CoinLaw The Crypto Desk Crypto Hacks Tracker
Crypto Hacks Tracker
Every major crypto theft we can verify, and what came back. The recovery column states whether the stolen value was actually retrieved rather than whether users were reimbursed.
31 incidents tracked last verified 5 Nov 2026 next review by 12 Nov 2026
- Incidents
- 31
- Disclosed losses · 26 of 31 incidents
- $12.2B
- Recovered · where stated
- $4.4B
- Re-verify cycle
- 90day
At a glance
- Largest loss in 2026
- Binance $6,300,000,000
- Most recent incident
- Binance 29 Oct 2026
- Recovered, where the amount is stated
- 45% of $9,359,234,535 lost across 10 incidents
All records
31 incidents, newest first. Filter or search below.
How to use this tracker
Search & filter
Filter by vector, recovery or year, or use the search box to find a specific incident.
Explore the data
Sort by newest first, largest loss, most recovered or A to Z.
Inspect records
Select Detail on any row to open its full record, then copy a link that opens that row directly.
Verify sources
Every row links the primary source it came from, most often fbi.gov.
| Project | Date | Loss (USD, derived) | Vector | Recovery | Record detail | |
|---|---|---|---|---|---|---|
| Binance CEX | 29 Oct 2026 | $6,300,000,000 | Unknown | Partial | ||
|
||||||
| Coinsbuy CEX | 9 Aug 2026 | Undisclosed | Unknown | Partial | ||
|
||||||
| Coldcard Wallet | 30 Jul 2026 | Undisclosed | Key compromise | None disclosed | ||
|
||||||
| Bitcoin Depot Other | 23 Mar 2026 | $3,665,000 | Key compromise | None disclosed | ||
|
||||||
| Cetus Protocol DeFi | 22 May 2025 | $223,000,000 | Smart-contract bug | Partial | ||
|
||||||
| Bybit CEX | 21 Feb 2025 | $1,500,000,000 | Phishing | Partial | ||
|
||||||
| WazirX CEX | 18 Jul 2024 | $230,000,000 | Phishing | None disclosed | ||
|
||||||
| DMM Bitcoin CEX | 31 May 2024 | $308,000,000 | Key compromise | None disclosed | ||
|
||||||
| Orbit Chain Bridge | 31 Dec 2023 | $81,500,000 | Unknown | None disclosed | ||
|
||||||
| KyberSwap DeFi | 22 Nov 2023 | $55,234,535 | Smart-contract bug | Partial | ||
|
||||||
| HTX CEX | 22 Nov 2023 | $30,000,000 | Unknown | None disclosed | ||
|
||||||
| Poloniex CEX | 10 Nov 2023 | $126,000,000unconfirmed | Key compromise | Partial | ||
|
||||||
| Mixin Network Other | 23 Sep 2023 | $200,000,000 | Unknown | None disclosed | ||
|
||||||
| CoinEx CEX | 12 Sep 2023 | $44,667,778 | Key compromise | None disclosed | ||
|
||||||
| Stake.com Other | 4 Sep 2023 | $41,000,000 | Unknown | None disclosed | ||
|
||||||
| Curve Finance DeFi | 30 Jul 2023 | $61,700,000 | Smart-contract bug | Partial | ||
|
||||||
| Multichain Bridge | 7 Jul 2023 | $127,000,000 | Unknown | None disclosed | ||
|
||||||
| Atomic Wallet Wallet | 2 Jun 2023 | $100,000,000 | Unknown | None disclosed | ||
|
||||||
| Euler Finance DeFi | 13 Mar 2023 | $197,000,000 | Smart-contract bug | Recovered | ||
|
||||||
| FTX CEX | 11 Nov 2022 | $413,000,000 | Unknown | None disclosed | ||
|
||||||
| Mango Markets DeFi | 11 Oct 2022 | $110,000,000 | Smart-contract bug | Partial | ||
|
||||||
| Nomad Bridge Bridge | 1 Aug 2022 | $186,000,000 | Bridge exploit | Partial | ||
|
||||||
| Harmony Horizon Bridge Bridge | 24 Jun 2022 | $100,000,000 | Key compromise | None disclosed | ||
|
||||||
| Beanstalk DeFi | 17 Apr 2022 | $77,000,000 | Smart-contract bug | None disclosed | ||
|
||||||
| Ronin Bridge Bridge | 23 Mar 2022 | $564,031,504 | Key compromise | Partial | ||
|
||||||
| Wormhole Bridge | 2 Feb 2022 | $321,680,400 | Smart-contract bug | None disclosed | ||
|
||||||
| BitMart CEX | 4 Dec 2021 | $150,000,000 | Key compromise | None disclosed | ||
|
||||||
| BadgerDAO DeFi | 2 Dec 2021 | $116,300,000 | Phishing | Partial | ||
|
||||||
| Poly Network Bridge | 10 Aug 2021 | $610,000,000 | Bridge exploit | Recovered | ||
|
||||||
| KuCoin CEX | 25 Sep 2020 | $281,000,000unconfirmed | Key compromise | Partial | ||
|
||||||
| Coincheck CEX | 26 Jan 2018 | Undisclosed | Unknown | None disclosed | ||
|
||||||
No records match the current filters.
About this data
- Scope
- Incidents where the affected project, a regulator, or a court filing disclosed what was taken. The dollar figure is our conversion at the incident date, never a disclosed number.
- Key facts
- 31 incidents, $12.6B in disclosed losses converted at each incident date from the units the victim itself published.
- The most common attack route is Key compromise, in 9 of 21 incidents where the disclosure named one.
- 28 of 31 disclose an amount; the rest publish none, and this table leaves those cells empty rather than estimating them.
- This cycle
- This cycle, from Binance's own updates: Binance reported that its hot wallets were compromised on 29 October 2026, with a loss of approximately $6.3B and approximately $3 billion frozen on-chain. Its investigation is still open, so the attack method reads unknown for now.
- Reading the table
- What was taken is recorded as the affected project or exchange disclosed it, in the units they stated, and sits in each row’s detail; the dollar column is our own conversion at the incident date, not a disclosed figure, because a token count is fixed while its value moves. Recovery status is as stated by the project or in court filings. A vendor’s estimate never substitutes for a disclosure. Informational only, not investment advice.
Using this data in research or journalism?
Quoting a figure with a link to this page needs no permission. Reuse of the compiled dataset is licensed under CC BY 4.0: credit CoinLaw and link back.
What the data shows
The charts below redraw the table above as the trends and comparisons a table cannot show.
Disclosed losses by year
Sum of losses as each affected project disclosed them. Years with no verified disclosure are absent, not zero. Losses no primary source states are left out here; the recovered-vs-lost chart shows them in their own band.
Largest incidents
Loss at disclosure, as each affected project stated it.
Attack vectors
How the funds were taken, per incident post-mortems.
Recovery outcomes
Whether anything came back, per incident.
Recovered vs lost, by year
Split by what was actually retrieved. An incident whose recovery has never been quantified sits whole in the third band rather than being guessed at, and one whose loss no primary source states sits in the fourth. Nothing is dropped, and nothing unverified is folded into a total.
- Recovered
- Not recovered
- Recovery not established
- Loss not confirmed
Verification ledger
5 most recent of 15 logged updates · RSSLatest Re-verified
Re-verify pass: 2 rows due. 1 re-confirmed against their cited source, 0 updated, 1 not re-checked this pass and left at their old date.
Loss approximately $6.3B on 29 Oct 2026; approximately $3 billion frozen on-chain
Loss $223M unchanged, now sourced; no longer marked unconfirmed
Loss about $186M, down from $190M; no longer marked unconfirmed
Recovered $42.89M, down from a rounded $43M that the cited FBI alert never stated
How this tracker is maintained
Every incident passes the same checks before it appears, and recovery stays under review after.
-
Sourced
The loss figure is the one the affected project, exchange, or court filing states, linked on every row. A chain-analytics estimate never substitutes for a disclosure. Where no figure was disclosed, the row says Undisclosed.
-
Dated
Each row carries the incident date as disclosed and the date we last confirmed it.
-
Re-checked
Recovery status is re-verified on a 90-day cycle, because recoveries unfold for years after the headlines stop. Each status change lands in the ledger.
- Where do these come from?
- Project statements, exchange notices, post-mortems, and court records only, linked on every row. An absent loss figure renders as Undisclosed rather than zero, because absence is a real answer.
- Why track recovery?
- Most coverage ends at the loss headline. Whether funds came back, fully or partly or not at all, is the part readers rarely find, so recovery is a first-class column here, sourced from the project’s own statements and court filings.
- Which incidents qualify?
- Incidents with losses of $10 million or more from January 2024 onward, plus smaller incidents a regulator, court or securities filing has put on record, and incidents whose victim has not yet stated the loss; canonical earlier cases are kept for reference depth. Inclusion is editorial; the tracker accepts no submissions and no payment.
This is informational content and does not constitute investment advice. Loss and recovery figures reflect what the affected parties disclosed as of the stated dates and can be revised. Confirm with the linked primary source before relying on a figure.
