By Marcus ReeveEvery Major Crypto Exchange Hack in One Sourced Table
Updated October 30, 2026. Binance figures are still moving, so each one below carries its source and time. This page will be revised as Binance and investigators publish more.
Short answer: The biggest crypto exchange hack on record is the theft from Binance on October 29, 2026. Estimates run from about $6.3 billion (Binance) to about $6.36 billion (TRM Labs) and about $6.4 billion (Chainalysis). That is roughly four times the previous record, the approximately $1.5 billion taken from Bybit in February 2025. TRM Labs and Chainalysis attribute the Binance theft to North Korea's TraderTraitor group. Between $2.7 billion and $3 billion was reported frozen within about a day, which is not the same as returned. Binance says it will cover all losses; that remains its pledge, not an independently verified outcome.
The Complete Table: Every Exchange Theft of $50 Million or More
Rows are ranked by a headline USD figure at the time of the theft. Where sources differ, the range is shown here and explained under "Where the sources disagree." "n/a" means the sources we read do not establish the figure, and we would rather leave a cell empty than estimate it. "Not named" means those sources name no attacker.
| # | Date | Exchange | Stolen, USD at the time | Attacker attribution | Frozen or recovered | Customers made whole? |
|---|---|---|---|---|---|---|
| 1 | Oct 29, 2026 | Binance | $6.3B to $6.4B | TraderTraitor, North Korea (TRM, Chainalysis) | $2.7B to $3B frozen, not returned | Pledged by Binance, not yet verified |
| 2 | Feb 21, 2025 | Bybit | About $1.5B | North Korea (FBI) | 3.84% frozen (CEO, April 2025) | Yes, per Bybit, using loans and purchases |
| 3 | Jan 26, 2018 | Coincheck | About $530M | Not named | n/a | Yes, in yen: about ¥46.3B against ¥58B taken |
| 4 | Nov 12, 2022 | FTX | $400M+ to $477M | US SIM-swap defendants; FTX link per Elliptic | About $100M frozen (about 21%) | n/a, handled inside the bankruptcy |
| 5 | Feb 24, 2014 | Mt. Gox | About $473M | Two Russians charged by the US (allegations) | About 200,000 BTC found (about 24%) | No, partial; deadline now Oct 31, 2027 |
| 6 | Sep 24, 2026 | Bitget | $351.6M to $390M | North Korea suspected (Bitget CEO, Chainalysis, TRM) | $339,100 in stablecoins (Sep 25); later total n/a | Bitget says its fund covers it |
| 7 | May 31, 2024 | DMM Bitcoin | $304M to $308M | TraderTraitor, North Korea (FBI) | n/a | Deposits pledged; accounts moved to SBI, exchange closed |
| 8 | Sep 26, 2020 | KuCoin | $275M to $281M | Lazarus, North Korea (Chainalysis) | 84% (CEO, Nov 2020) | n/a |
| 9 | Jul 18, 2024 | WazirX | About $235M | North Korea (US, Japan, South Korea) | n/a | Partly, about 85% of admitted claims |
| 10 | Dec 4, 2021 | BitMart | $150M to $196M | Not named | n/a | Pledged by BitMart |
| 11 | Feb 9, 2018 | BitGrail | About $170M | Not named; court held the owner responsible | n/a | No, a reported 92% loss |
| 12 | Nov 10, 2023 | Poloniex | About $126M | Not named | n/a | Pledged by owner Justin Sun |
| 13 | Aug 19, 2021 | Liquid | $91M to $97M | North Korea (Chainalysis) | n/a | Yes, per Liquid, with a $120M FTX loan |
| 14 | Jun 18, 2025 | Nobitex | $90M to $100M | Predatory Sparrow claimed it; likely per Elliptic | None: effectively burned (Elliptic) | Pledged by Nobitex from its reserve fund |
| 15 | Dec 11, 2021 | AscendEX | About $77.7M | Not named | n/a | 100% pledged by AscendEX |
| 16 | Jan 23, 2025 | Phemex | $70M to $73.5M | North Korea suspected, unconfirmed | n/a | Pledged, outcome not verified |
| 17 | Aug 2, 2016 | Bitfinex | About $72M | Ilya Lichtenstein admitted it | About 94,000 BTC (about 80%) later recovered | Yes, after a 36% haircut; repaid by April 2017 |
| 18 | Sep 14, 2018 | Zaif | About $59M | Not named | n/a | Pledged through a stake sale, outcome not verified |
| 19 | Jun 22, 2024 | BtcTurk | About $55M | Not named | About $5.3M (about 10%) frozen by Binance | Exchange says customers unaffected |
| 20 | Sep 12, 2023 | CoinEx | $52.7M to $54.3M | Lazarus suspected (Halborn) | n/a | 100% pledged by CoinEx |
What Is Known About the Binance Theft, by Source and Time
The first numbers came fast and changed within hours. TechCrunch reported on the afternoon of October 29, Pacific time, that crypto watchers put the drain at $2 billion or more and that CoinDesk estimated upward of $5.7 billion. The later figures, all still estimates, look like this:
| Source and time | Stolen | Frozen | What the number means |
|---|---|---|---|
| TRM Labs, on-chain state at Oct 30, 00:30 UTC | About $6.36B ($6.23B at current prices) | About $2.7B | Each transfer valued at its price when taken |
| Chainalysis, Oct 30 | About $6.4B | About $2.8B | The page's time stamp for the frozen figure is blank |
| Binance, first update, Oct 30 | About $6.3B | About $3B | Binance's own estimate of total impact |
| Binance, Update #2, Oct 30 | About $6.3B | About $3B | Same estimate; no time zone shown on the page |
How it happened, according to each party. Binance says that around 20:05 UTC on October 29 its hot wallets were compromised. Its first explanation was a compromised DevOps engineer's laptop that gave access to a service container. Update #2 says the laptop may be involved but that later work "uncovered additional points of breach," and that Binance has "found no evidence that wallet private keys were leaked." TRM Labs reads the evidence differently: valid signatures across ten chains in about half an hour point, in its assessment, to compromise of Binance's hot wallet signing infrastructure. Chainalysis dates the first outflows to around 4:20 p.m. Eastern, which is 20:20 UTC. TRM's timeline shows the XRP Ledger going first at 20:05 and the Bitcoin and Ethereum transfers at 20:20, which may account for that gap. A root cause has not been published.
Who froze what. TRM counts about 1.77 billion USDT frozen by Tether, about 825 million USDC by Circle, 40.5 million RLUSD by Ripple and 27.8 million USD1 by World Liberty Financial, plus about $30 million in ETH and ARB moved by Arbitrum's Security Council. Earlier reports of $1.56 billion from Tether and about $800 million from Circle were snapshots from the first hours. Binance co-CEO Yi He has said Ripple helped stop about $200 million from moving; TRM has confirmed the 40.5 million RLUSD freeze on-chain.
What the attacker still holds. As of TRM's snapshot, more than 420,000 ETH and 18,270 BTC, about $2.4 billion, were beyond any issuer's reach. Freezes work on issued tokens. They do not work on native coins, which is why, per TRM, the attacker sold stablecoins at a steep cost in the first hours. Our reference table of stablecoin depegs and USDT and USDC comparison cover how those issuers work.
What Binance promises. In a statement carried by ABC News, Binance said: "Binance will cover all losses from the SAFU fund and the company's funds" and "User funds are safe." That is Binance's claim. Update #2 says it has "set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets," that this covers approximately 80% of the impacted amount, and that it is buying the rest through market and over-the-counter channels. It targets a phased restart of withdrawals within about 34 hours of that update, subject to security checks, and says deposits remain operational. Early reports, including Al Jazeera and ABC News, said deposits were suspended too.
Still unconfirmed on October 30:
- The root cause. Binance has promised technical findings within about 48 hours and a full post-mortem with no date.
- Whether customers are fully covered. A Proof of Reserves result is promised by November 2, 2026.
- The final stolen and frozen totals, which differ by source and were still changing.
- Attribution by a government. The North Korea assessments so far come from analytics firms, and Binance's Update #2 names no actor.
How BTC Moved After Each Theft
We measure each move from the last daily close before the event date, using the Coin Metrics daily reference rate. "1 day" is the close on the event date, "7 days" is six days later and "30 days" is 29 days later.
| Exchange | Event date | Last close before | 1 day | 7 days | 30 days |
|---|---|---|---|---|---|
| Binance | 2026-10-29 | $81,237 | -3.7% | -0.9% | n/a |
| Bitget | 2026-09-24 | $84,434 | -0.1% | -1.0% | -4.2% |
| Nobitex | 2025-06-18 | $104,628 | +0.2% | +1.3% | +14.2% |
| Bybit | 2025-02-21 | $98,392 | -2.4% | -14.0% | -14.8% |
| Phemex | 2025-01-23 | $103,791 | +0.4% | +0.1% | -7.5% |
| WazirX | 2024-07-18 | $64,201 | -0.3% | +1.8% | -8.2% |
| BtcTurk | 2024-06-22 | $64,086 | +0.3% | -5.9% | +6.2% |
| DMM Bitcoin | 2024-05-31 | $68,375 | -1.5% | +3.5% | -10.9% |
| Poloniex | 2023-11-10 | $36,675 | +1.9% | -1.4% | +19.3% |
| CoinEx | 2023-09-12 | $25,135 | +2.9% | +6.5% | +6.7% |
| FTX | 2022-11-12 | $16,917 | -0.9% | -1.5% | +1.0% |
| AscendEX | 2021-12-11 | $47,437 | +4.0% | -2.3% | -11.7% |
| BitMart | 2021-12-04 | $53,672 | -8.4% | -11.6% | -11.8% |
| Liquid | 2021-08-19 | $44,954 | +3.8% | +9.0% | +5.0% |
| KuCoin | 2020-09-26 | $10,684 | +0.5% | -1.1% | +22.1% |
| Zaif | 2018-09-14 | $6,491 | +0.1% | +0.1% | -4.5% |
| BitGrail | 2018-02-09 | $8,219 | +5.4% | +23.0% | +6.9% |
| Coincheck | 2018-01-26 | $11,130 | -0.9% | -18.8% | -13.0% |
| Bitfinex | 2016-08-02 | $607 | -13.1% | -2.5% | -5.6% |
| Mt. Gox | 2014-02-24 | $610 | -11.1% | -8.5% | -4.3% |
Binance's 30-day cell is n/a because that window has not elapsed (it closes November 27); its 7-day move, to the November 4 close, is -0.9% (Bitfinex daily candles give about -1.0%). Its 1-day move covers less than four hours after the theft began. For that same day, Bitfinex candles give about -4.1% and CoinGecko about -4.2%. Al Jazeera reported a fall of about 5%, to below $77,000, on October 30.
Across the 20 rows, the median 1-day move is 0.0%, with 10 declines. The median 7-day move is -1.1% across all 20 rows, with 12 declines; the median 30-day move is -4.3% across 19 rows, with 11 declines. The sharpest 1-day falls are Bitfinex (-13.1%), Mt. Gox (-11.1%) and BitMart (-8.4%). These are small samples set against very different markets, and BTC moves on many other things in any given month. They describe what happened next, not what the theft caused, and they are no guide to what comes next. For wider context, see every Bitcoin crash over 50% and Bitcoin returns by year.
Patterns in the Table
- Binance alone is about 55% of the total. The 20 rows add up to about $11.6 billion on our headline figures, and Binance and Bybit together are about 68%.
- North Korea appears in 9 of 20 rows, worth about 80% of the dollars. Six are firm attributions by governments or analytics firms: Binance, Bybit, DMM Bitcoin, KuCoin, WazirX and Liquid. Three are only suspected: Bitget, Phemex and CoinEx.
- Large recoveries are rare. Only KuCoin (84%) and Bitfinex (about 80%) report recovering most of the loss. Eleven rows are n/a, and Nobitex's funds were destroyed rather than saved.
- Pledges are not outcomes. Ten of the 20 customer cells are company pledges whose result we could not verify. Five report customers covered, three show customers left short (Mt. Gox, WazirX, BitGrail), and two are n/a.
- A hack can outlast its headlines. Mt. Gox's repayment deadline moved again this month, to October 31, 2027, more than 13 years after the exchange halted.
Methodology
- Inclusion threshold: at least one credible estimate of $50 million or more at the time of the theft, confirmed by the exchange or by a named analytics firm or authority.
- USD at the time: dollar amounts reflect prices when the assets were taken or when the loss was first reported, never today's prices. A Bitcoin loss from 2014 would be far larger at today's prices, and we do not rank on that.
- What counts as an exchange: a custodial trading venue holding customer funds. Bridges, sidechains and DeFi protocols are excluded even when larger.
- Excluded for that reason: the Liquid Network sidechain (about $319 million, September 2026; not the Liquid exchange in row 13), KelpDAO, and the HECO bridge (about $86.6 million, November 2023). HTX's own hot wallet loss that day was about $12.5 million, below the threshold.
- Near misses: BtcTurk's 2025 loss ($48 million to $51.7 million) straddles the line and is left unranked. Binance's own May 2019 theft of 7,000 BTC, about $40 million, is below it.
- Dates: the date the theft occurred or, where that is unclear, the date it became public. Mt. Gox's losses built up over years, so its row uses the day trading halted. Coincheck, Bitfinex and BitGrail use the public date.
- Frozen is not recovered: frozen funds are out of the attacker's reach but have not necessarily returned to anyone.
- Coverage limit: this list is built from the Rekt leaderboard and the reporting below. It may miss smaller or poorly documented cases. Corrections are welcome.
Where the Sources Disagree
- Bybit: about $1.5 billion (FBI); $1.436 billion (Rekt).
- Coincheck: ¥58 billion, or $530 million (Security Affairs); a Bloomberg headline cited by Wikipedia said $400 million.
- FTX: $477 million (Elliptic); over $400 million in a US indictment that does not name FTX.
- Mt. Gox: 850,000 BTC, cut to 650,000 after 199,999.99 BTC turned up in an old wallet. The $473 million is a Wall Street Journal figure near the filing, as cited by Wikipedia.
- Bitget: $351.6 million first, then $387.5 million (BleepingComputer); The Hacker News also reports $390.06 million.
- DMM Bitcoin: 4,502.9 BTC in every source, valued from $304 million to $308 million.
- KuCoin: $281 million (Decrypt); $275 million by Chainalysis (Cointelegraph). Rekt lists $45 million, close to the unrecovered part.
- BitMart: about $150 million (BitMart's CEO); about $196 million (PeckShield).
- Liquid: $97 million (Elliptic); $91 million (Chainalysis).
- Nobitex: over $90 million (Elliptic); about $100 million (Nobitex).
- Bitfinex date: Fortune says "Tuesday's breach" in an article dated August 3, 2016, which we read as August 2.
- KuCoin date: Decrypt gives September 26, while Rekt lists September 29.
FAQ
What is the biggest crypto exchange hack ever?
The October 29, 2026 theft from Binance, at about $6.3 billion to $6.4 billion depending on the source.
What was the biggest before Binance?
Bybit, at about $1.5 billion on February 21, 2025. The FBI attributed it to North Korea.
Did Binance customers lose money?
Binance says it will cover all losses and that user funds are safe. That is the company's statement. As of October 30, withdrawals were suspended and its Proof of Reserves result was still pending, so the outcome cannot yet be verified.
How much of the stolen Binance crypto was frozen?
About $2.7 billion per TRM Labs as of 00:30 UTC on October 30, about $2.8 billion per Chainalysis, and about $3 billion per Binance. These are frozen funds, not funds returned.
Who hacked Binance?
TRM Labs, with "high confidence," and Chainalysis attribute it to TraderTraitor, a North Korean group. Binance's Update #2 names no one.
What is SAFU?
The Secure Asset Fund for Users is Binance's emergency protection fund, described by Wikipedia as holding roughly $1 billion. Binance says it will use SAFU together with company funds.
Does BTC always fall after an exchange hack?
No. The median 1-day move across these 20 rows is 0.0%, with 10 declines and 10 gains. Nothing here is trading advice.
This page is a reference, not financial advice. Keeping assets on any exchange carries risk that a table of past thefts cannot size. You can follow market conditions on the SimianX crypto leaderboard.
Related Reading
- Every Bitcoin Crash Over 50%: Recovery Times Since 2011
- Every Major Stablecoin Depeg: A Complete Reference Table
- Bitcoin Returns by Year: Every Year 2011–2026 Table
- Stablecoins 2026: Visa, Stripe & the USDT vs USDC Race
References
Sources are listed by table row. Every linked page was read for this article.
- Binance: TRM Labs, Chainalysis, Binance Update, Binance Update #2, ABC News, Al Jazeera, The National, TechCrunch, Wikipedia
- Bybit: FBI, Rekt, Unlock, The Defiant, Bitcoin.com
- Coincheck: Security Affairs, Wikipedia
- FTX: Elliptic, Elliptic
- Mt. Gox: Wikipedia, TechCrunch, Decrypt, Cointelegraph
- Bitget: BleepingComputer, The Hacker News, Security Affairs, Chainalysis, Rekt
- DMM Bitcoin: BleepingComputer, Security Affairs, Decrypt, Korea JoongAng Daily
- KuCoin: Decrypt, The Block, Cointelegraph, ForkLog, Rekt
- WazirX: Wikipedia, Outlook Business
- BitMart: Finance Magnates, Investing.com, Silicon Republic
- BitGrail: Decrypt, Finance Magnates, Wikipedia
- Poloniex: Decrypt, Rekt
- Liquid: Engadget, Cointelegraph, Finance Magnates
- Nobitex: Infosecurity Magazine, The Block
- AscendEX: HI-Network, Rekt
- Phemex: The Block, Halborn, CryptoSlate, Rekt
- Bitfinex: Fortune, Wikipedia, Wikipedia
- Zaif: Public Radio East / NPR
- BtcTurk: Unlock, Halborn
- CoinEx: Halborn, BitPinas, Rekt
