The Biggest Crypto Hacks of 2026 So Far, Ranked
Quick answer. The biggest crypto hack of 2026 is Binance: about $6.36 billion stolen on October 29. Bitget ($387 million), Liquid Network ($320 million), Drift ($295 million) and Kelp DAO ($293 million) follow, in DefiLlama's data read November 6, 2026.
Video transcript
2026 is already the worst year for crypto hacks in DefiLlama's data, by value and by count.
DefiLlama lists 8.78 billion dollars stolen across 332 incidents, from January 1 to November 5. Binance alone is 72 percent of it.
Binance tops the list with about 6.36 billion dollars on October 29. Bitget, Liquid Network, Drift and Kelp DAO follow.
In our reading, 11 of the 15 largest came through keys, signers, infrastructure or wallet devices, not smart contract bugs.
Nine trace to compromised keys and signers, worth 7.5 billion dollars. Wallet devices were hit twice. Only four were onchain flaws.
North Korea is blamed, formally or provisionally, for the largest losses. TRM Labs attributes 7.4 billion dollars of this year's hack value to North Korea.
Recovery ranges from most of the money to none, from about 2.85 billion dollars frozen at Binance to nothing at AFX Bridge. Covered is not recovered. When an operator pays, the loss moves from users to the operator.
An OpSec audit maps every path to your funds. Managed Security then monitors your contracts on every block, watches DNS and cloud offchain, and a Guardian engineer responds when something fires.
Read the full ranking for all 15 hacks, their causes and recoveries. Or talk to Guardian at guardian.security.
2026 is already the worst year for crypto hacks in DefiLlama's data, by value and by number of incidents.
It lists $8.78 billion stolen across 332 incidents from January 1 to November 5. Binance alone is 72% of it.
Below are the 15 largest, with what caused each one, who is blamed and what came back.
For the full history, see the biggest crypto hacks of all time. For yearly totals, see our crypto hack statistics.
The 15 Largest Hacks of 2026
Together these 15 total $8.23 billion, 94% of all 2026 losses in DefiLlama's dataset.
| # | Incident | Date | Loss | Cause |
|---|---|---|---|---|
| 1 | Binance | Oct 29 | $6.36B | Signing service reached from compromised devices |
| 2 | Bitget | Sep 24 | $387M | Zero-day in a third-party security product |
| 3 | Liquid Network | Sep 6 | $320M | Software bug minted unbacked L-BTC |
| 4 | Drift | Apr 1 | $295M | Council signers pre-signed an admin handover |
| 5 | Kelp DAO | Apr 18 | $293M | Poisoned RPC nodes fooled a lone verifier |
| 6 | Tectonic | Aug 30 | $124.5M | Inflated collateral on a thin market |
| 7 | COLDCARD | Jul 31 | $116M | Firmware bug weakened seed generation |
| 8 | Ledger devices (supply chain) | Oct 9 | $93M | Implants fitted to resold devices |
| 9 | Nesa | Aug 24 | $50M | Cosmos EVM balance accounting flaw |
| 10 | Step Finance | Jan 31 | $40M | Executive devices compromised |
| 11 | Mercado Bitcoin | Nov 2 | $40M | A company system compromised |
| 12 | Humanity | Jun 8 | $32M | Foundation member's key compromised |
| 13 | Truebit | Jan 8 | $26.4M | Unchecked overflow in old Solidity |
| 14 | Resolv | Mar 22 | $24.5M | Cloud-held minting key compromised |
| 15 | AFX Bridge | Jul 22 | $24.15M | Five validator keys compromised |
- Losses are DefiLlama's recorded amounts, before any freezes, returns or cover.
- Dates are DefiLlama's, in UTC, except Resolv: DefiLlama says March 21, Rekt March 22.
- Step Finance and Mercado Bitcoin tie at $40 million. We list the earlier first.
- Causes for Nesa, Step Finance, Mercado Bitcoin and Humanity come only from DefiLlama's descriptions. The rest come from the victims, Rekt or analytics firms.
What the list shows
- One incident sets the year. Without Binance, 2026 stands at $2.42 billion.
- Three of the 15 are exchanges, worth $6.79 billion, 83% of the list.
- The second half was heavier: nine of the 15 came from July on.
- Hardware wallet users were hit twice, at COLDCARD and through tampered Ledger devices.
The Top Five in Brief
Where the victim or an analytics firm gives a different figure from DefiLlama, we name both.
1. Binance, October 29
TRM Labs counts about $6.36 billion taken across ten blockchains. Binance's November 3 report estimates about $6.34 billion.
Binance says the attacker used access to an internal signing service to start transactions outside the normal withdrawal process. Our Binance hack explainer covers how.
2. Bitget, September 24
Bitget says attackers used a zero-day in a third-party security product to reach its wallet backend and inject forged withdrawal commands.
It says private keys were not compromised. Its final figure is about $388 million; DefiLlama records $387 million.
3. Liquid Network, September 6
A bug in Elements, the software behind Liquid, created about 4,000 L-BTC with no bitcoin behind it, The Block reported.
SideSwap's peg-out service burned them, and the Liquid Federation paid out 3,996 BTC. SideSwap says its key was not compromised.
4. Drift, April 1
Attackers got Security Council members to pre-sign Solana durable nonce transactions that handed over admin control, Chainalysis reports.
Chainalysis puts the loss at $285 million. Drift's own table of withdrawn assets totals $295.7 million, and DefiLlama records $295 million. See our Drift exploit breakdown.
5. Kelp DAO, April 18
A forged LayerZero message released 116,500 rsETH, about $292 million per LayerZero's May 18 report. DefiLlama records $293 million.
The route trusted a single verifier, and the attacker had poisoned the RPC nodes it read from. Our Kelp DAO write-up has the full timeline.
Root Causes: Keys Over Code
Most of the money left through keys, signers and infrastructure, not contract code.
| Cause | Incidents | Losses | Largest |
|---|---|---|---|
| Keys, signers and infrastructure | 9 | $7.50B | Binance, Bitget, Drift |
| Wallet devices | 2 | $209M | COLDCARD, Ledger devices |
| Onchain flaws | 4 | $521M | Liquid Network, Tectonic |
Without Binance, keys, signers and infrastructure still account for $1.14 billion across eight incidents.
These groups are our reading of each cause. DefiLlama's labels file Drift, Kelp DAO and Mercado Bitcoin under code classes, though its descriptions point to signers, RPC nodes and a compromised system.
Keys and signers
- Resolv: a GitHub credential linked to a contractor's account led to the minting key, per Rekt.
- AFX Bridge: five validator keys held 71% of voting power, past a two-thirds threshold, per Rekt.
- Step Finance: executive devices compromised, exposing treasury signing keys, per DefiLlama.
- Humanity: a foundation member's private key compromised, per DefiLlama.
Hardware wallets
Coinkite says a COLDCARD firmware bug weakened seed generation. Updating firmware does not repair a seed made before the fix.
Ledger says criminals fitted hidden components to genuine devices to capture recovery phrases, then resold them through resellers in Southeast Asia.
It says there was no flaw in its chip, operating system or servers.
Onchain flaws
- Liquid Network: a bug in Elements, its node software.
- Tectonic: the attacker pushed up the price of TONIC, which carried a 20% collateral factor on about $1.34 million of liquidity, per Rekt.
- Truebit: an unchecked overflow let the attacker mint TRU for almost nothing, per Rekt.
- Nesa: a Cosmos EVM balance accounting flaw, per DefiLlama.
Who Was Behind Them
North Korea is blamed, formally or provisionally, for the largest losses of the year.
TRM Labs attributes $7.4 billion of 2026's $8.7 billion in hack value to North Korea, in an October 30 report.
| Incident | Attributed to | By whom |
|---|---|---|
| Binance | TraderTraitor, North Korea | The FBI and TRM Labs |
| Kelp DAO | North Korea; TraderTraitor (UNC4899) | Mandiant and CrowdStrike, per LayerZero |
| Drift | UNC6862, North Korea | Mandiant, per Drift |
| Bitget | Counted as North Korean | TRM Labs, not definitive |
| AFX Bridge | UNC4899, "highly likely" | zeroShadow and SEAL, preliminary, per Rekt |
For Kelp DAO, LayerZero's report says Mandiant and CrowdStrike hold the North Korea attribution with high confidence, and the TraderTraitor link with medium confidence.
For Drift, its June 3 recovery update says Mandiant "conclusively attributed" the attack to UNC6862. In April, Chainalysis had called it likely linked, pending formal attribution.
Bitget names no attacker. The Block calls Liquid Network's attacker a purported white hat. The sources we read name no attacker for the rest of the list.
What Came Back
Recovery ranges from most of the money to none of it.
Covered is not recovered. When an operator pays, the loss moves from users to the operator.
| Incident | Status | Source |
|---|---|---|
| Binance | About $2.85B frozen or intercepted; Binance absorbs the loss | Binance, Nov 3 |
| Bitget | Protection Fund covers the impact; some assets frozen | Bitget |
| Liquid Network | 3,400 BTC returned, about 85% | The Block |
| Drift | Recovery pool proposed, up to $127.5M from Tether | Drift, Apr 16 |
| Kelp DAO | 106,993 rsETH recovered through liquidations by May 9 | Aave governance forum |
| Tectonic | Cronos rollback reversed $111.2M of $120.4M borrowed | Rekt |
| Mercado Bitcoin | Tether froze over $4.5M; customers not to bear losses | DefiLlama |
| Resolv | ETH not returned; 46M of 80M USR removed by Mar 26 | Rekt |
| AFX Bridge | Not recovered; bounty offer unanswered | Rekt |
TRM's Binance snapshot was about $2.7 billion frozen by 00:30 UTC on October 30.
DefiLlama's returnedFunds field is empty for all 15, so the ranking uses gross amounts.
How Guardian Helps
Eleven of the 15 came through keys, signers, infrastructure or devices, not contract code.
An OpSec audit maps every path to your funds and reviews how your team holds, approves and changes them.
Managed Security starts with a threat model of every path to your funds. Guardian then monitors your contracts on every block, including multisig transactions and large fund movements.
Offchain, it watches your domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds.
Frequently Asked Questions
What is the biggest crypto hack of 2026?
Binance, on October 29, 2026: about $6.36 billion, per TRM Labs and DefiLlama. Binance estimates about $6.34 billion. TRM calls it the largest hack in history.
How much crypto has been stolen in hacks in 2026?
$8.78 billion across 332 incidents from January 1 to November 5, in Guardian's count of DefiLlama data. TRM Labs put it at $8.7 billion on October 30. Binance is 72% of the total.
Who is behind the biggest crypto hacks of 2026?
North Korea, for several. The FBI named its TraderTraitor unit for Binance. Per LayerZero, Mandiant and CrowdStrike attribute Kelp DAO to North Korea. Drift says Mandiant attributed its hack to UNC6862, a North Korean group.
Were 2026's biggest hacks smart contract bugs?
Mostly not. In our reading, 11 of the 15 largest came through keys, signers, infrastructure or wallet devices: $7.70 billion, 94% of the list. Four were onchain flaws, led by Liquid Network.
Sources
- DefiLlama: Hacks dataset API (read November 6, 2026)
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
- TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
- Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
- Bitget: Bitget Hack Update, Timeline, Impact and Response (September 27, 2026, updated October 20, 2026)
- The Block: Liquid Network attacker returns 3,400 BTC after bug fix, retains nearly 600 BTC (September 7, 2026)
- Chainalysis: The Drift Protocol Hack, How Privileged Access Led to a $285 Million Loss (April 9, 2026)
- Drift: Incident Recovery Update (April 16, 2026)
- Drift: Drift Recovery Update, June 3, 2026 (posted June 4, 2026)
- LayerZero: LayerZero Labs KelpDAO Incident Report (May 18, 2026)
- Aave governance forum: WETH Unfreeze and LTV Restoration, LlamaRisk (May 9, 2026)
- Rekt: Tectonic, Rekt (read November 6, 2026)
- Coinkite: COLDCARD security status (verified October 1, 2026)
- Ledger: Response to the hardware implant attack (October 15, 2026)
- Rekt: Truebit, Rekt (read November 6, 2026)
- Rekt: Resolv Labs, Rekt (read November 6, 2026)
- Rekt: AFX Trade, Rekt (read November 6, 2026)
- Guardian: The Biggest Crypto Hacks of All Time, Ranked (November 2026)
- Guardian: Crypto Hack Statistics 2026 (November 2026)
Close the paths behind this year's biggest hacks
Guardian maps the keys, signers and infrastructure that can move your funds, then watches them around the clock.