DeFi & exchange archive
The biggest DeFi & crypto hacks of the last 10 years
A chronological record of major DeFi exploits, bridge hacks, oracle attacks, and centralized-exchange compromises from 2016 through 2026 — with reported amounts, attack vectors and dated outcomes. Reviewed October 30, 2026. Binance and Polymarket figures remain provisional.
All hacks, latest first
Binance
Binance’s October 30 initial investigation points to a compromised DevOps engineer’s laptop that allowed access to a service container and unauthorized withdrawals. Binance said it had found no evidence of leaked wallet private keys. A final technical post-mortem was still pending.
- Outcome
- At 02:25 UTC on October 30, Binance estimated ~$6.3B affected and ~$3B frozen on-chain. It pledged to cover all losses using SAFU and company funds, suspended deposits and withdrawals as a precaution, revoked affected authorization and engaged investigators. Frozen assets are not yet the same as returned funds.
Bithumb
An unauthorized external party accessed Bithumb’s internal mobile groupware system on October 27. Bithumb confirmed on October 29 that personal information of 6,444 customers was affected — 5,600 in encrypted files, while 844 had names, phone numbers, emails, resident registration numbers, bank account numbers and ID copies directly exposed.
- Outcome
- Bithumb blocked the access path, suspended mobile groupware use and apologized publicly. No crypto asset loss has been confirmed. South Korea’s Financial Services Commission opened an emergency inspection of the virtual asset industry in response. Users were warned of impersonation and voice-phishing risks from the leaked data.
Prabang
South Korean exchange Prabang disclosed that an unauthorized outsider breached its systems on October 24 and drained roughly 100 million won from a hot wallet — the first confirmed asset loss in a wave of hacks hitting Korean crypto exchanges and financial firms in late October.
- Outcome
- Prabang suspended all services, reported the incident to authorities and pledged to fully reimburse affected customer assets from company funds. The investigation into the cause and full scope was ongoing at disclosure.
Polymarket
Polymarket said a third-party provider was compromised. Malicious JavaScript targeted international-platform traders, with researchers tracing roughly $2.5–2.73M; the company had not published a final aggregate loss or affected-user count.
- Outcome
- The cause was fixed and trading resumed after a temporary pause. Polymarket pledged full reimbursement; the reviewed reports do not establish completed reimbursement to every trader.
Initia
An attacker created unbacked tokens on Initia and redeemed them through bridges. Bitquery traced ~$2.73M of real assets paid from bridge reserves, distinct from the ~$7.48M face value of tokens minted.
- Outcome
- Initia halted the network and connected app chains at 15:41 UTC. Bitquery’s October 23 snapshot traced the outflows to 1,135.5 ETH; this is a dated snapshot, not a claim about current wallet balances.
NEAR Intents
Failed deposit callbacks refunded tokens while retaining ledger credits, creating unbacked user balances. Valid bridge signers then paid withdrawals from other depositors’ reserves; this affected NEAR Intents rather than the NEAR base chain.
- Outcome
- NEAR Intents said funds were returned in full on October 2 and users made whole. A fix was deployed and the official post-mortem followed on October 16. Independent analysis distinguishes observed BTC returns from the project’s full-recovery statement.
Bitget
A third-party infrastructure compromise allowed unauthorized withdrawal instructions to reach Bitget’s wallet systems. Investigation established a zero-day in one security product; a second appliance was also involved, but two distinct zero-days were not confirmed.
- Outcome
- Bitget reported approximately $387.5M affected and said it would cover losses. Investigators reported no evidence of leaked wallet private keys; attribution remains source-dependent.
Liquid Network (Blockstream)
An Elements transaction-validation flaw allowed unbacked L-BTC to be created and redeemed against Liquid’s federation reserves. This was a sidechain validation failure, not an EVM smart-contract exploit.
- Outcome
- Reporting describes about 3,400 BTC returned after a patch, with 598.5 BTC remaining outstanding (around $47M at the report’s valuation). Recovered value is not subtracted from the gross incident estimate.
AFX Trade
A fake recruiter from a non-existent firm got an AFX Trade developer to clone a malicious repository on July 9; a hidden payload gave the attacker the developer's machine and, with it, the protocol's bridge keys.
- Outcome
- AFX offered a 30% bounty for a return. The reviewed reporting does not establish that most funds were recovered.
Ostium
Compromised off-chain price infrastructure supplied manipulated prices to the perpetuals platform, enabling trades at false valuations. The Arbitrum base chain itself was not compromised.
- Outcome
- Ostium paused affected activity and published a post-mortem describing the pricing-infrastructure failure.
Kelp DAO (rsETH)
A forged verification message in Kelp’s LayerZero integration released 116,500 rsETH, valued at approximately $292M. The incident exposed the integration’s verification configuration; it was not a blanket mint on every connected chain.
- Outcome
- Attributed to North Korea-linked actors. Funds laundered through mixers; largely unrecovered.
Drift Protocol
Attackers used social engineering and valid pre-signed Solana durable-nonce transactions to gain administrative control and drain funds. The recovery update revised outstanding user losses above the initial ~$285M estimate.
- Outcome
- Drift’s April 16 recovery update put outstanding user losses at approximately $295M. Recovery and reimbursement proposals are not the same as completed repayments.
Step Finance
Compromised executive devices led to unauthorized access to treasury wallets. Later reporting revised the incident from the initial ~$27M estimate to approximately $40M.
- Outcome
- Step reported approximately $4.7M recovered. This was a treasury-wallet incident, not a demonstrated user-contract exploit.
Balancer V2
A rounding-error bug in Balancer's composable stable pool math let crafted swaps extract value from the gap between internal accounting and real pool balances, across several chains at once.
- Outcome
- Vulnerable pools disabled; tens of millions recovered by white hats and distributed back to LPs.
Legacy entry — individual source not yet rechecked.
BtcTurk
Turkey's oldest exchange reported unusual hot-wallet outflows consistent with compromised private keys; cold-storage reserves were untouched.
- Outcome
- Deposits and withdrawals halted, wallets rotated. Binance froze part of the stolen funds.
Legacy entry — individual source not yet rechecked.
CoinDCX
A server-side breach gave an attacker access to CoinDCX's internal systems and its operational hot wallets.
- Outcome
- Exchange covered the loss from treasury; customer funds unaffected.
Legacy entry — individual source not yet rechecked.
GMX V1
A reentrancy-style flaw in a contract connected to the GLP liquidity pool let the attacker repeatedly withdraw more than their share.
- Outcome
- The exploiter returned the bulk of the funds in exchange for a bounty. GMX V1 was wound down.
Legacy entry — individual source not yet rechecked.
Nobitex
Iran's largest exchange had its hot wallets drained during the Israel–Iran conflict. The politically motivated attackers burned much of the loot to vanity addresses rather than cashing out.
- Outcome
- Service gradually restored; wallet infrastructure rotated. Funds not recoverable.
Legacy entry — individual source not yet rechecked.
Cork Protocol
A flaw in Cork's depeg-swap accounting allowed an attacker to extract wstETH from the protocol's pools.
- Outcome
- Cork paused affected contracts and published a post-mortem. Partial white-hat recovery was not established by the reviewed source.
Cetus
An overflow check flaw in Cetus's concentrated-liquidity math let an attacker mint near-worthless positions and drain roughly $223M of liquidity from the largest DEX on Sui.
- Outcome
- Sui validators froze ~$162M of the stolen funds; most was later returned to users.
Legacy entry — individual source not yet rechecked.
Infini
An overlooked developer privilege left in Infini's contracts was used to drain protocol-controlled stablecoin reserves.
- Outcome
- Operations paused; access controls rebuilt. Partial clawback discussions with white hats.
Legacy entry — individual source not yet rechecked.
Bybit
A compromised Safe{Wallet} developer environment delivered a malicious signing interface. Bybit’s signers approved a transaction that changed its cold-wallet implementation, enabling approximately $1.5B in assets to be drained.
- Outcome
- Bybit covered user losses from its treasury. FBI attributed to TraderTraitor / Lazarus.
Phemex
Attackers drained BTC, ETH and stablecoins from Phemex hot wallets in rapid succession, in an incident security firms linked to North Korean groups.
- Outcome
- Exchange covered user balances and rebuilt key management. Stolen funds routed through mixers.
Legacy entry — individual source not yet rechecked.
WazirX
Attackers (linked to Lazarus Group) compromised WazirX's Liminal multi-sig and drained the exchange's hot wallet.
- Outcome
- Exchange paused withdrawals; restructuring scheme proposed to repay users.
Legacy entry — individual source not yet rechecked.
DMM Bitcoin
Japanese exchange DMM Bitcoin lost 4,502.9 BTC in an unauthorized withdrawal later attributed to North Korean actors.
- Outcome
- DMM borrowed funds to make customers whole, then wound down the exchange in late 2024.
Legacy entry — individual source not yet rechecked.
HTX / Heco Bridge
HTX (formerly Huobi) and the Heco cross-chain bridge were drained in coordinated exploits affecting hot wallets and bridge contracts.
- Outcome
- HTX pledged user reimbursement. Bridge paused.
Legacy entry — individual source not yet rechecked.
Poloniex
Justin Sun-owned Poloniex saw its hot wallets drained across Ethereum, Tron and Bitcoin networks after a private-key compromise.
- Outcome
- Sun committed to full reimbursement; partial on-chain recovery via bounty offer.
Legacy entry — individual source not yet rechecked.
Mixin Network
A cloud-service provider used by Mixin was breached, exposing keys to the network's main deposit/withdrawal wallet.
- Outcome
- Mixin offered partial repayment via tokenized debt; service paused.
Legacy entry — individual source not yet rechecked.
Curve Finance
A Vyper compiler bug broke the reentrancy locks in several Curve stablepools (alETH, msETH, pETH, CRV/ETH), enabling reentrancy drains.
- Outcome
- White-hats recovered ~73% of funds. Vyper patched; Curve compensated remaining LPs.
Legacy entry — individual source not yet rechecked.
Euler Finance
A missing health check in the donateToReserves function allowed the attacker to push accounts into a self-liquidatable state and drain lending pools.
- Outcome
- After negotiations the attacker returned essentially all funds — among the largest white-hat-style returns ever.
Legacy entry — individual source not yet rechecked.
BonqDAO
The attacker manipulated the Tellor oracle price feed for AllianceBlock's ALBT token to mint BEUR stablecoin against worthless collateral.
- Outcome
- Most stolen tokens proved illiquid; protocol effectively wound down.
Legacy entry — individual source not yet rechecked.
Mango Markets
Avraham Eisenberg pumped the MNGO perp price on thin spot liquidity, used the inflated collateral to borrow out the treasury.
- Outcome
- Eisenberg was convicted in 2024, but that verdict was vacated in May 2025. Do not read the earlier conviction as a final, currently standing outcome.
BNB Chain Token Hub Bridge
Attacker forged a fake Merkle proof in the Token Hub bridge and minted 2M BNB. Validators halted the chain mid-attack.
- Outcome
- BNB Chain stopped block production; ~$430M frozen. Net stolen ~$100–140M.
Legacy entry — individual source not yet rechecked.
Nomad Bridge
A misconfigured initialization let any address spoof valid messages. Once one wallet started draining, hundreds copy-pasted the exploit calldata — the first 'free-for-all' bridge hack.
- Outcome
- Nomad recovered ~20% from white-hats; bridge effectively defunct.
Legacy entry — individual source not yet rechecked.
Harmony Horizon Bridge
Lazarus Group compromised two of five multi-sig signers (held with insufficient separation) and drained the bridge.
- Outcome
- Attributed to North Korea by the FBI. Funds laundered via Tornado Cash.
Legacy entry — individual source not yet rechecked.
Beanstalk Farms
Attacker took a flash loan to obtain a supermajority of governance stalk and instantly executed a malicious proposal that sent the treasury to themselves.
- Outcome
- Protocol redeployed months later via community-funded restart.
Legacy entry — individual source not yet rechecked.
Ronin Bridge (Axie Infinity)
Lazarus Group socially engineered a Sky Mavis engineer via a fake LinkedIn job offer, compromising 5 of 9 bridge validator keys and draining 173,600 ETH + 25.5M USDC.
- Outcome
- Sky Mavis and Binance reimbursed users; OFAC sanctioned the laundering addresses.
Legacy entry — individual source not yet rechecked.
Wormhole Bridge
Attacker forged signatures via a flawed signature-verification routine and minted 120K wETH on Solana without backing.
- Outcome
- Jump Crypto refilled the bridge from its own funds within 24 hours.
Legacy entry — individual source not yet rechecked.
BitMart
Hot-wallet private keys for BitMart's Ethereum and BNB Chain wallets were stolen and drained.
- Outcome
- BitMart pledged to use its own funds to reimburse affected users.
Legacy entry — individual source not yet rechecked.
Poly Network
Attacker exploited a privileged cross-chain function (EthCrossChainManager) to mint and withdraw assets across Ethereum, BSC and Polygon.
- Outcome
- Attacker ("Mr White Hat") returned virtually all funds within two weeks.
Legacy entry — individual source not yet rechecked.
PancakeBunny
Flash-loan attack manipulated the BUNNY/BNB pool, minting ~7M BUNNY and crashing the token from $146 to near zero.
- Outcome
- Token never recovered; compensation plan via vBUNNY released later.
Legacy entry — individual source not yet rechecked.
Uranium Finance
A migration to v2.1 contained an off-by-one math error in the swap fee logic, letting the attacker drain pool reserves in a single swap.
- Outcome
- Protocol shut down. Funds laundered via Tornado Cash.
Legacy entry — individual source not yet rechecked.
bZx
Two back-to-back attacks pioneered the 'DeFi flash loan' playbook by manipulating oracle prices using uncollateralized loans from dYdX.
- Outcome
- First widely cited proof that flash loans break naive on-chain oracle designs. Catalyst for TWAP/Chainlink adoption.
Legacy entry — individual source not yet rechecked.
Coincheck
Coincheck's NEM hot wallet was drained of 523M XEM after attackers planted malware via spear-phishing on employee machines.
- Outcome
- Coincheck reimbursed users from its own funds; later acquired by Monex Group. Catalyzed FSA regulation in Japan.
Legacy entry — individual source not yet rechecked.
The DAO
A reentrancy bug in the split-DAO function let the attacker recursively drain 3.6M ETH from the largest crowdfunded smart contract.
- Outcome
- Ethereum hard-forked to reverse the theft, creating Ethereum Classic. Reshaped smart-contract security forever.
Legacy entry — individual source not yet rechecked.
What 10 years of hacks tell us
- Bridges and centralized custodians dominate the losses. Ronin, Poly, Wormhole, Nomad, BNB Chain, Bybit, Coincheck — the largest single events have all been custody or cross-chain trust failures, not pure smart-contract bugs.
- North Korea (Lazarus / TraderTraitor) is the single biggest threat actor. Ronin, Harmony, DMM Bitcoin, WazirX and Bybit alone account for over $2.5B attributed to DPRK-linked groups.
- Hardware wallets reduce key exposure, not contract risk. Keeping funds out of custodial wallets reduces exchange exposure. Assets deposited in bridges or DeFi contracts still face protocol risk, and malicious approvals can drain a wallet even when a hardware device signs them.
- DeFi has matured but new vectors keep appearing. From reentrancy (The DAO) to flash loans (bZx) to compiler bugs (Curve/Vyper) to signer phishing (Bybit) — the attack surface evolves faster than audits cover.
Move funds off exchanges
Our hardware wallet comparison ranks devices by Secure Element design, air-gap, open-source status and supply-chain practices.
See the full comparison →Gross reported impact sums this selected archive’s incident estimates, before freezes, recoveries or reimbursements. Some historical figures include minted or market-value impact rather than realized theft, so the total is not a net-loss statistic. New and rechecked entries link to sources; legacy entries remain marked where not rechecked.