The scale of crypto theft has escalated dramatically, with the largest single heist now measured in the billions, not millions. What is striking is that most of these losses did not come from breaking cryptography itself; they came from failures in the human, operational, and code layers built around it—compromised credentials, supply-chain attacks, flawed smart contracts, and weak key management.
Below is a list of the ten most costly crypto hacks on record, ranked by the reported dollar value at the time of the incident, along with the critical failure that made each one possible.
1. Binance — $6.3 Billion (October 2026)
What went wrong: Attackers drained hot wallets across ten blockchains after compromising a DevOps engineer’s laptop. This foothold allowed them to access an internal service container and submit unauthorized withdrawal transactions. Preliminary analyses also pointed to the abuse of EIP-7702 delegations to amplify the drain. The breach was attributed to North Korea’s TraderTraitor group.
2. Bybit — $1.5 Billion (February 2025)
What went wrong: This was not a failure inside Bybit itself but a supply-chain attack on Safe{Wallet}, the multisig front-end used by the exchange. Attackers compromised a Safe developer’s workstation via a malicious npm package, injected code into the official Safe front-end, and waited for Bybit’s signers to initiate a routine cold-wallet operation. The malicious payload swapped the transaction logic, allowing the attackers to drain the cold wallet once the required signatures were collected. The Lazarus Group was blamed.
3. Ronin Network — ~$620 Million (March 2022)
What went wrong: Ronin’s bridge relied on a set of nine validator nodes; five approvals were needed for a withdrawal. Attackers managed to compromise five of those nine private keys (four controlled by Sky Mavis and one by Axie DAO). With the threshold met, they forged fake withdrawals and drained 173,600 ETH and 25.5 million USDC.
4. Poly Network — $610 Million (August 2021)
What went wrong: Vulnerabilities in Poly Network’s cross-chain smart contracts exposed weaknesses in access control and signature verification. The attacker exploited these flaws to create and release funds across multiple chains. In a rare twist, the attacker later returned almost all of the stolen assets.
5. Coincheck — $530 Million (January 2018)
What went wrong: The Tokyo exchange kept customer NEM coins in an internet-connected hot wallet with insufficient protections. The breach was traced to a malware infection via an email to an employee’s PC, which allowed attackers to transfer the funds. Coincheck lacked multi-signature security and had been warned by regulators about system flaws before the theft.
6. Mt. Gox — ~$470 Million at the time (2011–2014)
What went wrong: Once handling 80% of global Bitcoin trading, Mt. Gox suffered repeated breaches over several years due to a combination of a transaction-malleability bug, weak internal controls, and alleged mismanagement. By the time it collapsed, roughly 850,000 BTC were missing, though about 200,000 were later recovered. The exact split between external hacking and internal loss remains contested.
7. Wormhole — $320 Million (February 2022)
What went wrong: A signature-verification bug in the Wormhole bridge allowed an attacker to pass a fake “sysvar” account to the bridge program. Because the code failed to properly validate that account, the attacker could mint 120,000 wrapped ETH (wETH) on Solana without locking any collateral on the source chain.
8. DMM Bitcoin — $305 Million (May 2024)
What went wrong: The Japanese exchange lost 4,502.9 BTC after a private-key compromise that reportedly involved social engineering of a multi-signature signer. The attacker gained control of a key and used it to authorize the transfer. The incident was attributed to the Lazarus Group.
9. KelpDAO — $292 Million (April 2026)
What went wrong: The attacker exploited a mechanism that allowed uncollateralized tokens to be used to borrow real assets on Aave. This created over $2 billion in bad debt within minutes and extracted $292 million in value from the protocol.
10. WazirX — $235 Million (July 2024)
What went wrong: WazirX’s multi-signature wallet, operated through a third-party custody provider (Liminal), was manipulated. Attackers obtained the required signatures but substituted the transaction payload so that the signed transaction actually granted them control of the wallet, draining nearly half of the exchange’s reserves.
The Common Thread
Across these ten cases, the failures cluster into a few recurring patterns:
Key and credential compromise (Ronin, DMM, Binance) — private keys or employee credentials were stolen or socially engineered.
Supply-chain and front-end attacks (Bybit) — even cold wallets can be drained if the interface used to sign transactions is maliciously altered.
Smart-contract and bridge flaws (Poly, Wormhole, KelpDAO) — code that fails to validate inputs or enforce collateral rules invites exploits.
Operational negligence (Coincheck, Mt. Gox) — hot-wallet exposure, missing multi-sig, and weak internal controls.
Third-party custody risk (WazirX) — outsourcing key management does not automatically eliminate signing-process vulnerabilities.
The dollar figures are staggering, but the underlying lesson is consistent: in crypto, security is only as strong as the weakest link in the people, processes, and code that surround the private keys.
Natalie Pierce tracks the parts of crypto that move fast and rarely wait for everyone to catch up. From South Africa, she covers DeFi, AI crypto, hacks, airdrops, sentiment and emerging narratives, especially when user behavior and protocol risk start to overlap.
Her reporting is built for messy sectors. Natalie looks at incentives, reactions, security concerns, social momentum and early signs of traction without pretending every new trend is already proven. Her voice is clear and accessible, but careful enough for areas where excitement can outrun the facts very quickly.