Crypto Hacks and Crimes: A History of Digital Asset Theft

The Mt. Gox Bitcoin exchange suffered a major security breach when a hacker used stolen auditor credentials to transfer large amounts of Bitcoin and manipulate the price to USD 0.01. Over 2,600 BTC was stolen and 424,242 BTC was moved to cold storage to prove reserves.

Mt. Gox, the world's largest Bitcoin exchange handling 70% of all Bitcoin transactions, abruptly shut down and filed for bankruptcy protection in Japan. Approximately 850,000 Bitcoin, worth over USD 460 million at the time, had been stolen from its hot wallets over several years beginning in late 2011.

An attacker exploited a vulnerability in The DAO, a decentralized autonomous organization on Ethereum, draining approximately 3.6 million Ether worth USD 60 million. The hack led to a contentious hard fork of the Ethereum blockchain, creating Ethereum (ETH) and Ethereum Classic (ETC).

The Bitfinex cryptocurrency exchange was hacked, resulting in the theft of approximately 120,000 Bitcoin worth USD 72 million. The hack exploited Bitfinex's multi-signature wallet system. Bitfinex later issued recovery tokens (BFX) to affected customers.

Japanese cryptocurrency exchange Coincheck was hacked, losing approximately 523 million NEM tokens worth USD 534 million at the time. The hack, one of the largest ever, occurred because funds were stored in a hot wallet. Coincheck later reimbursed all affected customers.

Binance, the world's largest cryptocurrency exchange, suffered a security breach resulting in the theft of 7,000 Bitcoin (approximately USD 40 million). Hackers obtained user API keys and two-factor authentication codes. Binance covered the losses from its Secure Asset Fund for Users (SAFU).

The Ronin Network, a sidechain for the Axie Infinity game, suffered a bridge exploit that drained 173,600 Ethereum and 25.5 million USDC, worth approximately USD 620 million. Hackers compromised five of nine validator keys. The US Treasury later linked the attack to North Korea's Lazarus Group.

The TerraUSD algorithmic stablecoin lost its peg to the US dollar, triggering a death spiral that destroyed approximately USD 45 billion in market value within a week. The collapse led to contagion across the cryptocurrency lending market, forcing Celsius Network and Voyager Digital into bankruptcy.

A cross-chain bridge exploit on the BNB Smart Chain allowed an attacker to withdraw approximately 2 million BNB tokens worth USD 570 million. The hacker exploited a vulnerability in the Binance Bridge's proof-of-stake verification logic. Binance temporarily halted the chain and prevented most of the stolen funds from being transferred.

FTX, the third-largest cryptocurrency exchange, filed for Chapter 11 bankruptcy after it was revealed that customer funds were misappropriated to Alameda Research. Approximately USD 8 billion in customer assets went missing in what prosecutors described as one of the largest financial frauds in US history.

Binance and CEO Changpeng Zhao agreed to pay USD 4.3 billion to settle charges with US agencies for violations of the Bank Secrecy Act and sanctions laws. Binance was found to have allowed illicit transactions including those by Hamas, ISIS, and ransomware attackers through its platform.

Terraform Labs co-founder Do Kwon pleaded guilty to two counts of fraud in US federal court, agreeing to forfeit USD 19 million. He was later sentenced to 15 years in prison for his role in the USD 45 billion Terra-Luna collapse that devastated retail investors worldwide.

On April 1, 2026, attackers drained 285 million USD from the core liquidity vaults of Drift Protocol, the largest decentralized perpetual futures exchange on Solana, executing the theft in roughly twelve minutes before the protocol paused operations. Drift later attributed the breach to a six-month social engineering operation by North Korean (DPRK) hackers that began in fall 2025. It was one of the two largest crypto thefts of 2026.

On April 18, 2026, an attacker drained 116,500 rsETH, roughly 18 percent of the circulating supply of Kelp DAO's liquid restaking token, worth 292 million USD, with wrapped ether stranded across 20 chains. LayerZero tied the exploit to the Lazarus subgroup TraderTraitor, and investigators later traced tens of millions in frozen assets. Together with the Drift Protocol breach 17 days earlier, the two North Korea-linked attacks accounted for 76 percent of all crypto hack value in 2026 through April.

On July 30, 2026, an attacker exploited a seed-generation flaw present in Coldcard hardware wallet firmware since March 2021, draining 1,082.65 BTC (about 70 million USD) from 1,196 addresses in a 41-minute sweep without phishing, malware, or physical access to the devices. It became the largest hardware-wallet exploit on record, prompting recalls and firmware overhauls across the industry.

Poland's largest cryptocurrency exchange, Zondacrypto (formerly Zonda), collapsed amid a criminal investigation into missing customer funds, with losses reported at up to 2.4 billion zlotys by late August 2026, up from initial estimates near 97 million USD. CEO Przemyslaw Kral was charged with large-scale fraud, the Polish Olympic Committee president was detained in connection with the probe, and the exchange's Estonian operator entered bankruptcy. The scandal widened into a political crisis over alleged donations linked to the exchange, and Estonia's regulator flagged the firm for missing token disclosures under MiCA rules.

An attacker used a price manipulation attack against the TONIC token to drain roughly 75 million USD from Tectonic, the largest lending protocol on Crypto.com's Cronos chain. Validators halted the entire Cronos blockchain, producing no blocks for about 10 hours, which stranded most of the stolen funds on-chain; only about 6 million USD reached Ethereum before the halt. The incident marked one of the largest DeFi exploits of 2026 and an unprecedented full-chain halt for a major corporate-backed network.

A coordinated operation by CrowdStrike, the US Department of Justice, the FBI, and European law enforcement dismantled the Russia-based Sality peer-to-peer botnet, whose EggJagger payload hijacked copied Bitcoin and Ethereum addresses on infected machines to redirect payments to attackers. The malware had operated undetected for roughly eight years across more than 15,000 compromised devices before the takedown, which began on August 31, 2026 and was announced on September 1.

Around 4,000 BTC, worth approximately 320 million USD and roughly 95 percent of the Bitcoin sidechain's reserves, was drained from the Liquid Network federation wallet on September 6, 2026. The exploit did not involve stolen keys; self-described white hats reportedly pledged to return most of the funds after Blockstream patches the vulnerability. Liquid Network, a Blockstream-managed federated Bitcoin sidechain used by more than 80 exchanges and institutions, halted transactions and blocked L-BTC redemption while the incident was investigated.

Malone Lam, a 22-year-old Singaporean national, pleaded guilty in federal court to racketeering conspiracy for organizing a social-engineering ring that drained more than 245 million USD in bitcoin (over 4,100 BTC) from a Washington DC victim in August 2024, laundering it through mixers and exchanges while spending proceeds on luxury cars, jewelry, and private jets. The case was the first US Department of Justice prosecution to apply civil RICO statutes to a large-scale bitcoin theft ring, and marked the resolution of one of the largest single-victim crypto thefts ever prosecuted. Lam's sentencing was scheduled for a status hearing in December 2026.

Blockstream rejected ransom demands from the hackers behind the September 6, 2026 Liquid Network exploit, calling the theft non-negotiable after 3,400 of the roughly 4,000 stolen BTC (85 percent) were returned. The company pledged to pursue the remaining 598.5 BTC through law enforcement, exchange monitoring, and forensics.

A breach of Haruko, a third-party crypto trading application, compromised clients of 15 crypto firms, exposing exchange API credentials, trading data and customer funds, according to CoinDesk. The incident highlighted persistent supply-chain risk in crypto trading infrastructure, where third-party tools holding exchange API access can serve as a single point of failure across many institutions at once.

Crypto exchange Bitget suffered a security breach affecting 351.6 million USD in unauthorized transfers from its hot and warm wallet layers, disclosed by CEO Gracy Chen on Sept 24, 2026 after independent researchers flagged abnormal wallet movements. Cold wallets and a 464 million USD user protection fund were reported intact, but withdrawals were paused across all asset-network pairs pending a security review. The breach is among the largest exchange hacks of 2026, and Circle and Tether subsequently froze hacker-held stablecoins.

On October 7, 2026, a federal jury in New York convicted Maryland cybersecurity consultant Jonathan Spalletta of stealing nearly 55 million USD in cryptocurrency from the Uranium Finance decentralized exchange in two 2021 attacks, with part of the proceeds spent on rare Pokemon and Magic: The Gathering cards. The jury also found he laundered proceeds through the Tornado Cash mixer, a count carrying up to 20 years in prison; Judge Jed Rakoff set sentencing for February 16.