Binance’s US$6.3 Billion Breach Is Four Times the Previous Crypto Hack Record

Most of the US$6.36 billion stolen from Binance on 29 October 2026 was moved in just 20 minutes.

According to TRM Labs, the breach is now the largest crypto hack on record, with losses more than four times the US$1.5 billion stolen from Bybit in February 2025.

The scale of the Binance attack puts some of the industry’s most notorious breaches into perspective. How do earlier hacks compare?

Our updated ranking looks at the biggest crypto thefts in history, measured by their reported value at the time, including the infamous Mt. Gox collapse more than a decade ago.

The 10 Biggest Crypto Hacks in History

Last Updated: 11 November 2026.

1. Binance (US$6.3 billion, 2026)

Binance, the world’s largest crypto exchange by trading volume, said an attacker used a DevOps engineer’s compromised laptop to reach a service container and submit unauthorised withdrawals.

The exchange said it found no sign of a private key leak, while TRM assessed that the attacker had instead gained control of its hot wallet signing system.

Most of the US$6.36 billion that TRM traced left Binance wallets across ten blockchains in about 20 minutes.

The FBI attributed the theft to TraderTraitor, a finding questioned by US President Donald Trump and rejected by North Korea as a US attempt to damage its image.

2. Bybit (US$1.5 billion, 2025)

Attackers drained one of Bybit’s Ethereum cold wallets in February 2025 after disguising a malicious transaction as a routine one so that signers approved it.

Just like Binance’s, the FBI also attributed the theft to North Korea, and the haul stood as the largest crypto hack until Binance’s breach.

Bybit kept withdrawals running by replenishing its reserves through emergency loans and deposits from large holders.

3. Ronin Network (US$625 million, 2022)

Hackers took about 173,600 ether and 25.5 million USD Coin from Ronin Network, the bridge behind the blockchain game Axie Infinity, in March 2022.

The theft, valued at about US$625 million, was one of several 2022 attacks on bridges, the software that moves tokens between blockchains.

The Ronin breach also had a North Korean connection.

The FBI identified the Lazarus Group as responsible in April 2022, while US authorities sanctioned a cryptocurrency wallet linked to the stolen funds.

4. Poly Network (US$611 million, 2021)

An attacker took about US$611 million from Poly Network, a decentralised finance (DeFi) platform for moving tokens between blockchains, in August 2021.

DeFi lets users lend, borrow and trade tokens without a bank or exchange in the middle.

The hacker later returned almost all of the funds, making Poly one of the few large thefts where victims recovered nearly everything.

5. Binance BNB Bridge (US$569 million, 2022)

In October 2022, attackers exploited a bug in BSC Token Hub, a bridge linked to Binance’s BNB Chain, to forge transactions and create about 2 million BNB worth roughly US$570 million.

Unlike the 2026 breach at #1, this attack targeted the blockchain network rather than the exchange’s customer wallets.

Binance asked validators to pause the network while it contained the attack.

It estimated that only US$100 million to US$110 million actually left the chain, and because the tokens were newly minted, no user funds were affected.

6. Coincheck (US$530 million, 2018)

Thieves drained 523 million NEM tokens from an internet-connected hot wallet at Tokyo-based Coincheck in January 2018.

The exchange refunded more than US$440 million to all 260,000 affected customers from its own funds within about seven weeks.

Japan’s Financial Services Agency tightened its oversight of exchanges after the breach, and Monex Group later acquired Coincheck.

7. FTX (US$477 million, 2022)

More than US$477 million left FTX’s wallets in unauthorised transfers on 11 and 12 November 2022, as the exchange filed for bankruptcy, according to Elliptic.

FTX’s administrators later put the losses at US$413 million.

US prosecutors charged three people in early 2024 over a US$400 million SIM-swap theft (hijacking a victim’s mobile number) that Krebs on Security linked to FTX, although the indictment did not name the victim.

8. Mt. Gox (US$473 million, 2011 to 2014)

Mt. Gox, once the largest bitcoin exchange, suffered a string of thefts from 2011 and filed for bankruptcy in early 2014 with losses valued at about US$473 million.

About 24,000 customers lost access to their funds, and the trustee has since pushed the repayment deadline to October 2027, the sixth extension since 2023, and Mt. Gox wallets still hold about 34,400 BTC.

9. Wormhole (US$320 million, 2022)

Hackers took 120,000 ether-linked tokens from Wormhole, a DeFi bridge, in February 2022 by exploiting a weakness tied to an upgrade that had not yet been deployed to the live platform.

Jump Trading’s crypto arm, which had bought Wormhole’s developer in 2021, replaced the missing funds.

10. DMM Bitcoin (US$305 million, 2024)

Japanese exchange DMM Bitcoin lost more than 4,500 BTC, valued at over US$300 million, in 2024, with on-chain investigators suspecting North Korea’s Lazarus Group.

The FBI, the US Department of Defence and Japan’s National Police Agency later blamed North Korean hackers for the theft, which they valued at US$308 million.

How Do Crypto Hacks Happen?

Exchange and Wallet Breaches

Bybit showed in 2025 that cold wallets, which keep private keys offline, can still be drained when attackers compromise the people and systems that approve transactions.

The Binance breach went further, with TRM finding that one attacker obtained valid signatures for Binance wallets on ten blockchains within about half an hour.

On Ethereum, the attacker used EIP-7702, a feature that lets a wallet hand control to a smart contract, and submitted 50 pre-signed authorisations so that at least one would still be valid when the transaction ran, TRM said.

Smart Contract and Bridge Exploits

DeFi platforms run on smart contracts, so poorly audited code can let attackers drain funds, as Poly Network and the BNB Bridge showed.

Bridges remain a frequent target, and attackers took about US$290 million from KelpDAO in April 2026, the biggest crypto heist of the year until Binance.

Private Key Theft and Social Engineering

Attackers who obtain a private key gain full control of a wallet, usually through phishing, malware or impersonation.

Before a US$285 million theft from Drift Protocol in April 2026, North Korean proxies held months of in-person meetings with Drift staff.

Who is Behind the Biggest Crypto Hacks?

Groups linked to North Korea now account for most of the value stolen in crypto hacks.

TRM found their share of global hack losses rose from under 10% in 2020 and 2021 to 64% in 2025, then reached 76% in the first four months of 2026.

TRM put North Korea’s attributed crypto theft since 2017 at more than US$6 billion as of April 2026, roughly what the Binance breach took in a single evening.

Chainalysis data shows the Bybit theft made up most of the US$2.02 billion North Korea stole in 2025.

The trend has been building for years, with TRM tracing about a third of 2023’s crypto hacks to North Korea.

What Happens to Stolen Crypto?

Stablecoin issuers can freeze tokens on their own networks, which limited what the Binance attacker could keep.

Tether, Circle, Ripple and World Liberty Financial froze about US$2.67 billion in stablecoins, and Arbitrum’s Security Council froze roughly US$30 million more, according to TRM.

Bitcoin and Ether cannot be frozen that way.

TRM said the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth about US$2.4 billion, and expects those funds to move through bridges, swap services and over-the-counter brokers.

The breach moved markets too, with Bitcoin falling more than 4% to about US$78,000 the next day.

Will the Binance Victims Get Their Money Back?

Crypto held on an exchange is not insured like a bank deposit, so any refund is up to the platform, NBC News noted.

Binance is covering the losses from company funds and resumed withdrawals in phases on 1 November.

“Binance will absorb the financial impact of the stolen funds, not our users,” said Richard Teng, Co-CEO of Binance.

Outcomes for past victims have varied widely.

Coincheck refunded customers within weeks, Poly Network’s hacker returned the funds and Jump Trading covered Wormhole’s losses, while some Mt. Gox creditors are still waiting twelve years after its collapse.

What the Binance Hack Means for Southeast Asia?

Binance TH, the Thai exchange run by Gulf Binance, paused deposits and withdrawals for security checks and said its cold wallets are kept separate from Binance’s.

Thailand’s SEC said it found no major impact on locally held assets and told licensed operators to verify customer holdings.

Meanwhile, Binance’s Philippine partner BlockShoals said it was assessing the breach’s implications for its project in the SEC’s Strategic Sandbox.

Malaysia presents a different situation, with Binance confirming it has spent ten months in licence talks with the Securities Commission Malaysia (SC) and Bank Negara Malaysia (BNM).

The confirmation came weeks after the SC returned Binance to its Investor Alert List.

Singapore, meanwhile, already has additional regulatory safeguards in place.

MAS expanded the Payment Services Act in April 2024 to introduce further user protection and financial stability requirements for digital payment token providers.

How to Protect Your Crypto from Hackers

Use licensed platforms where you can.

Thailand’s SEC urged investors to stick to licensed digital asset operators and to watch for scams that use the Binance incident to persuade people to move their assets.

Turn on multi-factor authentication, and use multi-signature wallets for larger holdings so that no single approval can move funds.

Spread holdings across storage types, with hot wallets for day-to-day transactions and cold or hardware wallets for long-term savings.

Check website addresses before logging in, avoid links in unsolicited messages, and confirm that a DeFi project’s smart contracts have been audited by a reputable firm before depositing funds.

The Future of Crypto Security

TRM has urged exchanges to watch their wallets for unexpected EIP-7702 delegations, reject authorisations they did not request, and separate signing systems by blockchain and wallet tier.

In the Binance breach, a single attacker reached wallets on ten chains within hours.

Chris Perkins, Head of Franklin Crypto at Franklin Templeton, said the hack shows the need for stronger cybersecurity standards and closer coordination between governments.

“They don’t have the same sorts of safeguards,” said Michael Selig, Chairman of the Commodity Futures Trading Commission, comparing offshore exchanges with US markets in a CNBC interview.

What Comes Next for Binance?

Binance has said it will publish a detailed technical post-mortem once its investigation is complete and the facts are verified, InvestmentNews reported.

Frequently asked questions (FAQs)

1. What are the biggest crypto hacks in history?

Binance’s breach in October 2026, at about US$6.3 billion, is the largest on record. It is followed by Bybit (US$1.5 billion, 2025), Ronin Network (US$625 million, 2022) and Poly Network (US$611 million, 2021).

2. How do hackers steal cryptocurrency?

Common methods include compromising an exchange’s wallets or signing systems, exploiting bugs in smart contracts and bridges, stealing private keys, and tricking users through phishing or social engineering.

3. Can stolen cryptocurrency be recovered?

Stablecoin issuers can freeze stolen tokens, as they did with about US$2.7 billion from the Binance hack, but Bitcoin and Ether cannot be frozen the same way.

Full recovery is rare unless the hacker returns the funds, as happened with Poly Network.

4. Do exchanges reimburse customers after a hack?

Some do, including Coincheck in 2018 and Binance in 2026. Exchange balances are not insured like bank deposits, so repayment depends on the platform.

5. What is the safest way to store cryptocurrency?

Cold wallets that keep private keys offline are generally safer than hot wallets or exchange accounts, though the Bybit breach shows they are not immune.

Using licensed platforms and spreading holdings across storage types lowers the risk further.

Featured image: Edited by Fintech News Singapore based on an image by habibdesigner1 via Magnific.