Crypto Hacks Tracker: Every Major Theft And Whether Customers Got Paid Back

The Biggest Crypto Hacks

Amounts are the US dollar value at the time of the theft, as reported by the victim, law enforcement or blockchain investigators. When sources disagree, we use the figure the victim confirmed and note the range.

Did Customers Get Their Money Back?

For every hack of a centralized exchange or wallet app of $5 million or more, plus the 60 largest incidents of any kind, we checked what happened to the people whose money was there:

• Yes: customers were made whole, either by the company covering the loss or through recovered funds.
• Partial: customers got some money back, often years later or in a different form, like company tokens or bankruptcy payouts.
• No: customers absorbed the loss.
• Pending: the company has pledged to cover losses or the case is still open.
• Not applicable: the funds belonged to a protocol or company treasury rather than customer accounts.

The pattern is clear. Large exchanges with large cash reserves usually cover customer losses, and they often say so within days. Smaller exchanges are more likely to freeze withdrawals, pay back partially or shut down. Mt. Gox customers waited about a decade for partial repayment, and FTX customers were repaid through bankruptcy rather than by the exchange itself.

A promise to cover losses is not the same as a payout. We mark a hack "yes" only once repayment has been confirmed by the company or by reporting, and we keep pledges marked "pending" until then.

How Crypto Gets Stolen

Stolen keys and front-end attacks account for most of the dollars lost, while bugs in smart contracts cause the most incidents. Here are the causes in plain English, from the most dollars lost to the least:

• Stolen keys. Attackers get hold of the private keys or signing systems that control a hot wallet. This is the largest cause by dollars and includes the Coincheck theft in January 2018 and the Ronin Network theft in March 2022.
• Front-end and infrastructure attacks. Attackers break into a company's servers, internal systems or website instead of its smart contracts. Sometimes a website or domain is hijacked, so users approve transactions that send their own funds to the attacker. This is the second-largest cause by dollars because DefiLlama files Binance's $6.36 billion theft in October 2026 here. Without that one theft, it would be one of the smaller causes.
• Social engineering. Attackers trick employees or wallet signers into approving a transaction or handing over access. DefiLlama files the Bybit theft in February 2025 here, after signers approved a transaction that gave the attackers control of the wallet. We use the FBI's figure of $1.5 billion, as the table does, while the cause chart uses DefiLlama's $1.4 billion.
• Bugs in smart contracts. Code that holds money does something its authors didn't intend. Attackers find the flaw and drain it, sometimes in minutes.
• Access control failures. Someone gains admin powers they should not have, often through a compromised employee account or a badly configured contract.
• Bridge exploits. Attackers fool the systems that move tokens between blockchains into releasing or creating tokens that were never deposited.
• Price manipulation. An attacker briefly distorts the price feed an app relies on, then borrows or withdraws more than they should.

Rug pulls and governance attacks make up the rest.

What This Means For Your Money

Most people will never be the direct target of a multimillion-dollar hack. But the money you keep on an exchange or in a crypto app sits in pools that attackers do target. A few habits lower your risk:

1. Keep only what you trade on an exchange. Long-term holdings are safer in a wallet you control. Our ranking of the best crypto wallets covers hardware and software options, and not your keys, not your coins explains the tradeoff.
2. Favor exchanges that publish proof of reserves and have covered past losses. Our exchange ratings weigh each one's security record.
3. Use a hardware wallet or a multisig wallet for larger amounts, so one stolen key can't empty the account.
4. Check the website before you approve anything. Bookmark the apps you use instead of clicking links, and revoke old token approvals you no longer need.
5. Assume no insurance. Crypto held on an exchange is not FDIC insured, and exchange "insurance funds" are company promises, not guarantees.

If Your Exchange Gets Hacked

• Don't send more funds to the platform, and don't trust "recovery" offers that ask for payment or your seed phrase.
• Save screenshots of your balances and transaction history.
• Watch the exchange's official status page and verified social accounts for repayment plans.
• If withdrawals stay frozen, file a complaint with regulators and report theft to the FBI's IC3.
• Keep records for taxes. Losses from theft may be treated differently from investment losses, so talk to a tax professional.

How We Track Hacks

Our collector pulls the full incident list from DefiLlama's public hacks database every day, so new incidents appear within about 24 hours of being reported. Incident data comes from DefiLlama.

On top of that, Cult of Money researches the customer outcome for the largest incidents and every exchange or wallet hack of $5 million or more. Those outcomes come from the victim's own statements, law enforcement releases and reputable reporting, and they're linked in each row. When an exchange covers losses from its own funds, we record that separately from money actually recovered from the attacker.

We update a hack's status when repayment is confirmed. If you see an error, contact us.

FAQ

What Is The Biggest Crypto Hack Ever?

The largest crypto hack on record is Binance's $6.36 billion theft on Oct. 29, 2026. It's followed by LuBian ($3.5 billion in 2020) and Bybit ($1.5 billion in 2025). The table above is sorted by dollar amount at the time of the theft, so the order can differ from rankings that use today's prices.

Who Is Behind Most Large Crypto Hacks?

US law enforcement has attributed several of the largest thefts, including Bybit and Ronin, to North Korean groups. Many smaller incidents remain unattributed. We list attribution only when a law enforcement agency, the victim or a named investigator has made it, and we name the source.

Do Exchanges Reimburse Customers After A Hack?

Often, but not always. In our tracking, 37 of 58 major exchange hacks ended with customers made whole, while the rest ended in partial repayment, losses or are still pending. Larger exchanges are more likely to cover losses quickly.

Is My Crypto Insured On An Exchange?

Generally no. FDIC insurance covers bank deposits, not crypto, and SIPC covers securities at brokerages, not crypto held on an exchange. Some exchanges hold private insurance or reserve funds, but coverage is limited and not guaranteed.

Are DeFi Apps Safer Than Exchanges?

Not necessarily. DeFi apps avoid the risk of one company holding your keys, but they add the risk of smart contract bugs, and losses there are rarely reimbursed. The safest approach for most people is a mix: a reputable exchange for buying and a wallet you control for holding.