A cyberattack on Binance, the world's largest cryptocurrency exchange, on Thursday has drawn fresh attention to cryptocurrency theft, with blockchain intelligence firm TRM Labs estimating that about $6.36 billion was transferred out of its wallets across 10 blockchains.
Most transfers took place within about 20 minutes. TRM Labs attributed the operation, with high confidence, to TraderTraitor, a North Korean hacking group.
Binance said its preliminary investigation pointed to a potentially compromised laptop belonging to a DevOps engineer.
In a statement on Friday, it estimated the impact at around $6.3 billion and said about $3 billion in affected assets had been frozen.
The exchange said user funds were safe, pledged to cover losses through its Secure Asset Fund for Users and company funds, and reported no evidence that wallet private keys had been leaked. The investigation remains ongoing.
The incident ranks among the largest reported cryptocurrency thefts.
Here are some of the biggest cases, based on the estimated value of assets at the time.
Bybit, February 2025
Cryptocurrency exchange Bybit suffered one of the largest digital asset thefts on February 21, 2025, when hackers stole approximately $1.5 billion in cryptocurrency from an Ethereum cold wallet.
The attackers compromised the transaction approval process, tricking authorised signers into approving a malicious transaction.
The US Federal Bureau of Investigation (FBI) attributed the attack to North Korea, identifying the operation as part of a hacking campaign known as TraderTraitor.
The FBI said the attackers rapidly converted some of the stolen assets into bitcoin and other cryptocurrencies, distributing them across thousands of addresses on multiple blockchains.
Ronin Network, March 2022
The Ronin Network, a blockchain platform associated with the online game Axie Infinity, lost cryptocurrency worth almost $620 million after attackers compromised its transaction-validation system.
Hackers gained control of private keys belonging to validators, enabling them to approve unauthorised withdrawals.
The US Treasury Department attributed the March 2022 attack to Lazarus Group, a North Korean state-sponsored hacking organisation.
The department said the group had stolen almost $620 million from the blockchain project.
Poly Network, August 2021
A hacker exploited a vulnerability in Poly Network, a decentralised finance platform that enables transfers between different blockchains, stealing digital assets worth more than $610 million.
The platform said the attacker began returning the assets within days of the incident.
By August 2023, media reported that almost all the funds had been returned, except for some stablecoins frozen by their issuer.
The hacker claimed the attack was intended to expose a security weakness in the platform.
Poly Network offered a $500,000 reward for information about the vulnerability and for returning the funds.
BNB Chain, October 2022
An attacker exploited a vulnerability in the BSC Token Hub, a cross-chain bridge connecting two BNB blockchain networks, and withdrew around 2 million BNB tokens worth approximately $586 million.
BNB Chain said the attacker exploited a flaw in cross-chain message verification.
The network coordinated with validators to suspend operations and limit the movement of the affected assets.
Coinbase's threat intelligence team later published a technical analysis explaining how the attacker forged security proofs to exploit the bridge.
The initial amount involved did not translate into an equivalent financial loss, as much of the cryptocurrency remained on the network or was frozen.
Coincheck, January 2018
Japanese cryptocurrency exchange Coincheck suffered a major attack in January 2018, when hackers stole approximately 526.3 million NEM tokens from an internet-connected wallet.
Media reports said the stolen assets were valued at around $530 million at the time.
The incident prompted Japan's Financial Services Agency to order improvements to Coincheck's operations and examine security arrangements at other cryptocurrency exchanges.
Coincheck later said it had compensated affected customers for the stolen funds, according to company filings.
Mt. Gox, 2011–2014
Tokyo-based bitcoin exchange Mt. Gox collapsed in 2014 after disclosing that hundreds of thousands of bitcoins had gone missing through thefts spanning several years.
The missing cryptocurrency was valued at close to $500 million at the time, according to reports.
Mt. Gox, which once handled a large share of global bitcoin trading, filed for bankruptcy in 2014, leaving thousands of customers unable to access their funds.
Wormhole, February 2022
Wormhole, a platform connecting different blockchain networks, was exploited in February 2022, resulting in the theft of approximately $320 million in cryptocurrency.
Hackers exploited a vulnerability in the platform's verification process to create tokens without providing the required backing.
Media reported that Jump Crypto, whose parent company had acquired Wormhole's developer, replaced the stolen funds.
Liquid Network, September 2026
Attackers drained about $319 million in bitcoin from Liquid Network, a Bitcoin sidechain operated by Blockstream, on September 6, 2026.
TRM Labs said the attackers exploited a software vulnerability to create unbacked synthetic bitcoin tokens and exchange them for real bitcoin.
About 85 percent of the funds, worth roughly $272 million, were later returned after Blockstream patched the vulnerability.
The firm said around $47 million remained with the attackers.
