The Biggest Crypto Hacks of All Time, Ranked

By the Guardian team Updated November 2026 6 min read

Quick answer. The biggest crypto hack of all time is the October 29, 2026 theft from Binance, recorded at $6.36 billion in DefiLlama's data. LuBian ($3.5 billion, 2020) and Bybit ($1.4 billion, 2025) follow.

Watch: The Biggest Crypto Hacks of All Time, Ranked 1:36

Video transcript

The biggest crypto hack of all time happened in 2026. Most of the money in the top 20 left through keys and people, not code.

Number one is the October 29 theft from Binance, recorded at 6.36 billion dollars. The FBI and TRM Labs attribute it to North Korea's TraderTraitor.

LuBian, a mining pool, follows at 3.5 billion from 2020, then Bybit at 1.4 billion in 2025. Ronin Bridge and Poly Network complete the top five.

Thirteen of the top 20 carry DefiLlama labels for keys, people or infrastructure. That is 85 percent of the list's losses.

Ten are centralized exchanges. Six are bridge hacks. Seven carry code labels, though two of those began offchain.

TRM Labs says five of these hacks account for 9.1 billion dollars of the 12.8 billion it attributes to North Korea.

Lists disagree on pricing. LuBian's stolen bitcoin was worth 3.5 billion when taken, and about 14.5 billion when Arkham reported it in 2025.

Guardian covers both sides. An OpSec audit maps every path to your funds. An infrastructure pentest attacks your cloud and pipelines. Managed Security reviews every multisig transaction before signing.

Read the full ranking of all 20, or talk to Guardian at guardian.security to keep your protocol off this list.

Five of the 20 biggest crypto hacks of all time happened in 2026, including the largest.

We rank them by the amounts in DefiLlama's public hacks dataset, read on November 5, 2026. Where the FBI, a victim or an analytics firm gives another figure, we name it separately.

For yearly totals, see our crypto hack statistics.

The Top 20, Ranked

Together these 20 incidents account for $17.71 billion, 64% of all losses in DefiLlama's dataset.

#	Incident	Date	Loss	DefiLlama label
1	Binance	Oct 29, 2026	$6.36B	Key leaked via infrastructure
2	LuBian (mining pool)	Dec 28, 2020	$3.5B	Weak key generation
3	Bybit	Feb 21, 2025	$1.4B	Signer phishing
4	Ronin Bridge	Mar 23, 2022	$624M	Validator key compromised
5	Poly Network	Aug 10, 2021	$611M	Improper access control
6	Binance Bridge	Oct 6, 2022	$570M	Proof verifier bug
7	Coincheck	Jan 26, 2018	$534M	Hot wallet key compromised
8	Mt. Gox	Feb 7, 2014	$470M	Private key compromised
9	FTX	Nov 12, 2022	$450M	Phishing
10	Bitget	Sep 24, 2026	$387M	Hot wallet key compromised
11	Wormhole Portal	Feb 2, 2022	$326M	Signature verification flaw
12	Liquid Network	Sep 6, 2026	$320M	Unbacked cross-chain mint
13	DMM Bitcoin	May 31, 2024	$305M	Phishing
14	Drift	Apr 1, 2026	$295M	Proxy upgrade hijack
15	Kelp DAO	Apr 18, 2026	$293M	Cross-chain message spoofing
16	PlayDapp	Feb 9, 2024	$290M	Hot wallet key compromised
17	KuCoin	Sep 29, 2020	$281M	Hot wallet key compromised
18	Gate	Apr 21, 2018	$235M	Private key compromised
19	WazirX	Jul 18, 2024	$234.9M	Signer phishing
20	Cetus	May 22, 2025	$223M	Arithmetic error

Labels are DefiLlama's classifications, not the victims' findings. Binance alone is 36% of the list.

The Top 10, One Line Each

Dates are DefiLlama's. Vectors and attribution come from the victim, law enforcement or the analysts who traced the funds.

1. Binance, October 29, 2026. Binance says attackers reached a wallet signing service from compromised engineers' computers. The FBI and TRM Labs attribute it to North Korea's TraderTraitor.

TRM sizes it at about $6.36 billion, Binance at about $6.34 billion and the FBI at "more than $6 billion." See our Binance hack explainer.

2. LuBian, December 28, 2020. Arkham Intelligence first reported the 127,426 BTC theft in August 2025. It suspects weak key generation and names no attacker.

3. Bybit, February 21, 2025. Safe says a breached developer machine led to a disguised transaction, and Bybit's forensic firms found malicious JavaScript on Safe{Wallet}'s web app.

The FBI blamed North Korea's TraderTraitor for about $1.5 billion. See our Bybit hack explainer.

4. Ronin Bridge, March 23, 2022. Five of nine validator keys were taken; Ronin blamed social engineering. The US Treasury added the attacker's address to its Lazarus Group sanctions entry, per Elliptic.

5. Poly Network, August 10, 2021. A crafted cross-chain call needed "no private key compromise," rekt.news found. The unidentified attacker returned nearly all funds, CNBC reported.

6. Binance Bridge, October 6, 2022. Forged proofs minted 2 million BNB, and about $127 million left before BNB Chain halted, rekt.news found. Rekt names no attacker.

7. Coincheck, January 26, 2018. About 523 million NEM coins left an internet-connected hot wallet, CNBC reported. It identified no attacker.

8. Mt. Gox, February 7, 2014. In 2023, US prosecutors charged two Russians, alleging they reached a Mt. Gox wallet server in 2011 and took about 647,000 bitcoin, CyberScoop reported.

9. FTX, November 12, 2022. In 2024, US prosecutors charged three people over a SIM swap of an FTX employee's phone account, CNBC reported. Elliptic traced the funds through swaps, bridges and mixers.

10. Bitget, September 24, 2026. Bitget says a zero-day in a third-party security product let the attacker forge withdrawals. It names no attacker; TRM counts it as North Korean but has not definitively attributed it.

Patterns in the Top 20

Exchanges and keys

Ten of the 20 are centralized exchanges, worth $10.66 billion, or 60% of the list.

Thirteen carry DefiLlama labels for keys, people or infrastructure rather than code. They total $15.07 billion, 85% of the list.

Every exchange loss here from before 2021 carries a key compromise label: Mt. Gox, Coincheck, Gate and KuCoin.

Bridges

Six are flagged as bridge hacks: Ronin, Poly Network, Binance Bridge, Wormhole Portal, Liquid Network and Kelp DAO. Together they total $2.74 billion.

At Wormhole Portal, a signature verification bypass let the attacker mint wrapped ETH on Solana. Wormhole restored the backing in less than 24 hours, rekt.news reported.

Code bugs

Seven carry code labels, worth $2.64 billion. Cetus, an arithmetic error on Sui, is the only accounting bug in the top 20.

Two of the seven began offchain. DefiLlama's own descriptions say Drift's Security Council members were tricked into pre-signing transactions, and Kelp DAO's attackers compromised LayerZero RPC nodes.

Our onchain vs offchain report files incidents like these by root cause.

2026 and North Korea

Five of the 20 happened in 2026: Binance, Bitget, Liquid Network, Drift and Kelp DAO. They total $7.66 billion, 43% of the list.

TRM Labs says Binance, Bybit, Ronin, Bitget and DMM Bitcoin account for $9.1 billion of the $12.8 billion it attributes to North Korea.

How We Ranked

Data: DefiLlama's hacks API, read November 5, 2026. It held 1,339 entries, the latest dated November 5.
Ranking: by DefiLlama's recorded amount. 57 entries have no amount and cannot rank.
Nominal dollars: amounts as DefiLlama records them, with no inflation adjustment or repricing.
Scope: losses at exchanges, protocols, chains and wallet products, not thefts from individual users.
Early years are thin: one to six entries a year from 2011 to 2016.
Recoveries are not netted: amounts are gross, before funds returned, frozen or reimbursed.
One source per figure: the table is DefiLlama only. FBI, TRM and victim figures appear in the text, by name.

DefiLlama's returnedFunds field is filled for only three of the top 20, and is empty for Poly Network, whose attacker returned nearly everything. So we do not subtract it.

Why trackers publish different totals is its own question: see why crypto hack reports disagree.

How Guardian Helps

Most of the money in this list left through keys, signers and infrastructure, not contract code.

Guardian's audits and pentests cover both sides. An OpSec audit maps every path to your funds, including what a signer actually sees before approving.

An infrastructure pentest attacks your cloud accounts, pipelines and vendor consoles "the way an intruder escalates toward something that signs."

After launch, Managed Security keeps that threat model current, and its security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

What is the biggest crypto hack of all time?

The October 29, 2026 theft from Binance: $6.36 billion in DefiLlama's data. TRM Labs calls it the largest hack in history; Binance estimates about $6.34 billion.

What is the largest DeFi hack ever?

Ronin Bridge, in March 2022: $624 million in DefiLlama's data, the largest at a target it classes as a DeFi protocol. Poly Network ($611 million, 2021) is next.

Who is behind the biggest crypto hacks?

North Korea, for several. The FBI named its TraderTraitor unit for Binance and Bybit, and the US Treasury tied the Ronin attacker's address to Lazarus Group. The sources we read name no attacker for LuBian.

Why do lists of the biggest crypto hacks disagree?

They use different sources and price losses at different times. LuBian's 127,426 BTC were worth $3.5 billion when taken in 2020 and about $14.5 billion when Arkham reported the theft in 2025.

Sources

Keep your protocol off this list

Guardian tests the keys, signers, cloud accounts and contracts behind your funds, the paths that produced most of these losses.

Talk to Guardian Explore audits and pentests