From Mt. Gox to Binance: Seven crypto heists that shook the world
Binance’s estimated US$6.3 billion breach exceeds Bybit’s 2025 theft, as seven major cases highlight risks across crypto exchanges and platforms.
- Binance reported a US$6.3 billion security breach in October 2026, which could be the largest crypto theft on record.
- The incident was one of seven major crypto heists, with others including thefts from Bybit (US$1.5B), Poly Network (US$610M), and Ronin (US$540M).
- The seven highlighted attacks targeted various platforms, including large cryptocurrency exchanges like Mt. Gox and decentralized finance (DeFi) projects like Wormhole.
Binance, the world’s largest cryptocurrency exchange, has reported an estimated US$6.3 billion impact from its October 2026 security breach, potentially the largest crypto theft on record. The figure far exceeds the US$1.5 billion stolen from Bybit in 2025.
Repeated thefts in the industry that emerged after bitcoin was first proposed in 2008 have raised questions about the protection of customer funds and could prompt investors to reassess the risks of holding digital assets.
The following seven cases cover major attacks on cryptocurrency exchanges and decentralised platforms, including incidents in which assets were subsequently returned or replaced.
1. Binance’s breach could set a crypto theft record
When: October 2026
Estimated impact: US$6.3 billion, approximately 212 billion baht
Binance said it was working with partners to freeze affected assets and had located about US$3 billion. In the October 30, 2026, Reuters review, the exchange gave no update on the status of the remaining US$3.3 billion.
Binance co-founder Yi He pledged that the company would cover “all hacking losses”.
2. Bybit’s cold wallet is drained
When: February 2025
Reported value stolen: US$1.5 billion
Bybit suffered the theft of digital assets from a cold wallet used for ether tokens. Cold wallets normally keep their private keys offline and are generally considered more secure than internet-connected hot wallets.
3. Poly Network receives nearly all stolen assets back
When: August 2021
Reported value stolen: US$610 million
Hackers stole digital assets from Poly Network, a platform facilitating peer-to-peer token transactions, before returning almost all the funds.
The Poly Network attack exposed weaknesses in decentralised finance, or DeFi, where users can lend, borrow and save digital tokens without traditional financial intermediaries such as banks and exchanges.
4. Ronin attack drains ether and USD Coin
When: March 2022
Reported value at the time of the attack: Approximately US$540 million
Hackers took about 173,600 ether tokens and 25.5 million USD Coin tokens from Ronin Network, a blockchain project linked to the popular online game Axie Infinity.
Ronin supports transfers of cryptocurrency between different blockchains.
5. Coincheck’s hot wallet is breached
When: January 2018
Reported value stolen: US$530 million
Thieves accessed an internet-connected hot wallet at Tokyo-based cryptocurrency exchange Coincheck and drained its funds.
The Coincheck theft brought exchange security practices under scrutiny. South Korea’s intelligence agency suggested at the time that a North Korean hacking group might have been responsible.
6. Mt. Gox collapses after years of bitcoin theft
When: 2011–2014
Reported losses at collapse: Approximately US$470 million
Tokyo-based bitcoin exchange Mt. Gox suffered thefts between 2011 and 2014 and filed for bankruptcy in early 2014 after the breach came to light.
Mt. Gox had once handled 80% of global bitcoin trading, according to Reuters, which reported that about 24,000 customers lost access to their funds when the exchange collapsed.
7. Jump Trading replaces funds stolen from Wormhole
When: February 2022
Reported value stolen: US$320 million
Hackers stole 120,000 digital tokens linked to ether from Wormhole, a decentralised finance platform. Ether was the second-largest cryptocurrency at the time.
The cryptocurrency arm of Chicago-based Jump Trading subsequently replaced the missing funds. Jump Trading had acquired Wormhole’s developer in 2021, the year before the attack.
