- Binance breach involving estimated $6.3B in assets could become the largest cryptocurrency theft on record
- Bybit, Poly Network, Ronin Network and Coincheck among platforms previously targeted in major attacks
- Hackers have exploited weaknesses in digital wallets, transaction approval systems and blockchain networks
A cyberattack on Binance, the world's largest cryptocurrency exchange, on Thursday has drawn fresh attention to cryptocurrency theft, with blockchain intelligence firm TRM Labs estimating that about $6.36 billion was transferred out of its wallets across 10 blockchains.
Most transfers took place within about 20 minutes. TRM Labs attributed the operation, with high confidence, to TraderTraitor, a North Korean hacking group.
Binance said its preliminary investigation pointed to a potentially compromised laptop belonging to a DevOps engineer. In a statement on Friday, it estimated the impact at around $6.3 billion and said about $3 billion in affected assets had been frozen.
The exchange said user funds were safe, pledged to cover losses through its Secure Asset Fund for Users and company funds, and reported no evidence that wallet private keys had been leaked. The investigation remains ongoing.
The incident ranks among the largest reported cryptocurrency thefts. Here are some of the biggest cases, based on the estimated value of assets at the time.
Bybit, Feb. 2025 – $1.5 billion
Dubai-based cryptocurrency exchange Bybit suffered one of the largest digital asset thefts on Feb. 21, 2025, when hackers stole approximately $1.5 billion in cryptocurrency from an Ethereum cold wallet.
The attackers compromised the transaction approval process, tricking authorized signers into approving a malicious transaction.
The US Federal Bureau of Investigation (FBI) attributed the attack to North Korea, identifying the operation as part of a hacking campaign known as TraderTraitor.
The FBI said the attackers rapidly converted some of the stolen assets into bitcoin and other cryptocurrencies, distributing them across thousands of addresses on multiple blockchains.
Ronin Network, March 2022 – $620 million
The Ronin Network, a blockchain platform associated with the online game Axie Infinity, lost cryptocurrency worth almost $620 million after attackers compromised its transaction-validation system.
Hackers gained control of private keys belonging to validators, enabling them to approve unauthorized withdrawals.
The US Treasury Department attributed the March 2022 attack to Lazarus Group, a North Korean state-sponsored hacking organization.
The department said the group had stolen almost $620 million from the blockchain project.
Poly Network, Aug. 2021 – $611 million
A hacker exploited a vulnerability in Poly Network, a decentralized finance platform that enables transfers between different blockchains, stealing digital assets worth more than $610 million.
The platform said the attacker began returning the assets within days of the incident.
By Aug. 23, almost all the funds had been returned, apart from some stablecoins frozen by their issuer, media reported.
The hacker claimed the attack was intended to expose a security weakness in the platform. Poly Network offered a $500,000 reward for information about the vulnerability and the return of the funds.
BNB Chain, Oct. 2022 – $586 million
An attacker exploited a vulnerability in the BSC Token Hub, a cross-chain bridge connecting two BNB blockchain networks, and withdrew around 2 million BNB tokens worth approximately $586 million.
BNB Chain said the attacker had exploited a flaw in the verification of cross-chain messages.
The network coordinated with validators to suspend operations and limit the movement of the affected assets.
Coinbase's threat intelligence team later published a technical analysis explaining how the attacker forged security proofs to exploit the bridge.
The initial amount involved did not translate into an equivalent financial loss, as much of the cryptocurrency remained on the network or was frozen.
Coincheck, Jan. 2018 – $530 million
Japanese cryptocurrency exchange Coincheck suffered a major attack in January 2018, when hackers stole approximately 526.3 million NEM tokens from an internet-connected wallet.
The stolen assets were valued at around $530 million at the time, according to media reports.
The incident prompted Japan's Financial Services Agency to order improvements to Coincheck's operations and examine security arrangements at other cryptocurrency exchanges.
Coincheck later said it had compensated affected customers for the stolen funds, according to company filings.
Mt. Gox, 2011–2014 – $480 million
Tokyo-based bitcoin exchange Mt. Gox collapsed in 2014 after disclosing that hundreds of thousands of bitcoins had gone missing through thefts spanning several years.
The missing cryptocurrency was valued at close to $500 million at the time, according to reports.
Mt. Gox, which once handled a large share of global bitcoin trading, filed for bankruptcy in 2014, leaving thousands of customers unable to access their funds.
Wormhole, Feb. 2022 – $325 million
Wormhole, a platform connecting different blockchain networks, was exploited in February 2022, resulting in the theft of approximately $320 million in cryptocurrency.
Hackers exploited a vulnerability in the platform's verification process to create tokens without providing the required backing.
Media reported that Jump Crypto, whose parent company had acquired Wormhole's developer, replaced the stolen funds.
Liquid Network, Sept. 2026 – $319 million
Attackers drained about $319 million in bitcoin from Liquid Network, a Bitcoin sidechain operated by Blockstream, on Sept. 6, 2026.
TRM Labs said the attackers exploited a software vulnerability to create unbacked synthetic bitcoin tokens and exchange them for real bitcoin.
About 85% of the funds, worth roughly $272 million, were later returned after Blockstream patched the vulnerability. Around $47 million remained with the attackers, according to the firm.
