CoinLaw The Crypto Desk Crypto Hacks Tracker

Crypto Hacks Tracker

Every major crypto theft we can verify, and what came back. Losses are recorded from the affected project, its regulator or a court filing, never from an aggregator, and the recovery column states whether the stolen value was actually retrieved rather than whether users were reimbursed.

25 incidents tracked verified through 14 Aug 2026 next review by 13 Sep 2026

Incidents: 25
Disclosed losses · 22 of 25 incidents: $6.1B
Recovered · where stated: $1.5B
Re-verify cycle: 30day

Largest disclosed loss on this page Bybit · $1,500,000,000 (Feb 2025) Largest full recovery Poly Network · $610,000,000 returned

Latest change Bitcoin Depot backfilled from its 6 Apr 8-K: 50.903 BTC (about 3.67 million dollars, the company own recorded fair value) taken from corporate settlement wallets via compromised credentials on 23 Mar. Surfaced while triaging the breach tracker drafts; it was filed there, but no personal data was taken, so it belongs here. (14 Aug 2026) All changes

All records

25 incidents, newest first. Filter or search below.

What is in scope Incidents where the affected project, a regulator, or a court filing disclosed what was taken. The dollar figure is our conversion at the incident date, never a disclosed number.

25 incidents, $6.1B in disclosed losses converted at each incident date from the units the victim itself published. The most common attack route is Key compromise, in 8 of 19 incidents where the disclosure named one. 22 of 25 disclose an amount; the rest publish none, and this table leaves those cells empty rather than estimating them.

What was taken is recorded as the affected project or exchange disclosed it, in the units they stated, and sits in each row’s detail; the dollar column is our own conversion at the incident date, not a disclosed figure, because a token count is fixed while its value moves. Recovery status is as stated by the project or in court filings. A vendor’s estimate never substitutes for a disclosure. Informational only, not investment advice.
Project	Date	Loss (USD, derived)	Vector	Recovery
Coinsbuy CEX	9 Aug 2026	Undisclosed	Unknown	Partial
What was taken Ethereum and TRON hot-wallet assets Amount recovered None stated Recovery timeline Coinsbuy confirmed on 10 August 2026 that unauthorized withdrawals hit several platform wallets the previous day, said all affected client funds were covered from its own reserves, and offered a 100,000 dollar reward. The company neither confirmed nor disputed a total, so the loss stays Undisclosed here. For scale only: the independent investigator SpecterAnalyst tallied about 7.9 million dollars across Ethereum and TRON from three linked addresses, with proceeds moved into Monero via exchanges; ChangeNOW froze a six-figure portion, recorded as partial recovery. Reserve compensation to users is not counted as recovery. The intrusion method has not been described, so the vector stays unknown. Primary source Coinsbuy statement, via Cointelegraph ↗ Last confirmed 14 Aug 2026
Coldcard Wallet	30 Jul 2026	Undisclosed	Key compromise	None disclosed
What was taken Bitcoin held in self-custody wallets whose seeds were generated on affected COLDCARD firmware Amount recovered None stated Recovery timeline Coinkite published its Coldcard Security Advisory on 30 July 2026, updated 1 August. A firmware defect present from version 4.0.1 in March 2021 through 4.1.9 inclusive routed seed generation through a predictable software randomizer rather than the hardware entropy source, leaving Mk2 and Mk3 seeds with roughly 40 bits of effective entropy against the 128 expected, which puts the resulting keys within reach of offline enumeration. Seeds made on Mk4, Mk5 and Q before the fixed releases carry about 72 bits. Fixed firmware 4.2.0 corrects new seed generation but cannot repair a seed already created, so Coinkite told affected holders to migrate funds to a newly generated seed. Seeds built with at least 50 fair, independent, private dice rolls are not considered at risk from this defect alone, and a strong unique BIP-39 passphrase adds an independent barrier, though Coinkite advises passphrase users to migrate as well. TAPSIGNER, OPENDIME and SATSCARD are unaffected. Coinkite states no theft figure and says a formal technical review is still to come, so the loss stays Undisclosed here rather than being implied as zero. For scale only, and expressly not as the recorded figure: Galaxy Research, a third-party chain-analytics firm, estimates 1,596 BTC taken from about 7,300 addresses across three confirmed waves plus 14 smaller incidents, worth more than 100 million dollars, and reports that none of the coins from those three waves have moved. This tracker records the figure the affected vendor states, and a chain-analytics estimate never substitutes for a disclosure. Re-verified 14 Aug 2026: Coinkite has published a technical backgrounder attributing the defect to a random-byte fallback introduced during a library migration, with the formal postmortem still to come, and still states no theft figure, so the loss stays Undisclosed. Third-party tallies keep moving and disagree with each other, TRM Labs counting 1,816 BTC from more than 5,200 addresses across four waves while Galaxy counts 1,596 BTC from about 7,300 addresses, which is exactly why an analytics estimate never substitutes for a disclosure here. Primary source Coinkite, "Coldcard Security Advisory" ↗ Last confirmed 14 Aug 2026
Bitcoin Depot Other	23 Mar 2026	$3,665,000	Key compromise	None disclosed
What was taken 50.903 BTC from company-controlled settlement wallets Amount recovered None stated Recovery timeline Bitcoin Depot, the crypto ATM operator, discovered on 23 March 2026 that an unauthorized actor had obtained control of credentials for its digital asset settlement accounts and transferred approximately 50.903 Bitcoin from company-controlled wallets. The company determined the incident material on 6 April and filed its 8-K, recording a preliminary loss of approximately 3.665 million dollars, the fair value of the Bitcoin at the incident date, which is the figure stored here per the company own filing. The 8-K states the incident was contained to the corporate environment, with no evidence customer personal information was accessed, and no recovery is reported. Read from the filing text directly, 14 Aug 2026. Primary source Bitcoin Depot, Form 8-K (Item 1.05) ↗ Last confirmed 14 Aug 2026
Cetus Protocol DeFi	22 May 2025	$223,000,000	Smart-contract bug	Partial
What was taken Liquidity pool assets on Sui, with USDC bridged out via CCTP Amount recovered $162,000,000 Recovery timeline An arithmetic overflow in the liquidity-pool maths let the attacker drain roughly USD 223 million on 22 May 2025. Cetus paused its contracts and, with the Sui Foundation and validators, froze USD 162 million before it could move. A recovery route with no precedent followed: an onchain community vote, carried by validators representing 90.9 per cent of stake, authorised a protocol upgrade reclaiming the frozen funds from the attacker's accounts WITHOUT their signature, into a 4-of-6 multisig trust held by Cetus, the Sui Foundation and OtterSec. About USD 61 million had already been bridged to Ethereum and is treated as lost. Primary source Sui Foundation, "Response to the Cetus Incident – Onchain Community Vote" ↗ Last confirmed 27 Jul 2026
Bybit CEX	21 Feb 2025	$1,500,000,000	Phishing	Partial
What was taken ETH and staked-ETH derivatives from a cold wallet Amount recovered $43,000,000 Recovery timeline Signers approved a transaction through a manipulated Safe multisig interface, handing control of a cold wallet to the attacker. The FBI attributed the theft to North Korea. mETH Protocol retrieved roughly USD 43 million of cmETH, Tether froze USDT linked to the funds, and a seizure followed in Greece; the LazarusBounty programme continues to pay for traces. Bybit met customer withdrawals from its own reserves and loans, which is not counted as recovery here — the bulk of the stolen value remains with the attacker. Primary source FBI, "North Korea Responsible for $1.5 Billion Bybit Hack" ↗ Last confirmed 27 Jul 2026
WazirX CEX	18 Jul 2024	$230,000,000	Phishing	None disclosed
What was taken ETH and ERC-20 tokens from the exchange Ethereum multisig Amount recovered None stated Recovery timeline WazirX own preliminary report, published the day of the attack, states a loss of funds exceeding USD 230 million from a six-signatory multisig run on Liminal custody infrastructure; the stored figure is that stated floor. Signers approved what the interface showed while the actual payload upgraded the wallet to a malicious contract, the same manipulated-signing class as the Bybit theft. No recovery from the attacker; parent Zettai obtained a Singapore moratorium (HC/OA 861/2024) and restructured user claims under a scheme of arrangement, which redistributes the loss rather than recovering it. Primary source WazirX, "Preliminary Report: Cyber Attack on WazirX Multisig Wallet" ↗ Last confirmed 30 Jul 2026
DMM Bitcoin CEX	31 May 2024	$308,000,000	Key compromise	None disclosed
What was taken 4,502.9 BTC leaked from exchange wallets Amount recovered None stated Recovery timeline DMM Bitcoin disclosed an unauthorised outflow of 4,502.9 BTC on 31 May 2024 and covered customer balances in full with support from DMM group companies — a reimbursement, not a recovery. None of the stolen bitcoin came back: it was mixed through CoinJoin, moved across bridging services and traced onward to the Huione Guarantee marketplace. Japan's Financial Services Agency issued an administrative action in September 2024, and DMM Bitcoin wound down, transferring accounts to SBI VC Trade by March 2025. Primary source 金融庁 (Japan FSA), "株式会社DMM Bitcoinに対する行政処分について" ↗ Last confirmed 27 Jul 2026
Poloniex CEX	10 Nov 2023	$126,000,000	Key compromise	Partial
What was taken Assets across ETH, BTC, TRON and XRP hot wallets Amount recovered None stated Recovery timeline Hot wallets across several chains were drained on 10 November 2023. Poloniex stated it had identified and frozen a portion of the assets held at the attacker's addresses and offered a 5 per cent white-hat bounty for the return of the rest. The frozen portion has not been quantified publicly, so no recovered figure is recorded. Poloniex separately committed to reimbursing affected users from operating revenue, which is not counted as recovery here. Primary source Poloniex, "Announcement on Poloniex Hack Incident" ↗ Last confirmed 27 Jul 2026
Mixin Network Other	23 Sep 2023	$200,000,000	Unknown	None disclosed
What was taken Mainnet assets held by the network Amount recovered None stated Recovery timeline Mixin announcement, read at source: in the early morning of 23 September 2023 Hong Kong time the database of the network cloud service provider was attacked, and after initial verification the funds involved are approximately 200 million US dollars, the figure stored here. Deposits and withdrawals were suspended; Google and SlowMist were brought in. Mixin offered a 20 million dollar bounty for return of the funds. The precise mechanism behind the database compromise and the final recovery position were never published, so vector and recovery stay unrecorded. Primary source Mixin Kernel announcement, 25 September 2023 ↗ Last confirmed 30 Jul 2026
Curve Finance DeFi	30 Jul 2023	$70,000,000	Smart-contract bug	Partial
What was taken CRV/ETH, alETH, msETH and pETH pool liquidity Amount recovered $52,300,000 Recovery timeline A reentrancy guard defect in Vyper 0.2.15, 0.2.16 and 0.3.0 left several pools exploitable — the flaw was in the compiler, not in Curve's own contracts. By 7 August 2023 about 73 per cent, some USD 52.3 million, had been returned by white hats and MEV operators who had front-run the attackers, including c0ffeebabe.eth returning funds taken from the CRV/ETH and msETH pools. Primary source Chainalysis, "Curve Finance Pools Exploited Due to Code Vulnerabilities" ↗ Last confirmed 27 Jul 2026
Multichain Bridge	6 Jul 2023	$126,000,000	Unknown	None disclosed
What was taken wETH, wBTC and USDC, with close to USD 120 million from the Fantom bridge alone Amount recovered None stated Recovery timeline Assets left Multichain's bridges in July 2023 with no exploit transaction to point to. The team said its CEO had been taken into custody by Chinese police in May 2023 and that it had lost access to the MPC keys; his sister then moved remaining funds to addresses she controlled, describing it as asset preservation, before also being detained. Multichain ceased operations. The vector is recorded as unknown because the source itself frames it as a possible hack or rug pull rather than a determined exploit. Nothing was returned. Primary source Chainalysis, "Multichain Exploit: Possible hack or rug pull" ↗ Last confirmed 27 Jul 2026
Atomic Wallet Wallet	2 Jun 2023	$100,000,000	Unknown	None disclosed
What was taken User funds drained from non-custodial wallets across multiple chains Amount recovered None stated Recovery timeline Users of the non-custodial wallet reported drained balances on 2 June 2023. Atomic Wallet said fewer than 0.1 percent of active users were affected and never published its own loss total; the USD 100 million figure and the date come from the FBI, whose August 2023 press release attributes the theft to DPRK TraderTraitor actors, the group also behind Harmony Horizon and Ronin. The company has announced no reimbursement and no recovery of the stolen funds; the attack mechanism was never officially established. Primary source FBI, "FBI Identifies Cryptocurrency Funds Stolen by DPRK" ↗ Last confirmed 30 Jul 2026
Euler Finance DeFi	13 Mar 2023	$197,000,000	Smart-contract bug	Recovered
What was taken DAI, WBTC, stETH and USDC drawn from the lending pools Amount recovered $240,000,000 Recovery timeline Flash-loan assisted exploit of the donation and liquidation logic on 13 March 2023. The exploiter returned assets in tranches through late March following negotiation with Euler Labs, and Euler recorded all recoverable funds returned on 3 April 2023. Value returned to the protocol by the exploiter; this was not an operator reimbursement. Primary source Euler Finance, "War & Peace: Behind the Scenes of Euler's $240M Exploit Recovery" ↗ Last confirmed 27 Jul 2026
FTX CEX	11 Nov 2022	$413,000,000	Unknown	None disclosed
What was taken Mixed digital assets drained from FTX.com and FTX US wallets Amount recovered None stated Recovery timeline Funds drained from both exchanges the night the company filed for Chapter 11. The stored figure is the debtors own accounting from their 17 January 2023 statement: 323 million dollars of FTX.com assets and 90 million of FTX US assets were subject to unauthorized third-party transfers post-petition. The attack mechanism was never officially established by the debtors, and the recovery position of those specific funds was never cleanly separated from the estate recoveries, so both stay unrecorded here rather than guessed. Primary source FTX Debtors, "FTX Debtors Provide Additional Information to Customers and Other Stakeholders" ↗ Last confirmed 30 Jul 2026
Mango Markets DeFi	11 Oct 2022	$110,000,000	Smart-contract bug	Partial
What was taken USDC, SOL and other collateral drawn against inflated MNGO positions Amount recovered $67,000,000 Recovery timeline Avraham Eisenberg pumped MNGO across three venues so the oracle price rose more than thirteen-fold in half an hour, then borrowed against the inflated collateral. He returned roughly USD 67 million in USDC and SOL under a governance proposal the Mango DAO approved on 13 October 2022, keeping USD 47 million as a claimed bug bounty in exchange for the DAO agreeing not to pursue him. Mango added USD 25 million from its own treasury to compensate users, which is not counted as recovery here. The CFTC, SEC and Department of Justice each brought charges regardless of the DAO vote. Primary source CFTC, "CFTC Charges Avraham Eisenberg with Manipulative and Deceptive Scheme to Misappropriate Over $110 million from Ma ↗ Last confirmed 27 Jul 2026
Nomad Bridge Bridge	1 Aug 2022	$190,000,000	Bridge exploit	Partial
What was taken WBTC, WETH, USDC and other bridged assets Amount recovered $37,000,000 Recovery timeline A botched initialisation let any message prove valid, and the exploit turned into a free-for-all: over 300 addresses drained the bridge by copying the original transaction. Nomad published a recovery address and offered up to a 10 per cent bounty, treating anyone returning at least 90 per cent of what they took as a white hat. More than USD 37 million, about a fifth, came back that way. Primary source Nomad, "The Road to Recovery" ↗ Last confirmed 27 Jul 2026
Harmony Horizon Bridge Bridge	24 Jun 2022	$100,000,000	Key compromise	None disclosed
What was taken ETH, USDC, WBTC and other bridged assets Amount recovered None stated Recovery timeline The FBI confirmed in January 2023 that Lazarus Group actors were responsible for the theft reported on 24 June 2022. The proceeds were laundered through Tornado Cash and later through RAILGUN, and the FBI has continued to track the assets in North Korean-controlled wallets. Nothing has been returned. A Harmony proposal to mint ONE to compensate holders was rejected by its community, so there was no reimbursement either. Primary source FBI, "FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft" ↗ Last confirmed 27 Jul 2026
Beanstalk DeFi	17 Apr 2022	$77,000,000	Smart-contract bug	None disclosed
What was taken Non-Beanstalk user assets drained from protocol liquidity pools Amount recovered None stated Recovery timeline Beanstalk Farms own postmortem, read at source: the credit-based stablecoin protocol was attacked at 12:24 UTC on 17 April 2022, with approximately 77 million dollars of non-Beanstalk user assets stolen from its liquidity pools, the figure stored here. The attacker used a flash loan to pass a malicious governance proposal and send the funds to their own wallet; the team shut off governance, paused the protocol, and burned the remaining Beans in the exploiter contract. Larger figures circulated for total protocol impact, but the tracker records the victim stated theft. The protocol later relaunched through a community recapitalization, which is funding, not recovery. Primary source Beanstalk Farms, "Beanstalk Governance Exploit" ↗ Last confirmed 30 Jul 2026
Ronin Bridge Bridge	23 Mar 2022	$625,000,000	Key compromise	Partial
What was taken 173,600 ETH and 25.5m USDC drained from the bridge Amount recovered $30,000,000 Recovery timeline Five of nine validator keys were compromised through social engineering, letting the attacker forge withdrawals. The FBI attributed the theft to the Lazarus Group. Law enforcement and industry partners seized more than USD 30 million of the stolen funds in September 2022, around a tenth of the total and the first DPRK crypto seizure on record. Separately, Sky Mavis reimbursed affected users from a USD 150 million funding round plus balance-sheet funds — that reimbursement is not counted as recovery here. Primary source Chainalysis, "Crypto Community Makes Profiting Hard for North Korean Hackers" ↗ Last confirmed 27 Jul 2026
Wormhole Bridge	2 Feb 2022	$326,000,000	Smart-contract bug	None disclosed
What was taken 120,000 wETH minted on Solana without collateral Amount recovered None stated Recovery timeline A signature-verification flaw let the attacker mint 120,000 wETH on Solana without posting collateral. Jump Crypto replaced the full amount within roughly a day so the protocol stayed solvent, and a USD 10 million bounty offer to the attacker went unanswered. None of the stolen value has been recovered: the assets remain in the attacker's wallets. This is the clearest case where reimbursement and recovery diverge — users were made whole, the theft was not reversed. Primary source Chainalysis, "Lessons from the Wormhole Exploit" ↗ Last confirmed 27 Jul 2026
BitMart CEX	4 Dec 2021	$150,000,000	Key compromise	None disclosed
What was taken ETH and BSC hot-wallet assets across many tokens Amount recovered None stated Recovery timeline BitMart own breach notice, read at source: a large-scale security breach on 4 December 2021 hit one ETH and one BSC hot wallet, with hackers withdrawing assets of approximately 150 million US dollars, the figure stored here; the company later attributed the breach to a stolen private key that compromised both wallets. Third-party analysts put the total nearer 196 million, but the tracker records what the victim disclosed. BitMart compensated affected users from its own funding, which is not counted as recovery; nothing is recorded as recovered from the attacker. Primary source BitMart, "BitMart Security Breach Update" ↗ Last confirmed 30 Jul 2026
BadgerDAO DeFi	2 Dec 2021	$116,300,000	Phishing	Partial
What was taken 2017 BTC, 53 DIGG, 26.56 ETH, 730 CVX Amount recovered $9,123,000 Recovery timeline A malicious snippet injected into the front end via an unauthorised Cloudflare API key prompted users to grant unlimited token approvals, which the attacker then drew on. Badger paused all contracts, stranding assets the attacker had taken but not yet withdrawn. BIP 76 and 77 recovered those to a DAO multisig and BIP 78 returned them to the wallets they came from: $9.123M, which Badger states is 7% of funds lost and left 40% of affected users whole. The remaining ~$121M has not been recovered from the attacker. Treasury-funded restitution under BIP 79/80 is reimbursement, not recovery, and is excluded here. Primary source BadgerDAO Recovery Phase (project statement, archived) ↗ Last confirmed 28 Jul 2026
Poly Network Bridge	10 Aug 2021	$610,000,000	Bridge exploit	Recovered
What was taken ETH, BSC and Polygon assets across the cross-chain pools Amount recovered $610,000,000 Recovery timeline The attacker, who used the moniker Mr. White Hat, began returning assets voluntarily the day after the exploit. Tether released 33,431,200 USDT frozen during the attack on 25 August 2021. Poly Network stated recovery of all affected user assets complete on 26 August 2021. Value returned to the protocol; this was not an operator reimbursement. Primary source Poly Network, "Asset Recovery Complete" ↗ Last confirmed 27 Jul 2026
KuCoin CEX	25 Sep 2020	$281,000,000	Key compromise	Partial
What was taken BTC, ETH and a long tail of ERC-20 tokens from hot wallets Amount recovered $204,000,000 Recovery timeline Hot-wallet private keys were compromised and the FBI later attributed the theft to the Lazarus Group. KuCoin put recovery at about 84 per cent, roughly USD 204 million, achieved largely by token issuers freezing or reissuing affected contracts and by exchanges blocking the laundering routes. Value returned to KuCoin rather than paid out of its own pocket, so it is counted here. Primary source KuCoin, "The Latest Updates About the KuCoin Security Incident" ↗ Last confirmed 27 Jul 2026
Coincheck CEX	26 Jan 2018	Undisclosed	Unknown	None disclosed
What was taken Customer-held NEM (XEM), sent externally from the exchange Amount recovered None stated Recovery timeline The largest exchange theft of its era, recorded here on the regulator own words: Japan FSA bulletins state that on 26 January 2018 virtual currency (NEM) held by Coincheck was illicitly transmitted externally following unauthorized access, and that business-improvement orders and on-site inspections followed across the industry. Every loss and compensation figure Coincheck published was denominated in yen and XEM, and the company notices from the period are no longer online, so this row records no US dollar loss rather than a converted or second-hand one. The episode led directly to Japan revised crypto exchange regulation. Primary source Japan FSA, Access FSA No. 176 (administrative actions, virtual currency exchangers) ↗ Last confirmed 30 Jul 2026

What the data shows

Every figure below comes from the verified table above, redrawn as the trends and comparisons a table cannot show.

Verification ledger

5 most recent of 6 logged updates

Bitcoin Depot backfilled from its 6 Apr 8-K: 50.903 BTC (about 3.67 million dollars, the company own recorded fair value) taken from corporate settlement wallets via compromised credentials on 23 Mar. Surfaced while triaging the breach tracker drafts; it was filed there, but no personal data was taken, so it belongs here. 14 Aug 2026
Coinsbuy added (9 Aug, company-confirmed, loss undisclosed, partial freeze via ChangeNOW). Coldcard re-verified against Coinkite technical backgrounder; loss remains undisclosed by the vendor. 14 Aug 2026
Recovery status verified and recorded on three rows previously withheld by the no-blank-cells rule; all 22 records now render. 30 Jul 2026
Seven incidents added from primary sources: Atomic Wallet, WazirX, FTX, Mixin Network, Coincheck, BitMart and Beanstalk. The tracker now holds 22 records. 30 Jul 2026
BadgerDAO incident added from primary sources. 28 Jul 2026

How this tracker is maintained

Every incident passes the same checks before it appears, and recovery stays under review after.

Sourced

The loss figure is the one the affected project, exchange, or court filing states, linked on every row. A chain-analytics estimate never substitutes for a disclosure. Where no figure was disclosed, the row says Undisclosed.
Dated

Each row carries the incident date as disclosed and the date we last confirmed it.
Re-checked

Recovery status is re-verified on a 30-day cycle, because recoveries unfold for years after the headlines stop. Each status change lands in the ledger.

Where do these come from?: Project statements, exchange notices, post-mortems, and court records only, linked on every row. An absent loss figure renders as Undisclosed rather than zero, because absence is a real answer.
Why track recovery?: Most coverage ends at the loss headline. Whether funds came back, fully or partly or not at all, is the part readers rarely find, so recovery is a first-class column here, sourced from the project’s own statements and court filings.
Which incidents qualify?: Major incidents from January 2024 onward, plus canonical earlier cases kept for reference depth. Inclusion is editorial; the tracker accepts no submissions and no payment.

This is informational content and does not constitute investment advice. Loss and recovery figures reflect what the affected parties disclosed as of the stated dates and can be revised. Confirm with the linked primary source before relying on a figure.

Quoting a figure with a link to this page needs no permission. Cite it as you would any source. Reuse of the compiled dataset itself is licensed under CC BY 4.0: credit CoinLaw and link back.

Crypto Hacks Tracker

All records

What the data shows

Verification ledger

How this tracker is maintained

Sourced

Dated

Re-checked

Sources