “within approximately 34 hours”, in phases; figures of 48 hours came from press reports.

By November 10, 2026, Binance had reopened most withdrawals, but not all of them. Withdrawals restarted in phases from November 1 (Recovery Update #4), with more assets added on November 3, 5 and 6; deposits stayed open according to the updates. Our own reading of Binance’s public network status at 21:24 UTC on November 10 still showed native withdrawals switched off for Toncoin, Cardano, Litecoin, Polkadot and Stellar, and native deposits of Toncoin and Polkadot were off too. The status page does not say whether each of these stops is linked to the hack.

Binance says it has nearly replaced the stolen assets and backs its balances with a reserve proof. On November 2, Recovery Update #5 reported the full zero-knowledge proof of reserves for the snapshot of October 31, 00:00 UTC: ten tokens, including bitcoin, ether, USDT, BNB and Solana, are backed at least 1:1, and each customer can check their own balance. Binance gives no ratio per coin. According to Recovery Update #7 of November 4, about 98% of the stolen assets are replenished, and a new snapshot of November 4 covers 44 tokens; its full proof was expected to take 50 to 60 hours.

The crypto Fear and Greed Index fell over the same period. The index of alternative.me stood at 51 on October 29, before the attack, and at 30 the next day. Its lowest reading between October 29 and November 10, 2026, was 25 on November 7. These readings do not show how much of the decline the hack caused. We track how bitcoin reacts in our Bitcoin forecast. According to TRM, most of the outflow value ran over the Ethereum network, including the stablecoins issued there, so we also follow it in the Ethereum forecast.

Who is behind it? North Korea, Lazarus and TraderTraitor

State hackers from North Korea are behind the largest crypto hacks of recent years. The FBI attributed the Ronin hack of 2022 to the Lazarus Group and APT38. For DMM Bitcoin, Bybit and Binance it named the group TraderTraitor, which is also tracked as Jade Sleet, UNC4899 or Slow Pisces.

The sums have grown sharply over the years. In 2024, about $2.2 billion in crypto was stolen according to Chainalysis, $1.34 billion of it by North Korean hackers. From January to early December 2025 it was more than $3.4 billion according to the follow-up report, at least $2.02 billion of it from North Korea. For 2026, TRM Labs already counts $8.7 billion up to October 30, $7.4 billion of it from North Korea.

The two analytics firms count differently, so we use only one source per year. For 2024, TRM Labs arrives at a clearly smaller North Korean share than Chainalysis. The direction is the same for both.

The pattern repeats: the attackers target people, not the blockchain. At DMM it was a fake job offer, at Bybit a fake signing interface, at Binance in 2026, according to the first account, an employee’s laptop. For your own account too, phishing and fake approvals are key risks.

What happens to customer money after a hack

The eleven cases ended in three ways, and which one applied depended mainly on whether the exchange could pay. Whether customers had a claim for compensation depends on the contract and the law of the country. Such a claim does not guarantee fast or full payment if the exchange lacks the money.

How it was settled	Cases
Covered by the exchange, pledged by Binance in 2026	Coincheck, Binance 2019, KuCoin, DMM Bitcoin, Bybit, Bitget, Binance 2026
Bankruptcy or restructuring	Mt. Gox, FTX, WazirX
Loss first shared out among all customers	Bitfinex, IOUs bought back in 2017

Covered does not mean you get your money at once. At Bitget it took eight days until all withdrawals ran again. Binance also suspended them after the attack and reopened them step by step from November 1. Anyone who wanted to move their balance to their own wallet or another exchange in that time could not.

Covered does not always mean you get your coins back. Coincheck paid in yen at a fixed rate. Anyone who wanted to hold NEM had to buy again. DMM Bitcoin replaced everything but then gave up its business.

Customers are hit hardest when the exchange cannot survive the hack. At Mt. Gox, the trustee only paid out ten years after the collapse. At FTX, more than two years passed between the collapse and the first distribution, and WazirX only restarted in October 2025, more than a year after the attack. One limit of this review belongs here: eleven cases are no statistic. Lists like this mostly contain large exchanges, and large exchanges can pay more easily than small ones.

How to protect yourself from the next exchange hack

You cannot stop an attack on the exchange itself, but you can limit its effect on you. Five steps clearly lower the risk to your balance. The SEC’s investor bulletin on crypto custody of December 12, 2025, puts the risk plainly: if a third-party custodian is hacked, shuts down or goes bankrupt, “you may lose access to your crypto assets”.

• Holdings in your own wallet: what you do not actively trade belongs in a wallet whose keys only you hold.
• Test the withdrawal route: send a small amount from the exchange to your wallet once, before you need it in an emergency.
• Check the exchange: find out which company holds your coins, how it is regulated, whether it uses hot or cold wallets and whether it lends out customer assets. The SEC bulletin lists these questions.
• Not everything on one exchange: keep only the capital you are currently trading there.
• Secure your account: two-factor login by app or security key instead of SMS, and a fixed list of allowed withdrawal addresses.

Your own wallet removes the exchange risk, but it gives you a new one. With a hardware wallet, your keys sit offline on a separate device. For smaller amounts a software wallet such as MetaMask is enough. Before every approval, check the address, the amount and the requested action on the device’s display. Do not confirm an approval you do not understand. At Bybit, the signers saw a harmless transaction that in fact rebuilt the wallet.

Whether the step pays off for you depends on the amount and on your care. The two lists compare what your own wallet gains over an exchange account and what responsibility it puts on you.

Pros of your own wallet

• No exchange hack risk: an attack on the exchange no longer hits your coins.
• No freeze: a withdrawal stop at the exchange does not affect you.
• Not part of a bankruptcy estate: a bankruptcy of the exchange, as at Mt. Gox or FTX, leaves your holdings untouched.

Cons of your own wallet

• Full responsibility: if device and recovery words are lost, the holdings are gone for good; nobody can get them back.
• No helper in an emergency: only your own care protects you against phishing and fake approvals.
• Extra step for trading: to trade, you first have to send the coins back to an exchange.

Testing the withdrawal route is the underrated step. Many people only notice in an emergency that an address is missing, a network is not supported or a new identity check is due. A small test run settles that in quiet times.

If you trade actively, you still need an exchange. For traders, your own wallet is not a replacement but the store for everything that is not in the market right now. Our reviews of Kraken and Bitpanda show what to look for in custody and licences, and the MEXC review shows why you should first check where an exchange may legally serve you.

Exchange rankings on data sites do not measure your custody risk. In our CoinGecko review, Binance still had a Trust Score of 10 out of 10 on November 8, 2026, after the hack. The score weighs liquidity most, so check custody and reserves at the exchange itself.

No deposit insurance: what US rules mean after a hack

There is no deposit insurance for crypto in the US. The FDIC’s fact sheet on crypto companies says deposit insurance does not apply to crypto assets. It also does not protect against the default, insolvency or bankruptcy of any non-bank, including crypto custodians and exchanges.

SIPC does not fill that gap for ordinary exchange balances. SIPC protection concerns eligible assets held at a failing SIPC-member brokerage. According to SIPC, it does not protect any digital or crypto asset that does not qualify as a security under the Securities Investor Protection Act (SIPA). Whether an exchange can replace a loss therefore depends on its own funds, on recovered assets and on how a bankruptcy runs.

If you lose crypto to a hack or a scam, report it. The FBI asks for reports through its Internet Crime Complaint Center at ic3.gov or the local FBI field office; it says so in its alert on the Binance hack. Readers in the EU find the custody and liability rules of the MiCA regulation in our guide to crypto exchanges in Europe.

Conclusion: compensation rarely comes at once and never automatically

Of eleven major hacks of crypto exchanges, six ended with the exchange covering the loss, without bankruptcy and without sharing it out among customers, and Binance has pledged a seventh. That is the good news. The bad news: whether and when customers saw their money depended on the exchange’s means, on recovered assets and on the settlement. Where the exchange could not carry the loss, customers waited years, at Mt. Gox more than a decade.

My assessment: the attackers are better organized than ever. 2026 is already the record year, and most of the loot goes to North Korea. For you this means: keep on the exchange only what you are trading, put the rest in your own wallet and test the route there before you need it. This is no investment advice.

Frequently asked questions about crypto exchange hacks

What was the largest crypto hack of all time?

The largest known crypto hack is the attack on Binance of October 29, 2026. Binance puts the loss at about $6.3 billion. Before that, Bybit held the record with $1.46 billion in February 2025.

What happened to Mt. Gox, and do creditors get their money back?

By 2014, Mt. Gox had lost about 850,000 bitcoin, of which 200,000 turned up again. The trustee has been repaying in bitcoin and bitcoin cash since July 2024. He extended the repayment deadline to October 31, 2027, because many creditors have not completed their paperwork.

Who is the Lazarus Group?

Lazarus is a hacker group that the FBI attributes to North Korea. The FBI named it together with APT38 as the attacker in the Ronin hack of 2022. The FBI tracks the large exchange hacks at DMM Bitcoin, Bybit and Binance under the name TraderTraitor.

Has Binance been hacked before?

Yes, Binance has been hacked twice. In May 2019 Binance lost 7,000 bitcoin and replaced them from the SAFU fund. On October 29, 2026, the largest known crypto hack followed with about $6.3 billion.

Is my balance on a crypto exchange safe?

Whether you get your money back after a hack depends mainly on whether the exchange can pay. There is no deposit insurance for crypto. It is safer to leave only your trading capital on the exchange and keep the rest in your own wallet.

Is crypto FDIC insured or SIPC protected?

No, the FDIC does not insure crypto assets, and SIPC does not cover ordinary crypto exchange balances. SIPC protects eligible assets at a failing SIPC-member brokerage, and it excludes crypto that is not a security under SIPA. The FDIC says its deposit insurance also does not cover the failure of a crypto exchange or custodian. Check what an exchange says about insurance before you leave larger amounts there.