The Ugly Morning Announcement
When Billions Disappear Before Breakfast
Manuscript Date: 1 September 2026
Published: 25 September 2026
Updated: 25 September 2026
Greetings, beautiful people. 😊☕
The Largest Cryptocurrency Exchange Thefts and Hacks in History
Editorial Note — Research Scope and Cutoff Date: This article presents a research-based overview of significant cryptocurrency exchange thefts and security incidents. Information and sources were reviewed through 16 October 2026. Later developments are included where relevant and supported by reliable, publicly available sources. Unverified information is excluded or clearly identified as unconfirmed. Reported losses are approximate and may change as investigations progress. Events or findings published after the stated cutoff date may not be reflected here.
#H2> ☕ Introduction — Imagine Waking Up and …
Your Crypto Has Gone for a Walk
Imagine waking up one morning, making your coffee, and opening your cryptocurrency exchange account to check your balance.
Everything looks normal. Your coins are still listed. Your balance is sitting there, looking perfectly respectable.
Then you try to withdraw your funds.
Nothing.
You refresh the page. Still nothing. You check the exchange’s announcements and find a message about a security incident.
Suddenly, your coffee doesn’t taste quite as good.
Of course, not every withdrawal delay means something terrible has happened. Exchanges may suspend withdrawals for maintenance, technical problems or other legitimate reasons. But throughout cryptocurrency’s history, some interruptions have been caused by something far more serious: attackers stealing digital assets from exchange systems.
And we’re not talking about someone sneaking into the office and walking away with a computer under their arm.
Cryptocurrency theft can involve compromised private keys, manipulated transactions, stolen employee credentials or weaknesses in the systems responsible for approving transfers.
In February 2025, approximately US$1.5 billion in cryptocurrency was stolen from Bybit. The FBI attributed the theft to North Korean cyber actors. It was an extraordinary incident—not least because the attack manipulated a legitimate transaction process rather than simply breaking through an obvious digital front door.
Source: FBI — North Korea Responsible for $1.5 Billion Bybit Hack.
So, what can we learn from these incidents? How did the thefts happen? Did customers lose their money? And what do these cases tell us about the risks of leaving cryptocurrency with an exchange?
Let’s explore the history without turning this into a technical examination that requires three cups of coffee and a computer science degree.
#H2> 🧭 First, What Exactly Are We Counting?
Before we start counting billions, let’s clear up one important point.
Not every cryptocurrency theft is an exchange hack.
Some attacks target centralised cryptocurrency exchanges that hold assets on behalf of customers. Others target decentralised finance (DeFi) protocols, cross-chain bridges, blockchain applications or individual wallet owners.
These incidents may all involve stolen cryptocurrency, but they are not the same type of event.
This article focuses primarily on incidents involving cryptocurrency exchanges and exchange-operated custody systems.
It also discusses the collapse of FTX, where cryptocurrency was moved from wallets after the exchange entered bankruptcy proceedings. That case is included for its relevance to exchange security, although its circumstances differ from a conventional external exchange hack.
The figures in the table are approximate reported values at or around the time of each incident. They are not adjusted for inflation or changes in cryptocurrency prices.
One more thing: the amount stolen is not always the same as the amount customers ultimately lose. An exchange may recover assets, receive support from another company, reimburse customers or absorb the loss itself. Conversely, a theft can contribute to a wider financial crisis that leaves customers facing losses long after the original incident.
#H2> 📊 A Look at Major Cryptocurrency Exchange Thefts and Security Incidents
The following table is a selection of significant cases, arranged chronologically rather than ranked by dollar value. It is not an exhaustive list of every exchange incident in cryptocurrency history.
Year | Exchange or platform | Approximate reported amount | What happened? | Sources |
|---|---|---|---|---|
2011–2014 | Mt. Gox | Hundreds of millions of US dollars over time | Bitcoin disappeared from the exchange over an extended period. Mt. Gox suspended trading and withdrawals before entering bankruptcy proceedings in 2014. The precise history and timing of the losses are complex. | |
2016 | Bitfinex | About US$72 million at the time | Attackers stole approximately 119,754 bitcoin. Bitfinex subsequently socialised the loss among customers through a controversial recovery approach and later redeemed its issued recovery tokens. | |
2018 | Coincheck | About US$530 million | Attackers stole NEM cryptocurrency held in a hot wallet. Coincheck announced reimbursement plans for affected customers. | |
2019 | Binance | About US$40 million | Attackers stole 7,000 bitcoin in a security breach. Binance said its emergency insurance fund would cover the loss. | |
2019 | Upbit | About US$50 million | A large quantity of ether was transferred from an Upbit hot wallet without authorisation. Upbit said it would cover the loss using company assets. | |
2020 | KuCoin | Initially estimated at roughly US$275–285 million | Attackers obtained access to private keys associated with exchange wallets. KuCoin later reported substantial asset recovery and other recovery measures, so the initial theft estimate should not be confused with the final unrecovered loss. | |
2021 | BitMart | About US$150 million initially reported | A security breach affected hot wallets holding assets across multiple blockchains. Initial estimates varied as investigations continued. | |
2022 | Crypto.com | About US$34 million initially reported | Unauthorised withdrawals affected customer accounts. Crypto.com said affected users were reimbursed. The incident demonstrated that account and withdrawal controls matter alongside wallet protection. | |
2022 | FTX | Approximately US$400 million in assets moved during the collapse period, with the circumstances disputed | Cryptocurrency was moved from wallets around the time FTX entered bankruptcy. The incident has often been described as a hack, but the exact circumstances and attribution have been more complicated than a straightforward confirmed external breach. | |
2023 | Poloniex | More than US$100 million in reported losses | A breach affected wallets associated with the exchange. Investigators and blockchain analysts tracked movements of the stolen assets, but tracking does not necessarily mean that the assets were recovered. | |
2024 | DMM Bitcoin | About US$308 million | Attackers stole 4,502.9 bitcoin through an attack involving a compromised employee and wallet-management infrastructure at a service provider. The FBI and Japanese authorities attributed the theft to North Korean cyber actors. DMM Bitcoin later announced plans to cease operations. | |
2024 | WazirX | More than US$230 million initially reported | A major theft affected a multisignature wallet. WazirX published a timeline of the incident and later entered a prolonged process involving restructuring and disputes over customer claims. The theft and its financial consequences should be considered separately. | |
2024 | BingX | More than US$40 million initially estimated | Unauthorised transfers affected hot wallets. BingX said it would cover affected losses, while the reported amount varied as the incident was assessed. | |
2025 | Bybit | Approximately US$1.4–1.5 billion | Attackers manipulated a transaction approval process connected to an Ethereum cold wallet. The FBI attributed the theft to North Korean cyber actors. Bybit said it would cover customer liabilities and worked to restore its wallet operations. | |
2026 | Bitget | Approximately US$388 million reported after initial estimates | Bitget reported unauthorised transfers from part of its hot- and warm-wallet infrastructure. Its initial estimate was about US$351.6 million, later revised by reporting to approximately US$387.5–388 million. The incident and the exchange’s response remain subject to continuing developments. |
A note about the numbers: These amounts are not perfectly comparable. Some are initial estimates; others are based on the value of assets at the time of theft. Investigators may revise estimates as more wallets are identified, and recovered funds can change the final financial impact. The table is intended as a historical overview, not a definitive ranking or audited loss ledger.
#H2> 🔍 What Do These Incidents Have in Common?
Looking at the table, you might be tempted to conclude that cryptocurrency exchanges simply cannot be trusted.
That would be too broad a conclusion. Exchanges differ in their security practices, governance, financial position and response to incidents. A security breach at one platform does not automatically tell us everything about another.
However, the history does reveal several recurring weaknesses.
#H3> 🔑 1. Private Keys Are Powerful Things
A cryptocurrency private key is what allows someone to authorise transactions from a wallet. If an attacker obtains sufficient control over the keys—or over the system that uses them—the attacker may be able to transfer assets without needing the account holder’s permission.
Think of a private key as a very special key to a vault. It does not matter how impressive the vault door looks if the wrong person obtains the key.
Of course, cryptocurrency security is more complicated than a physical vault. Exchanges can use multisignature arrangements, hardware security modules, approval workflows and other controls. These measures can reduce risk, but they must be implemented and operated correctly.
#H3> 🖥️ 2. The Weak Point May Be the Computer System, Not the Wallet Itself
Many people imagine a hacker attacking a wallet by guessing a password. Real incidents can be much more complicated.
An attacker might compromise an employee’s computer, steal an administrator’s credentials, exploit a software vulnerability or manipulate the interface used to approve a transaction.
The Bybit incident in 2025 is a useful example. The FBI attributed the theft to North Korean cyber actors, and reporting described a sophisticated manipulation of the transaction approval process. The lesson is important: even a carefully designed custody arrangement can be undermined if the system displaying or authorising a transaction is compromised.
The wallet may be doing exactly what it was instructed to do. The problem is that the instruction was not what the human operator thought they were approving.
That’s a rather expensive difference between “Looks good to me” and “Wait a minute—where is that money going?”
#H3> 🧑💻 3. People and Suppliers Are Part of the Security Picture
Security is not only about software. People, contractors, suppliers and service providers may also be part of the chain of trust.
In the DMM Bitcoin case, the FBI described how an attacker posing as a recruiter contacted an employee of a wallet-software company and used a malicious script to compromise the employee. The attacker then used access to the compromised environment to help manipulate a transaction request.
This is a reminder that a company can be affected by a weakness in a supplier or partner—even if the company itself did not directly employ the person who was compromised.
In everyday language, you can lock your front door, but it also matters who has the spare key and whether the person holding it has been tricked.
#H3> 🔥 4. Hot Wallets Need Special Attention
A hot wallet is connected to systems that can interact with the internet. Exchanges use hot wallets because customers need to deposit, trade and withdraw cryptocurrency without waiting for every transaction to be handled manually.
That convenience is useful. It also means hot wallets and the systems controlling them require strong protection.
Cold wallets, by contrast, are designed to keep private keys offline or otherwise separated from everyday online systems.
They can reduce exposure, but “cold” does not mean “impossible to compromise.” The process used to authorise a transaction can still be targeted, as the Bybit incident illustrated.
The practical question is not simply whether an exchange uses cold storage. It is how the entire transaction process is protected—from the moment a withdrawal is requested to the moment it is signed and broadcast.
#H2> 🧾 The Theft Is Only the Beginning of the Story
When cryptocurrency is stolen, the first headline often focuses on the amount. But customers need answers to other questions, too.
Will withdrawals be suspended?
Will the exchange cover the missing assets?
Can the stolen cryptocurrency be traced or frozen?
Will customers be reimbursed?
Could the incident expose deeper financial or management problems?
If the company becomes insolvent, what happens to customer claims?
These questions matter because a security incident does not have one universal outcome.
#H3> 💰 Sometimes the Company Covers the Loss
Some exchanges have announced that they would use company funds or dedicated reserves to cover losses after a breach. Binance, for example, said it would cover the bitcoin stolen in its 2019 incident through its emergency insurance fund. Crypto.com also said it reimbursed affected users following its 2022 incident.
These examples show that customers do not always bear the direct cost of a theft.
But there is an important distinction: a company’s announcement that it will cover a loss is not the same thing as an independent guarantee that every customer will be protected in every future incident. Customers should look for clear evidence of what was reimbursed, which losses were covered and whether the platform’s commitments are subject to conditions.
#H3> 🔎 Sometimes Investigators Recover Assets
Blockchain transactions are often visible on public ledgers. Investigators and blockchain-analysis firms can follow the movement of funds between addresses and sometimes help identify assets that can be frozen or seized.
That does not mean stolen cryptocurrency is automatically recoverable.
Attackers may move funds through many addresses, use services that complicate tracing, exchange one asset for another or attempt to convert cryptocurrency into traditional money. Even when investigators identify the funds, legal authority and cooperation from exchanges or other service providers may be required to freeze or seize them.
In other words, a visible trail is helpful—but it is not a magic “return my money” button.
#H3> ⚖️ Sometimes the Consequences Become Much Larger
A major theft can put pressure on a company’s finances, reputation and ability to operate. But it is important not to confuse a hack with bankruptcy.
A security incident does not automatically mean that an exchange is insolvent. Likewise, an exchange can collapse because of financial mismanagement, misuse of customer assets, liquidity problems or other reasons that are not simply a hack.
FTX illustrates why the distinction matters. Cryptocurrency was moved from wallets around the time the company entered bankruptcy proceedings in 2022, but the circumstances were more complicated than a straightforward, fully explained external attack. Its collapse also involved broader financial and governance failures.
For customers, the key lesson is that security, financial health, governance and custody arrangements are related—but they are not interchangeable.
#H2> 🧠 What Can We Learn From This History?
We cannot eliminate every risk in cryptocurrency. However, we can make better decisions when we understand where the risks come from.
H3> 🏦 1. An Exchange Account Is Not the Same as a Personal Wallet
When you leave cryptocurrency on a centralised exchange, the platform generally controls the private keys for the assets held in its custody. Your account gives you a way to access and transact with your balance under the exchange’s rules and systems.
This arrangement can be convenient. It allows people to trade without managing every technical detail themselves.
However, it also means that access to your assets depends on the exchange’s systems, policies, financial condition and ability to operate.
An account balance on a screen is not, by itself, proof that you personally control the private keys.
That is not a reason to panic every time you open an exchange account. It is a reason to understand the arrangement before deciding how much to leave there.
#H3> 🔐 2. Self-Custody Gives You More Control—and More Responsibility
With self-custody, you control the private keys or recovery material needed to access your cryptocurrency. A hardware wallet is one tool that can help people manage those keys, but the device alone does not remove every risk.
You must still protect your recovery phrase, verify transaction details, obtain software from legitimate sources and guard against scams, theft and accidental loss.
There is no magical button labelled “Make My Crypto Completely Safe.” If there were, we would all be pressing it.
Self-custody changes the risk profile rather than eliminating risk. You reduce your dependence on an exchange’s custody arrangements, but you take on greater personal responsibility for protecting access to your assets.
The right approach depends on your knowledge, needs, transaction habits and ability to manage that responsibility.
#H3> 🛡️ 3. Treat Exchange Security Claims as a Starting Point
An exchange may advertise cold storage, proof of reserves, insurance or a protection fund. These can be useful pieces of information, but they answer different questions.
Cold storage concerns how private keys are stored and separated from online systems.
Proof of reserves may provide evidence about certain assets held at a particular time, depending on the method and scope of the report.
Insurance depends on the actual policy, covered events, exclusions and claims process.
Protection funds depend on the amount available, the terms of coverage and the circumstances in which the fund can be used.
One label does not tell the whole story. For example, a proof-of-reserves report may not establish that a company has no liabilities or that it is financially healthy in every other respect.
Read the details, not just the headline.
#H3> 🔑 4. Protect Your Own Account, Too
Even when an exchange has strong internal controls, your personal account can still be targeted.
Useful precautions include:
Use a unique, strong password that you do not reuse elsewhere.
Enable a strong form of two-factor authentication where available.
Be cautious with emails, direct messages and websites asking you to sign in.
Never share your password, authentication codes or wallet recovery phrase with someone who contacts you unexpectedly.
Check withdrawal addresses and transaction details carefully.
Review account activity and security notifications.
Use withdrawal allowlists and other account controls where appropriate.
Keep your devices and software updated, and avoid installing unknown files or browser extensions.
These measures cannot guarantee safety, but they can reduce the chances of common attacks succeeding.
And please remember: a convincing message is not necessarily a genuine message. Scammers have learned to write very polite emails.
#H2> 📚 A Few Important Questions Before We Finish
#H3> ❓ Does a Cryptocurrency Exchange Hack Mean Bitcoin Was Hacked?
No—not necessarily.
Bitcoin and other blockchain networks have their own protocols and security mechanisms. Many exchange thefts involve the exchange’s computers, private keys, employees, wallet-management systems or transaction approval processes rather than a failure of the underlying blockchain.
It is important to identify what was actually compromised before drawing conclusions about an entire cryptocurrency network.
#H3> ❓ If an Exchange Is Hacked, Will I Automatically Lose My Cryptocurrency?
Not automatically.
The outcome depends on the incident, the exchange’s financial position, its response and any applicable legal or contractual arrangements. Some exchanges have reimbursed affected users; other incidents have involved prolonged disputes, restructuring or uncertainty.
Never assume that reimbursement is guaranteed simply because an exchange has reimbursed customers after a previous incident.
#H3> ❓ Can an Exchange Recover Stolen Cryptocurrency?
Sometimes, but recovery is uncertain.
Investigators may trace funds, law enforcement may seize assets, and other platforms may freeze identified deposits.
Some attackers also return funds, although that is not a dependable recovery strategy.
A transaction visible on a public blockchain is not the same thing as money that can be immediately retrieved.
#H3> ❓ Is Keeping Cryptocurrency in a Cold Wallet Always Safer?
Cold storage can reduce exposure to online attacks, but the complete security process still matters. Private keys can be mishandled, recovery phrases can be stolen, and transaction approval systems can be manipulated.
For individuals, self-custody also introduces the risk of losing access through mistakes or poor backup practices.
The useful question is not “Which option is perfectly safe?” but “Which risks am I taking, and do I understand how to manage them?”
#H2> 🌱 Final Thoughts — Knowledge Is More Useful Than Panic
The history of cryptocurrency exchange thefts is certainly sobering. From the long-running Mt. Gox saga to the enormous Bybit incident in 2025 and the reported Bitget theft in 2026, the industry has repeatedly been reminded that digital assets require careful protection.
But the lesson is not that every exchange is doomed or that every cryptocurrency holder should lose sleep.
The more useful lesson is that convenience, security and control are different things.
An exchange can make buying, selling and transferring cryptocurrency easier. It can also introduce risks associated with its systems, employees, suppliers and financial condition. Self-custody can give you more direct control, but it also requires you to protect your keys and recovery material.
Neither approach is risk-free. What matters is understanding the trade-offs and making decisions deliberately.
So, the next time someone tells you that cryptocurrency security is simply a matter of choosing a good password, you can smile politely and explain that the story is a little more complicated.
Then finish your coffee.
Preferably before it gets cold.
#H2> 📖 Our Editorial Approach
CryptoMatters aims to explain cryptocurrency security and digital-asset risks in clear, accessible language. We distinguish reported estimates from confirmed findings where possible, and we use primary sources, official statements, law-enforcement announcements and reputable reporting to help readers examine the evidence.
The incidents listed here are selected examples, not a complete record of every theft. Loss estimates and investigations may change. Where the circumstances remain disputed or incomplete, readers should consult the linked sources and the latest reliable reporting before drawing firm conclusions.
Our aim is to help readers ask better questions, understand the risks and make more informed decisions.
Research cutoff: 16 October 2026.
