- Binance’s October breach of approximately $6.3 billion stands as the largest cryptocurrency theft by nominal U.S. dollar value, far eclipsing Bybit’s $1.46 billion to $1.5 billion exploit.
- When denominated in raw Bitcoin, historical collapses like Mt. Gox—involving roughly 650,000 net lost BTC—dwarf modern dollar records, representing tens of billions in present-day purchasing power and a much larger share of the circulating supply.
- Binance founder Changpeng Zhao emphasized that gross dollar theft numbers fail to account for reimbursement capacity, market proportion, or the actual percentage of user assets protected by exchange reserves.
The cryptocurrency sector’s security landscape has transitioned into an era of multi-billion-dollar exploits, fundamentally reshaping how market participants quantify risk. When analyzing historical thefts by their estimated fiat valuation at the time of each incident, the magnitude of centralized exchange security breaches and decentralized bridge failures has expanded rapidly. However, discrepancies between initial headline losses, permanent capital impairment, and token-denominated impacts show that total dollar losses provide only a partial picture of systemic fallout.
The Era of Multi-Billion-Dollar Exchange Breaches
At the top of the historical rankings by contemporaneous dollar value is the October 29 Binance security incident. Blockchain forensic investigators traced around $6.3 billion transferred across nearly a dozen distributed ledgers, including Ethereum, Bitcoin, Tron, and Solana. On-chain analysis pinpointed 18,270 BTC within the compromised funds and connected the operation to North Korea’s Tradertraitor hacking group. Despite the scale of the exploit, partners moved swiftly to freeze an estimated $3 billion, while Binance deployed its corporate funds and emergency reserves to backstop affected customer balances.
Prior to the Binance breach, the largest single dollar theft was recorded on February 21, 2025, when Bybit suffered a sophisticated breach resulting in losses of roughly $1.46 billion to $1.5 billion. Attackers intercepted the transaction approval framework of an Ether cold-wallet transfer, presenting authorized signers with what appeared to be legitimate transactions. Bybit saw approximately 400,000 ETH and related tokens drained, an attack subsequently attributed by the Federal Bureau of Investigation (FBI) to North Korean state-sponsored actors. Bybit procured additional liquidity to ensure uninterrupted user withdrawals.
Infrastructure and Bridge Vulnerabilities: Ronin, Poly Network, and BSC
Cross-chain bridges and decentralized infrastructure account for some of the largest historical losses outside centralized trading venues:
- Ronin Network (March 2022): Attackers linked by U.S. officials to the Lazarus Group seized control of five of nine validator private keys, siphoning 173,600 ETH and 25.5 million USDC, valued between $540 million and $625 million at the time.
- Poly Network (August 2021): A critical flaw in access controls allowed an attacker to execute unauthorized transfers worth nearly $610 million. The incident took a unique turn when the exploiter eventually returned almost all compromised assets.
- BSC Token Hub (October 2022): A protocol flaw facilitated the unauthorized minting of 2 million BNB, nominally priced between $570 million and $586 million. Prompt ecosystem intervention prevented the vast majority of the newly minted tokens from moving beyond the network, demonstrating why nominal minting figures differ significantly from realizable gains.
- Wormhole (February 2022): A signature-validation vulnerability permitted an attacker to mint 120,000 unbacked wrapped ETH, totaling $320 million to $326 million. Jump Crypto intervened to replenish the missing collateral.
- Nomad Bridge (August 2022): A message-validation error led to a chaotic drain of approximately $190 million by multiple parties.
Historical Exchange Collapses and Protocol Shortfalls
The timeline of crypto compromises spans multiple market cycles. In January 2018, Japanese exchange Coincheck lost approximately 523 million NEM tokens ($530 million) from a compromised hot wallet, eventually reimbursing users with company capital. During the November 2022 insolvency proceedings of FTX, an estimated $450 million to $477 million vanished in unauthorized transfers amid internal control failures.
Other significant breaches include Bitget’s reported September 2026 incident, where compromised withdrawal infrastructure led to losses revised upward to $387.5 million, prompting the exchange to utilize its protection fund. Liquid Network faced an event in September 2026 involving around 4,000 BTC, though reports indicate white-hat participants returned 3,400 BTC. DMM Bitcoin suffered a $305 million to $308 million loss (4,502.9 BTC) in May 2024 through social engineering targeting wallet infrastructure, ultimately prompting the exchange to wind down operations despite promising user compensation. Further protocol compromises include KelpDAO ($292 million in April 2026), Drift Protocol ($285 million to $295 million in April 2026), KuCoin ($150 million to $280 million in September 2020), WazirX ($230 million to $235 million in July 2024), Cetus Protocol ($223 million in May 2025), Mixin Network ($200 million in September 2023), and Euler Finance ($197 million in March 2023, where approximately 90% was returned).
Dollar Valuation vs. Bitcoin Quantities
Rankings calculated strictly by contemporary fiat value inherently tilt toward recent years when crypto asset valuations were elevated. Evaluating security incidents by the volume of raw Bitcoin stolen reveals an entirely different historical balance. For perspective, applying a fixed reference price of $78,000 per BTC illustrates this divergence:
| Incident / Entity | Year | BTC Lost / Compromised | Contemporaneous Fiat Value | Hypothetical Value (at $78,000/BTC) |
|---|---|---|---|---|
| Mt. Gox (Initial Shortfall) | 2014 | 850,000 BTC | ~$473 Million | $66.30 Billion |
| Mt. Gox (Net Loss Post-Recovery) | 2014 | ~650,000 BTC | N/A | $50.70 Billion |
| Lubian Mining (Disputed) | 2020 | 127,426 BTC | Unresolved | $9.94 Billion |
| Bitfinex | 2016 | 119,756 BTC | ~$72 Million | $9.34 Billion |
| Allinvain Wallet | 2011 | 25,000 BTC | Minimal | $1.95 Billion |
| Binance | 2026 | 18,270 BTC | $6.3 Billion (all assets) | $1.43 Billion (BTC only) |
When Mt. Gox shuttered in 2014, its reported missing balance of 850,000 BTC was valued at roughly $473 million. Even after discovering 200,000 BTC in cold storage, the remaining 650,000 BTC represents more than $50 billion at a $78,000 BTC valuation. Similarly, the 119,756 BTC stolen from Bitfinex in 2016 was valued at roughly $72 million at the time, yet accounts for over $9.34 billion at modern reference rates, though law enforcement later seized a significant portion.
Changpeng Zhao on Measuring Exploit Impact
Binance founder Changpeng Zhao, commonly known as CZ, challenged the convention of assessing exchange security failures purely through gross dollar headlines. Zhao argued that nominal figures do not accurately capture market impact, platform survival, or end-user harm:
“Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. $6.3 billion is the biggest in USD terms, but not in $BTC terms. MtGox was 650,000 $BTC,” Zhao wrote on X. “Other important numbers to consider: % of bitcoin (in relation to $BTC total supply), ie, market impact. MtGox is big there again at 5%+. Number of users impacted, and % of user assets impacted. MtGox (the largest CEX at the time) and FTX (not small) were all near 100% of users and their [assets].”
Zhao further stated:
“Most important: Who is impacted? Does the platform cover it all? (only one victim), as in recent two CEX cases and Binance. Obviously, still a major disaster for the industry, Binance (and me). It hurts, but we survive. Most importantly, we protect our users.”
Why This Matters
The distinction between nominal dollar losses and crypto-native metrics is critical for institutional risk modeling, insurance pricing, and regulatory scrutiny. In early incidents like Mt. Gox, breaches wiped out a substantial percentage of the entire existing Bitcoin supply and bankrupted the exchange, inflicting total losses on customers. In contrast, modern tier-one exchanges operate with broader asset diversification and multi-billion-dollar emergency reserves, allowing them to absorb enterprise-level shocks without passing losses directly to retail depositors.
Furthermore, evaluating attacks through asset-specific lenses highlights how state-sponsored cyber operations, particularly from North Korean syndicates like Lazarus and Tradertraitor, have shifted targets. Attackers have evolved from simple hot-wallet intrusions to complex transaction-approval hijacking, signature validation exploits, and cross-chain messaging attacks across multiple decentralized and centralized platforms.
Frequently Asked Questions
What is the largest crypto hack by dollar value at the time of the incident?
The Binance security breach ranks as the largest single event in nominal U.S. dollar value, with investigators tracing approximately $6.3 billion across multiple blockchains, surpassing Bybit’s $1.46 billion to $1.5 billion incident.
Why is Mt. Gox considered larger than modern multi-billion-dollar hacks?
While Mt. Gox was valued at approximately $473 million during its 2014 bankruptcy, it involved roughly 650,000 unrecovered Bitcoins. That accounted for more than 5% of Bitcoin’s total circulating supply at the time, representing tens of billions of dollars at modern market valuations.
Do initial theft figures reflect the permanent loss suffered by users?
No. Initial figures denote the total gross value compromised during the exploit. Final net losses often decrease significantly due to law enforcement asset freezes, negotiated white-hat returns (such as Poly Network and Euler Finance), or corporate protection funds that reimburse customer balances in full.
