Updated October 30, 2026. The Binance investigation is ongoing; its loss estimates, attribution and recovery figures remain subject to revision.
The biggest crypto hacks are remembered for the money stolen. But what happens afterwards matters just as much: were users reimbursed, did investigators recover the assets, or were customers left waiting for years?
The latest Binance incident has pushed that question back into focus. Binance estimates an impact of around $6.3 billion, while blockchain intelligence firm Elliptic puts the theft at approximately $6.43 billion. If those estimates hold, it would exceed the previous record set by Bybit in 2025.
Below are seven of crypto’s largest and most consequential security incidents, explained in plain English.
How to read the figures: These are approximate historical valuations, not today’s value of the tokens. The selection is not a definitive ranking of the seven largest net losses. Some figures describe stolen assets, others an initial shortfall or an exploit’s gross size. A frozen token is not automatically money returned to its owner.
1. Binance, October 2026: approximately $6.3–$6.4 billion
What happened: Binance reported a major security incident following unauthorized withdrawals on October 29. Its preliminary investigation points to a compromised DevOps engineer’s laptop, which may have given an attacker access to a service container and the ability to submit withdrawal transactions.
In everyday terms, the suspected route was through systems that could authorize transfers. Binance says it has found no evidence of a wallet private-key leak. A final technical explanation is still pending.
What was done: Binance suspended deposits and withdrawals, worked with law enforcement and industry partners, and said it would cover the losses using its SAFU emergency fund and company money. It also promised an updated proof-of-reserves report after remediation.
Binance reported about $3 billion frozen on-chain. Elliptic separately verified approximately $2.84 billion frozen in its October 30, 08:00 UTC update. These are different reports, not amounts to add together.
Where things stand: Elliptic attributes the attack to North Korea-linked actors. That is the firm’s assessment; the investigation remains open. Binance’s commitment to cover losses should not yet be described as completed reimbursement, and frozen assets should not be counted as already returned.
Sources: Binance’s initial update, Elliptic’s investigation and Reuters reporting.
2. Bybit, February 2025: approximately $1.5 billion
What happened: On February 21, 2025, attackers manipulated a transfer involving Bybit’s Ethereum cold wallet. Investigators identified malicious code affecting the Safe wallet interface used in the signing process.
A cold wallet normally keeps signing keys away from routine online exposure. But that protection can still fail if people approve a malicious transaction through a compromised interface. The FBI attributed the theft to North Korea’s TraderTraitor actors.
What was done: Bybit obtained liquidity through loans, deposits and over-the-counter purchases. It said an updated reserves examination confirmed that the gap in customer asset backing had been closed within 72 hours. The exchange also launched a bounty initiative to help trace and recover stolen funds.
The outcome: Bybit restored the backing of customer assets, according to its report. That was different from recovering the entire stolen haul: replacing missing ETH with other funding does not mean the attacker returned it.
Sources: FBI attribution, Bybit incident timeline and Bybit reserves update.
3. Ronin Bridge, March 2022: roughly $620 million
What happened: The bridge used by the Axie Infinity ecosystem lost 173,600 ETH and 25.5 million USDC. Attackers obtained enough validator approvals to make unauthorized withdrawals appear legitimate.
A bridge holds assets on one blockchain while representing them on another. Ronin’s security depended on multiple validators approving transfers, but the attacker compromised five of the nine keys needed under the system then in place.
What was done: The bridge was paused and later reopened on June 28, 2022, after audits. Sky Mavis refilled the backing for user balances. The redesigned bridge added withdrawal limits and a circuit breaker intended to interrupt suspicious large withdrawals.
The outcome: Ronin said users had been made whole. However, 56,000 ETH associated with the Axie DAO treasury was treated separately and remained undercollateralized at reopening. Chainalysis later announced that more than $30 million linked to the theft had been seized with industry and law-enforcement assistance.
Sources: UN investigation report, Ronin’s reopening and reimbursement update and Chainalysis on the seizure.
4. Poly Network, August 2021: approximately $610 million
What happened: On August 10, 2021, an attacker exploited Poly Network’s cross-chain contract system and moved hundreds of millions of dollars in tokens.
The failure was in the software used to control cross-chain assets. It did not mean the underlying Ethereum, BNB Chain or Polygon networks had all been broken.
What was done: Poly Network publicly contacted the attacker, coordinated with security teams and token issuers, and worked through a staged return of the assets. Tether froze approximately $33.4 million in USDT.
The outcome: This became an unusual case in which the attacker returned the assets. Poly Network subsequently announced completion of the recovery process, including the previously frozen USDT.
The team called the attacker “Mr. White Hat,” but that description should not obscure what users experienced: assets were removed without authorization and access depended on a lengthy recovery effort.
Sources: Chainalysis’s investigation and Poly Network’s account of the restoration.
5. BNB Chain Token Hub, October 2022: roughly $570 million in BNB affected
What happened: An attacker exploited the BSC Token Hub bridge and obtained 2 million BNB, worth roughly $570 million at the time.
BNB Chain said the attacker forged a proof accepted by the bridge. Put simply, the system accepted a false claim that a transfer was valid and released extra BNB.
What was done: Validators coordinated a temporary pause of BNB Smart Chain. Emergency remediation contained much of the affected value on the network, and the chain subsequently resumed.
The outcome: The gross exploit figure was far larger than the amount moved to other chains. Initial estimates put the assets taken off BSC at around $100–$110 million. The approximately $570 million headline therefore should not be presented as the final amount successfully carried away.
This was a bridge incident in the BNB Chain ecosystem, separate from the Binance exchange breach in October 2026.
Sources: BNB Chain’s official incident update and the project’s initial statement on containment.
6. Coincheck, January 2018: approximately $530 million in NEM
What happened: Japanese exchange Coincheck lost hundreds of millions of NEM tokens from a hot wallet. A hot wallet is connected to online systems so that an exchange can process transfers conveniently.
The incident exposed how much damage can follow when a large pool of customer assets is reachable through a compromised custody setup.
What was done: Coincheck compensated affected customers in Japanese yen. Japan’s financial regulator investigated and required improvements, and Monex acquired the exchange in April 2018.
Coincheck’s later filings describe heightened security measures and stronger governance following the acquisition.
The outcome: Customers received compensation, but that did not mean the stolen NEM had all been recovered. The yen-based calculation also became the subject of lawsuits, illustrating why the currency, valuation date and terms of reimbursement matter.
Sources: 2018 regulatory presentation and Coincheck’s annual filing.
7. Mt. Gox, disclosed in 2014: an initial shortfall of about $450 million
What happened: Mt. Gox collapsed in 2014 after reporting approximately 850,000 BTC missing. Around 200,000 BTC was subsequently located in an old wallet, so the initial missing balance should not be confused with a final theft total.
The case involved theft over an extended period rather than one cleanly defined transaction. US prosecutors later alleged that defendants and co-conspirators caused the theft of approximately 647,000 BTC between 2011 and 2014. Those are allegations, not convictions established by that announcement.
What was done: The exchange entered court proceedings, and the remaining assets became part of a rehabilitation process for creditors. Repayments in Bitcoin and Bitcoin Cash began in 2024.
Where things stand: An October 16, 2026 trustee notice extended the deadline for specified repayments to October 31, 2027. It said the relevant repayments were largely complete for eligible creditors whose procedures and processing had gone smoothly, while others remained unpaid.
Mt. Gox shows how a security failure can leave customers dealing with its consequences more than a decade later.
Sources: Contemporary academic account, US Justice Department charges, trustee archive and October 2026 repayment notice.
What these crypto hacks teach us about recovery
The responses fall into several different categories:
- Assets returned: The attacker sends the stolen tokens back, as happened in the Poly Network case.
- Assets frozen or seized: Tokens are blocked from moving or brought under legal control. Returning them can require additional procedures.
- Customers reimbursed: A company uses other money to replace losses, as distinct from recovering the original assets.
- Claims handled through court: Customers become creditors and may wait years for distributions, as Mt. Gox demonstrates.
The same distinction applies to the latest Binance incident. A promise to cover losses, a reported freeze and a completed return of funds are three separate milestones.
These cases also show why “crypto was hacked” is often too vague. The weak point may be an employee device, a transaction-signing interface, custody infrastructure or a bridge contract. Understanding which layer failed is essential to judging whether the response addresses the cause.
