If you’ve ever wondered whether your crypto is truly safe, the answer, at least historically, is: not always. The story of digital assets is also one of digital theft. Billions of dollars have been drained from wallets, exchanges, and protocols while the owners slept, worked, or simply logged in expecting a routine transaction. I’ve read about some of the biggest crypto hacks in history, and the patterns they reveal are both alarming and instructive.
According to the Immunefi 2026 State of Onchain Security report, an average crypto hack now costs around $25 million.
In this article, I’ll walk you through the five biggest crypto hacks of all time, what made each one possible, and how to protect your assets.
Also read: Top AI Tools for Cyber Security: A Smarter Way to Real-Time Cyber Threat Detection
Key Takeaways
- The biggest crypto hack in history is the 2025 Bybit heist, where approximately $1.5 billion in Ethereum was stolen by North Korea’s Lazarus Group.
- Most major cryptocurrency heists exploit human error, weak key management, or third-party vulnerabilities – not unbreakable code.
- Cold wallets, multi-factor authentication, and regular security audits are your strongest lines of defense.
- Even multi-signature systems can be compromised if the approval interface itself is manipulated.
- The total value stolen in crypto attacks across all time now runs into the tens of billions of dollars.
What is a Crypto Hack?
A crypto hack is any unauthorized breach that results in the theft, manipulation, or destruction of digital assets stored on a blockchain, exchange, wallet, or DeFi protocol.
Unlike traditional bank robberies, a crypto attack doesn’t require physical presence. A sophisticated hacker can drain hundreds of millions of dollars from halfway across the world using nothing more than a laptop, a vulnerability in code, and a willingness to exploit it.
Crypto hacks generally fall into a few categories:
- Exchange hacks: Attackers target centralized platforms where users store funds..
- Smart contract exploits: Flaws in protocol code are used to siphon funds.
- Bridge attacks: Cross-chain bridges connecting different blockchains are hit due to their complexity.
- Social engineering or supply chain attacks: Hackers manipulate people or third-party software to gain access.
What makes crypto theft truly devastating is its near-irreversibility. Once funds move on-chain to a hacker’s wallet, recovering them is extremely difficult without cooperation from exchanges or law enforcement.
Also read: Why Crypto Wrench Attacks are Becoming One of the Most Violent Forms of Crypto Crimes
5 Biggest Crypto Hacks of All Time
Bybit: $1.4 Billion (February 2025) – Biggest Crypto Hack
On February 21, 2025, approximately $1.4 billion in crypto was stolen from the large exchange Bybit. This is the largest single theft of any kind ever recorded – surpassing even the infamous looting of Iraq’s central bank in 2003.
How it happened
- Hackers gained access to a Safe developer’s computer and took control of the Safe UI specifically used for Bybit transactions.
- Malicious JavaScript was injected into the frontend code, making it appear that Bybit was signing a legitimate transaction when it was not.
- When Bybit employees went to approve a routine transfer, the UI displayed what looked like a valid destination address.
- Funds moved to hidden addresses before employees realized anything was wrong – a textbook supply chain attack executed with frightening precision.
Who did it
The theft has been attributed to Lazarus Group, an infamous North Korean criminal hacking group. The FBI officially confirmed that North Korea was responsible for the theft, referring to the operation as “TraderTraitor.”
Also read: OKX Temporarily Suspends DEX Aggregator Due to Lazarus Hack Risk
What happened after
Bybit froze the compromised wallet, brought in forensic teams, and launched a recovery bounty offering up to 10% of recovered funds. Within 48 hours, $160 million was laundered through DEXs and cross-chain bridges. The heist accelerated regulatory discussions on mandatory exchange security standards in the U.S., Singapore, and EU.
Lesson learned
Even multi-signature systems are vulnerable when the interface itself is poisoned. Security can’t stop at the smart contract – it must extend to every piece of software in the signing pipeline.
Ronin Network: ~$625 Million (March 2022)
Before Bybit, the Ronin Network cryptocurrency heist held the record; and it sat undetected for six days.
On March 29, 2022, Ronin Network announced it had been hacked and approximately $625 million stolen in total – made up of 173,600 ETH and $25.5 million in USDC.
How it happened
- Ronin Network is a sidechain built to support Sky Mavis’s blockchain game Axie Infinity, secured by a set of validator nodes.
- Attackers found an entry point through a neglected RPC node that had been left with elevated permissions from a previous arrangement.
- Five out of nine validator signatures were required to authorize a transaction – the attacker gained control of Sky Mavis’s four Ronin validators plus a third-party validator run by Axie DAO, giving them the threshold needed.
- The breach wasn’t flagged by internal monitoring – it was only discovered when a user attempted to withdraw 5,000 ETH and couldn’t.
Who did it
The U.S. Treasury Department later attributed the theft to North Korea’s Lazarus Group.
What happened after
Sky Mavis raised $150 million led by Binance to reimburse affected users. The U.S. Treasury sanctioned Lazarus-linked wallet addresses – one of the first sanctions applied directly to a crypto address. Ronin Network expanded its validator set and overhauled key management protocols before relaunching the bridge.
Lesson learned
Validator centralization is a systemic risk. When one entity controls too many signing keys, the “decentralized” in decentralized finance becomes misleading. The six-day detection gap also shows how critical real-time on-chain monitoring is.
Poly Network: ~$611 Million (August 2021)
This one had a twist nobody expected: the hacker gave most of it back.
In August 2021, a hacker attacked Poly Network by exploiting a vulnerability in its system and managed to steal funds worth over $600 million. However, in a strange twist, they didn’t make off with their bounty – the hacker agreed to return most of the money, except for $33 million in USDT which had been frozen by the issuer.
How it happened
- Poly Network is a cross-chain interoperability protocol allowing assets to move between different blockchains.
- The attacker exploited a flaw in how the protocol handled cross-chain contract calls – essentially manipulating the system into believing they had the authority to move funds they didn’t own.
- The exploit required no brute force; it was a logic-level vulnerability in how the bridge verified cross-chain transaction permissions.
- The attacker drained funds across Ethereum, Binance Smart Chain, and Polygon simultaneously.
Who did it
The attacker’s identity, who later referred to themselves as “Mr. White Hat”, was never definitively confirmed. They communicated publicly through on-chain transaction messages embedded in Ethereum transactions, claiming the attack was done “for fun” as a challenge rather than for financial gain.
What happened after
The hacker returned funds incrementally while communicating publicly through on-chain messages. Poly Network offered a $500,000 bounty and a security advisory role as a gesture for exposing the vulnerability. All but $33 million in frozen USDT was recovered, making it crypto’s strangest heist resolution.
Lesson learned
Cross-chain bridges carry disproportionate risk because they aggregate value while managing complex multi-chain logic. A bug at that junction can expose the entire system.
The Poly Network hack also proved that protocol-level vulnerabilities can be catastrophic even without malicious actors – a single well-intentioned researcher with the same knowledge could have done the same.
Coincheck: ~$534 Million (January 2018)
Coincheck is the cautionary tale of what happens when you store hundreds of millions of dollars in a hot wallet with no multisig protection.
In January 2018, hackers stole cryptocurrency then worth around $530 million from Tokyo-based exchange Coincheck. The target was the exchange’s NEM (XEM) tokens, which were being kept in a “hot” wallet – meaning the funds were connected to the internet and effectively online rather than stored offline in cold storage.
How it happened
- Coincheck was holding a massive concentration of NEM tokens in a single hot wallet, all connected to the internet.
- The wallet had no multi-signature protection – a single set of credentials was sufficient to authorize withdrawals.
- Attackers exploited this single point of failure to drain the entire balance in one transaction.
- There was no additional layer of approval, time-delay controls, or withdrawal limits that might have limited the damage.
Who did it
The attackers were never publicly identified. Japanese authorities investigated the breach, but no formal attribution was made, although speculations are around Russian groups.
What happened after
NEM developers flagged the stolen coins across exchanges, making them effectively untradeable. Japanese regulators issued business improvement orders to Coincheck. Monex Group acquired the exchange and used company capital to partially repay affected clients. Coincheck eventually relaunched under Monex with significantly tightened security controls.
Lesson learned
Custodial concentration is a ticking clock. Keeping a large volume of a single token in a single internet-connected wallet, without multi-sig, is not an oversight – it’s a liability. The Coincheck hack became the benchmark for why regulated exchanges must use cold storage for the bulk of their holdings.
Also read: Crypto Whales Explained: How to Detect Wallet Accumulation Early
Mt. Gox: ~$470 Million (2011-2014)
No list of biggest crypto hacks is complete without Mt. Gox – the exchange that once processed 80% of all Bitcoin transactions globally and then collapsed spectacularly, taking nearly $500 million with it.
In 2011, hackers initially made off with 25,000 Bitcoins. Then in 2014, Mt. Gox experienced another attack which resulted in the loss of nearly 650,000 of its customers’ Bitcoins and about 100,000 of its own. This amounted to approximately 7% of all Bitcoins in circulation at the time, valued at around $473 million.
How it happened
- The Mt. Gox hack was a slow hemorrhage spanning years.
- Attackers repeatedly exploited poor private key management and weak internal controls that gave them persistent, undetected access.
- A vulnerability known as transaction malleability allowed attackers to manipulate transaction IDs, tricking Mt. Gox’s system into believing withdrawals had failed and reissuing them – effectively draining funds through repeated double-withdrawals.
- By the time management understood the full scale of what was happening, the damage was irreversible.
Who did it
Based on investigations and US Department of Justice indictments (as of 2023), the primary perpetrators behind the theft are Russian nationals Alexey Bilyuchenko and Aleksandr Verner.
What happened after
Mt. Gox filed for bankruptcy in February 2014, leaving several customers locked out of their funds. Legal proceedings stretched nearly a decade. In 2024, creditors finally began receiving Bitcoin repayments through a court-supervised rehabilitation process – distributed in BTC, worth far more than the original 2014 dollar value.
Lesson learned
The oldest lesson in crypto security: control of private keys equals control of funds. Mt. Gox is why the phrase “not your keys, not your coins” exists. Centralized exchanges are counterparty risks – and those risks compound when internal security hygiene is poor.
How Biggest Crypto Hacks Happen
Looking across these five events, a few attack vectors appear repeatedly:
- Social engineering and phishing: Manipulating employees into approving malicious transactions or surrendering credentials.
- Supply chain attacks: Targeting third-party software or infrastructure that the exchange or protocol depends on (Bybit is the clearest example).
- Private key theft: Compromising the keys that authorize transactions, either by brute force, phishing, or insider access.
- Smart contract exploits: Finding and weaponizing logic errors in code that governs how funds are managed.
- Bridge vulnerabilities: Exploiting the architectural complexity of cross-chain systems where multiple codebases interact.
- Hot wallet exposure: Storing large amounts of assets in internet-connected wallets with minimal security controls.
The common thread: in almost every major crypto attack, the weakest link was either a human decision or a third-party dependency – not the blockchain itself.
How to Protect Your Crypto Assets From Hacks
You can’t prevent exchange-level hacks on your own. But you can dramatically reduce your personal exposure:
- Use cold storage for long-term holdings: Hardware wallets like Ledger or Trezor keep your private keys offline and away from attackers.
- Never leave large balances on exchanges: Exchanges are custodians, not vaults. Treat them like a checking account, not a savings account.
- Enable all available authentication layers: Use authenticator apps rather than SMS for 2FA, since SIM-swapping attacks are common.
- Verify every transaction you sign: Before approving any wallet interaction, check the contract address, the destination, and the permissions being granted.
- Use hardware wallets for transaction signing: Even if your computer is compromised, a hardware wallet requires physical confirmation of any transaction.
- Diversify your holdings across wallets: Don’t put everything in one place – not on a single exchange, and not in a single wallet.
- Stay alert to phishing attempts: Most hacks start with an email, a fake website, or a manipulated interface. Double-check URLs and never click unsolicited links.
- Monitor your wallet activity: Set up alerts for any unauthorized transaction attempts using on-chain monitoring services.
The Future of Crypto Security
The Bybit heist proved something uncomfortable: the industry’s security infrastructure has not kept pace with the value it’s protecting. As billions more flow into crypto, attackers – including nation-state actors – are dedicating greater resources to finding and exploiting vulnerabilities.
Several trends are shaping what security might look like going forward:
- AI-powered threat detection: Real-time anomaly detection tools are improving rapidly, flagging suspicious transaction patterns before they escalate.
- Zero-knowledge proofs: ZK cryptography allows verification of transactions without exposing sensitive data, reducing attack surfaces in complex protocols.
- Regulatory frameworks: Post-Bybit, regulators in the U.S., Singapore, and the EU began accelerating discussions on mandatory security standards for exchanges.
- Decentralized key management: Multi-party computation (MPC) distributes key authority across multiple parties, so no single compromised machine can authorize a full withdrawal.
- Bug bounty programs at scale: Protocols are increasingly offering significant rewards to white-hat hackers who discover vulnerabilities before bad actors do.
The future of crypto security will likely be built on layered defenses, better human training, and a cultural shift toward treating security as a first-class product feature rather than an afterthought.
The Bottomline
The five biggest crypto hacks in history – Bybit, Ronin Network, Poly Network, Coincheck, and Mt. Gox – have collectively cost the industry billions of dollars and millions of users their savings. Each cryptocurrency heist tells its own story, but the underlying message is consistent: scale brings scrutiny, and scrutiny reveals weakness.
What’s changed is the sophistication of the attacks. We’ve moved from poorly secured hot wallets to nation-state supply chain operations that can fool even multi-signature systems. That escalation demands a matching response from exchanges, protocols, and individual users alike.
I’d say that the biggest protection you have isn’t a piece of software – it’s understanding how these attacks work. Because once you know what attackers are looking for, you stop being the easiest target in the room.
For more info on crypto and all things Web3, visit Blockverse.
Frequently Asked Questions (FAQs)
The Bybit heist in February 2025 is the largest crypto hack ever recorded, with approximately $1.5 billion in Ethereum stolen by North Korea’s Lazarus Group using a sophisticated supply chain attack.
The Poly Network hacker returned most of the $611 million stolen, claiming it was done as a challenge. They communicated publicly and ultimately accepted a security advisory role, making it crypto’s strangest “heist.”
Recovery is rare but possible. Exchanges can freeze funds, blockchain analytics can trace movement, and law enforcement can act – but the decentralized, irreversible nature of blockchain transactions makes full recovery difficult in most cases.
Lazarus Group is a North Korean state-sponsored hacking unit linked to multiple major crypto heists, including Bybit and Ronin. Proceeds reportedly fund North Korea’s ballistic missile and nuclear weapons programs.
Use a hardware cold wallet for significant holdings, never store large amounts on exchanges long-term, enable authenticator-based 2FA, verify every transaction before signing, and stay vigilant against phishing attempts and fake websites.
