Crypto Hacks Database: Every Major Exploit Since 2025

Video transcript

Most stolen crypto did not leave through a smart contract bug. It left through keys, signers and infrastructure.

Guardian counts 41 crypto hacks of 10 million dollars or more from January 2025 to November 10, 2026. Together they are worth 10.58 billion dollars. Binance and Bybit are the largest.

Stolen keys, signers, hot wallets and cloud access took three quarters of the value. Frontend and supply chain attacks took another 15 percent. Contract and protocol bugs were just 7 percent.

Offchain attacks took 91 percent of the value, across 29 of the 41 incidents. Take out Binance, and the offchain share is still 78 percent.

The ten largest incidents total 9.62 billion dollars. Exchanges dominate, with Binance, Bybit and Bitget hit through signing systems or wallet infrastructure. Bugs in node or contract code hit Liquid Network, Cetus and Balancer. COLDCARD wallets lost funds to weak seeds.

If you are hit, work in order. Contain the damage, then ask exchanges and issuers for freezes. Open a channel to the attacker, and finally publish a post-mortem.

Guardian's OpSec audit reviews the keys, signing procedures and access that protect your funds. Managed Security monitors contracts on every block, and watches domains, DNS and cloud. When something fires, a Guardian engineer responds.

Read the full database to search every incident and download the CSV. Or talk to Guardian at guardian.security.

This is a list of crypto hacks you can search, filter and download.

It covers every hack, exploit or theft of $10 million or more since January 1, 2025. It also keeps smaller incidents that Guardian has explained.

We built it from the sources ourselves: the victim's own statement first, then reputable reporting and named research. Every row names whose loss figure it shows.

For analysis, read our crypto hack statistics, the biggest hacks of 2026 and onchain vs offchain losses. This page is the full list.

How to Use the Database

1. Search for a project, chain or technique, such as Solana or oracle.
2. Filter by year, by category, or to $10M+ or explainer rows.
3. Sort newest first, or by the largest loss.
4. Download the CSV, with recoveries, attribution and every source link.

Each column means one thing:

• Date: the UTC day the exploit began, where a source gives the time.
• Loss: the value at the time of theft, before any recovery. The line below names whose figure it is.
• Range: two credible figures that differ by more than 10%, with both sources named.
• Category and technique: our category, and one line on how the attack worked.
• Source: the first sources we read. The CSV lists all of them.

The five categories

• Onchain: a bug in contract, protocol, bridge or node code.
• Offchain, keys: stolen keys, signers, hot wallets, cloud access, insiders and staff devices.
• Offchain, frontend: websites, DNS, packages, extensions and tampered hardware.
• Economic: price, oracle or governance manipulation.
• Other: the cause is unknown or fits none of these.

We file by root cause where the victim or its investigators state it, and by mechanism where they do not.

So Kelp DAO is offchain: its attacker poisoned the RPC nodes its verifier read from. Drift is offchain too, because its signers pre-signed the takeover.

What the Data Shows

These totals cover the incidents of $10 million or more in Guardian's dataset.

• $2.29 billion across 18 incidents in 2025. Bybit is 61% of it.
• $8.28 billion across 23 incidents in 2026 so far. Binance is 77%.
• $1.94 billion is 2026 without Binance.
• 91% of the value came from the ten largest incidents.
• $32 million is the median incident of $10 million or more.

Offchain takes the money

Offchain attacks took 91% of the value, across 29 of the 41 incidents. Without Binance, the offchain share is still 78%.

Contract and protocol bugs were 9 incidents and 7% of the value. Liquid Network, Cetus and Balancer were the largest.

Centralized exchanges were hit hardest. Binance, Bybit and Bitget alone lost more than $8 billion between them.

How it compares

TRM Labs put 2026 hacking at $8.7 billion year to date on October 30, the highest on record. Our 2026 incidents of $10 million or more come to $8.28 billion.

Chainalysis counts over $3.4 billion stolen from January to early December 2025. Our 2025 total is $2.29 billion.

The gap is the long tail: smaller hacks, and thefts from individuals, which this list leaves out. Our guide to why crypto hack reports disagree covers the rest.

The Ten Largest Incidents

The ten largest since January 2025 total $9.62 billion.

• Exchanges: Binance, Bybit and Bitget, all through signing systems or wallet infrastructure.
• Code: Liquid Network, Cetus and Balancer, each a bug in node or contract code.
• Wallets: COLDCARD's weak seeds, with tampered Ledger devices in 12th place.

All figures are values at the time of theft, before freezes, returns or cover. Each incident's row in the full list names whose figure it is.

Some money comes back. Binance says about $2.85 billion of its loss was frozen or intercepted.

At Tectonic, Cronos rolled its chain back and reversed about $111.2 million. Our report on stolen crypto recovery rates covers the rest.

What to Do If You Are Hit

Speed decides what can still be frozen. Work through these in order.

1. Contain. Pause contracts, revoke keys and pull a compromised front end. Our incident response plan sets the roles.
2. Ask for freezes. Send exchanges and issuers the addresses, hashes, amounts and a UTC timeline. See how to request an exchange freeze.
3. Open a channel. An onchain message can offer the attacker a bounty for returning the rest. Read how to negotiate with a hacker first.
4. Publish a post-mortem. Timeline, root cause, funds lost and recovered, and fixes. Use our post-mortem template.

Most of the money on this list left through keys, signers and infrastructure. Guardian's OpSec audit reviews the keys, signing procedures, access permissions and team processes that protect your funds.

Guardian's Managed Security monitors contracts on every block for privileged calls, upgrades, multisig transactions and large fund movements.

Offchain, it watches domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds.

To follow incidents as they break, see how to track crypto hacks in real time.

The Full List

50 incidents from January 1, 2025 to November 10, 2026, newest first.

Get every row as a CSV file. It adds every chain, recoveries, attribution and all sources.

Explainers for Earlier Incidents

Guardian has also explained these incidents from before 2025.

• October 2024: Radiant Capital. Malware swapped transactions developers signed.
• Jul 18, 2024: WazirX. Multisig signers approved a different transaction than shown.
• Dec 31, 2023: Orbit Bridge. Ethereum vault drained; cause unconfirmed.
• December 2023: Ledger Connect Kit. Phished npm account shipped a wallet drainer.
• Sep 23, 2023: Mixin Network. Cloud provider database breached.
• 2023: Tornado Cash governance. Metamorphic contract took over governance.
• December 2022: 3Commas. Leaked exchange API keys used to trade.
• Sep 20, 2022: Wintermute. Hot wallet key likely broken via Profanity.
• Aug 9, 2022: Curve. DNS hijack sent users to a clone.
• June 2022: Harmony Horizon bridge. Two compromised keys were enough to sign.
• March 2022: Ronin bridge. Five of nine validator keys used.
• January 2022: Crypto.com. Withdrawals passed without 2FA.
• Dec 2, 2021: BadgerDAO. Injected script requested malicious approvals.
• June 2020: Ledger customer data. API key exposed an e-commerce database.
• August 2016: Bitfinex. Attacker inside the network moved 119,754 BTC.

These smaller incidents since 2024 sit outside the table. Most are supply chain attacks.

• Mar 31, 2026: axios npm compromise
• Sep 8, 2025: chalk and debug npm compromise
• August 2025: GreedyBear fake wallet extensions
• Apr 21, 2025: xrpl.js backdoor
• March 2025: tj-actions/changed-files compromise
• Dec 3, 2024: @solana/web3.js backdoor
• December 2024: Cyberhaven extension attack
• Oct 30, 2024: Lottie Player attack
• June 2024: Kraken deposit bug

For the all-time ranking, see the biggest crypto hacks of all time.

Methodology

Scope

• Included: hacks, exploits and thefts at protocols, exchanges, bridges, chains, wallets and firms.
• Threshold: a reported loss of $10 million or more, from January 1, 2025.
• Smaller rows: only incidents Guardian has written an explainer on.
• Left out: thefts from private individuals, rug pulls, frauds, trading losses and data breaches with no theft figure.
• Paper losses: left out where a project's own tokens were returned or mostly never sold.

We also leave out incidents we could not confirm in a source we trust.

Sources

Every field comes from a source we read. The victim's post-mortem or statement comes first.

Next come outlets such as The Block, CoinDesk, Cointelegraph and Decrypt. Then named research from firms such as TRM Labs, Chainalysis, Elliptic, CertiK and Halborn.

We do not copy rows, figures or labels from other hacks databases. Categories and technique lines are our own.

Disagreements

Where two credible figures differ by more than 10%, the row shows the range and names both sources.

Otherwise it shows one figure, the victim's where there is one. Dates are UTC where a source gives the time; otherwise they are the date the source reports.

Updates and revisions

We update the database monthly. This version runs to November 10, 2026.

Figures are as reported, and they are often revised as investigations finish. A row can change between versions.

The CSV is free under the CC BY 4.0 license. Credit the Guardian Crypto Hacks Database.

Frequently Asked Questions

What is the biggest crypto hack ever?

Binance, on October 29, 2026. Binance puts the assets taken at about $6.34 billion, and TRM Labs counts about $6.36 billion, calling it the largest hack in history. The FBI has linked it to North Korea's TraderTraitor group.

Who is behind most of the money stolen?

North Korea, by the main research firms' counts. TRM Labs says North Korea is responsible for 85% of the value hacked in 2026, as of October. Chainalysis says North Korean hackers stole at least $2.02 billion in 2025.

Does the list include individuals whose wallets were drained?

No. It covers organizations and products. Chainalysis counted $713 million stolen from individual victims in 2025, so its totals run higher. If your own wallet was drained, start with our first-hour guide.

Can I reuse this data?

Yes. The CSV is licensed CC BY 4.0. You may copy, adapt and republish it, including commercially, if you credit the Guardian Crypto Hacks Database and link to this page. Each row's sources keep their own rights.

Sources

Every row's sources are linked in the table and listed in full in the CSV. The page text draws on these:

• TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• Chainalysis: North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion (December 18, 2025)
• Binance: 29 October 2026 Binance Security Incident: Initial Findings and Response Update (November 3, 2026)
• BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
• The Block: Crypto exchange Bybit confirms hack as over $1.4 billion worth of ETH leaves wallets (February 21, 2025)
• Bitget: Bitget Hack Explained: Timeline, Impact and Security Response (September 27, 2026)
• CNBC: Crypto platform Bitget suspects North Korea is responsible for $352 million hack (September 25, 2026)
• Blockstream: Liquid Network Security Incident Assessment (September 23, 2026)
• The Block: Liquid Network attacker returns 3,400 BTC after bug fix, retains nearly 600 BTC (September 7, 2026)
• Drift: Incident Recovery Update - April 16, 2026 (April 16, 2026)
• Drift: Drift Recovery Update - June 3, 2026 (June 4, 2026)
• CoinDesk: 2026's biggest crypto exploit: $292 million gets drained from Kelp DAO with wrapped ether stranded across 20 chains (April 18, 2026)
• LayerZero: KelpDAO Incident Statement (April 19, 2026)
• The Block: Sui DEX Cetus says overlooked flaw in open-source library used by smart contract led to $223 million exploit (May 27, 2025)
• The Block: Sui-based token prices plunge amid $223 million Cetus Protocol exploit (May 22, 2025)
• The Block: Balancer identifies rounding error as root cause of multi-chain DeFi exploit (November 6, 2025)
• Balancer forum: [BIP-892] Distribution of Rescued Funds from Balancer v2 November 3rd 2025 Attacks (November 27, 2025)
• Cointelegraph: Cronos confirms $9.2M slipped away before Tectonic exploit rollback (September 8, 2026)
• CoinDesk: Cronos executes controversial blockchain rollback to recover crypto worth $111 million (September 8, 2026)
• Cointelegraph: Coldcard strengthens seed generation with firmware update (August 21, 2026)
• Coinkite (COLDCARD): Current COLDCARD Security Status (October 1, 2026)
• Creative Commons: Attribution 4.0 International (CC BY 4.0)
• Guardian: OpSec Audit
• Guardian: Managed Security