Security Incidents
A chronological record of landmark thefts from Mt. Gox to Bybit, focusing on loss size, the compromised layer and recovery outcomes.
These incidents did not break Bitcoin's consensus rules or cryptography. Most compromised an exchange or custodian's servers, private keys, hot wallets or signing workflow. Coincheck, Poly Network, FTX and Bybit involved non-Bitcoin assets, but remain important turning points in centralized custody and digital-asset security.
Loss values are approximate contemporaneous figures reported at the time. Crypto price movements can make recovery-time values dramatically different.
| Date | Incident | Type | Loss |
|---|---|---|---|
| Feb 2014 | Mt. Gox | Bitcoin exchange | ~850,000 BTC reported |
| Aug 2, 2016 | Bitfinex | Bitcoin exchange | 119,754 BTC · ~$72M then |
| Jan 26, 2018 | Coincheck | Exchange · NEM | ¥58B · ~$532.6M then |
| May 7, 2019 | Binance | Bitcoin exchange | 7,000 BTC · ~$40M then |
| Sep 26, 2020 | KuCoin | Exchange · multiple assets | ~$281M |
| Aug 10, 2021 | Poly Network | Cross-chain bridge | ~$611M |
| Nov 11, 2022 | FTX post-bankruptcy theft | Exchange · multiple assets | FTX estimate: ~$415M |
| May 31, 2024 | DMM Bitcoin | Bitcoin exchange | 4,502.9 BTC · ~$308M |
| Feb 21, 2025 | Bybit | Exchange · ETH assets | ~$1.5B |
~850,000 BTC reported
The world's largest Bitcoin exchange at the time disclosed accumulated losses and filed for bankruptcy. US prosecutors later alleged that defendants laundered about 647,000 BTC from the hack.
Attack surface: Long-running wallet and operational-control failures; the complete intrusion path remains disputed.
Outcome: About 200,000 BTC was later found in old wallets, and creditor repayments began in 2024.
119,754 BTC · ~$72M then
More than 2,000 unauthorized transactions moved bitcoin from segregated customer wallets, becoming a landmark on-chain tracing and recovery case.
Attack surface: Compromise of the exchange network and multisignature wallet operations.
Outcome: US authorities seized about 94,643 BTC in 2022; the hacker received a five-year sentence in 2024.
¥58B · ~$532.6M then
About 523 million NEM was stolen from a Tokyo exchange hot wallet. It was not a Bitcoin theft, but became a defining centralized-custody failure.
Attack surface: Online NEM hot wallet with a single-signature setup.
Outcome: Coincheck announced roughly ¥46.3 billion in compensation for about 260,000 affected customers.
7,000 BTC · ~$40M then
Attackers combined stolen user credentials and API keys to execute one large withdrawal from the exchange's hot wallet.
Attack surface: Phishing, compromised two-factor data and API keys.
Outcome: Binance covered the full loss through its SAFU fund, leaving user balances intact.
~$281M
Bitcoin, ether and numerous tokens left exchange wallets, followed by broad freezes and token migrations by affected projects.
Attack surface: Leaked hot-wallet private keys.
Outcome: KuCoin said tracing, freezes, token swaps and insurance ultimately made customers whole.
~$611M
A smart-contract exploit moved assets across several chains. It was not an exchange or Bitcoin hack, but exposed the scale of bridge-authorization risk.
Attack surface: Authorization flaw in cross-chain smart contracts.
Outcome: The attacker returned nearly all assets; a separate $33 million in USDT was frozen.
FTX estimate: ~$415M
Assets moved from several wallets hours after FTX filed for bankruptcy. This theft is distinct from the separate criminal misuse of customer funds.
Attack surface: Wallet access was compromised after the filing; the attacker and exact path remain publicly unresolved.
Outcome: Some flows were traced, but the attacker has not been publicly identified.
4,502.9 BTC · ~$308M
An unauthorized outflow removed 4,502.9 BTC from the Japanese exchange. The company pledged to replace all customer bitcoin deposits with group support.
Attack surface: The initial notice gave no detailed path; later authorities described signs of a North Korea-linked operation.
Outcome: After its compensation pledge, the company decided to close and transfer customer accounts.
~$1.5B
A cold-wallet signing flow was made to appear legitimate while ether and related tokens were redirected, reported as the largest single crypto theft to date.
Attack surface: A sophisticated compromise of the multisig supply chain and signing interface.
Outcome: Bybit said customer assets remained fully backed and withdrawals continued; the FBI attributed the theft to North Korea's TraderTraitor actors.
Loss figures use values reported around each incident, not current prices. Where the attack path remains uncertain, the description is limited to public findings.