A laptop and a chain of glowing blocks over a night view of Earth

Money, plainly

The biggest crypto hacks in history

From Mt. Gox to Binance: who lost what, how, and who took it.

On October 29, 2026, about $6.3 billion left Binance, roughly four times the Bybit record of 2025. This timeline lists the major thefts from crypto exchanges and bridges since 2011, each with its date, amount, method, attribution and aftermath.

16 heists · 43 sources · amounts in US dollars at the time, as reported

Ranked by dollars taken

1Binance · 2026$6.3B
2Bybit · 2025$1.5B
3Ronin Network (Axie Infinity) · 2022$625M
4Poly Network · 2021$611M
5BNB Chain Token Hub (Binance) · 2022$570Mminted
6Coincheck · 2018$530M
7FTX · 2022$477M
8Mt. Gox · 2014$473M
9Bitget · 2026$388M
10Wormhole · 2022$320M
11DMM Bitcoin · 2024$308M
12KelpDAO · 2026$292M
13KuCoin · 2020$281M
14WazirX · 2024$235M
15Harmony Horizon Bridge · 2022$100M
16Bitfinex · 2016$72M

Dollar values at the time of each theft. The early losses rank low because a bitcoin was worth far less in 2014 and 2016.

The timeline

September 2011 to February 2014 · Exchange
Mt. Gox
About $473 million at the 2014 filing
About 850,000 BTC reported missing; 199,999.99 BTC later found
How
Prosecutors say intruders used unauthorized access to the exchange's server to move bitcoin out of its wallets from September 2011 until at least May 2014. The loss came to light when the exchange stopped withdrawals in February 2014.
Attribution
In 2023 the US Justice Department charged two Russian nationals, Alexey Bilyuchenko and Aleksandr Verner, with laundering about 647,000 of the stolen bitcoin. Alexander Vinnik of the BTC-e exchange was indicted in 2017 over the same flows.
What happened after
Mt. Gox filed for civil rehabilitation in Tokyo on February 28, 2014. Weeks later it reported finding 199,999.99 BTC in an old wallet, cutting the loss to about 650,000 BTC. Chief executive Mark Karpelès was convicted in 2019 of falsifying records and received a suspended sentence. The trustee has extended the creditor repayment deadline several times, most recently in October 2025.
Sources: [1], [2], [3]
August 2016 · Exchange
Bitfinex
About $72 million at the time
119,754 BTC
How
The attacker authorized more than 2,000 transactions that moved bitcoin out of customers' multisignature wallets, run with the custody firm BitGo, into a wallet he controlled.
Attribution
Ilya Lichtenstein, a US citizen, admitted to the hack and was sentenced to five years in prison in November 2024. His wife, Heather Morgan, received 18 months for helping launder the funds.
What happened after
Bitfinex reduced every customer balance by 36% and issued BFX tokens against the loss. In 2022 federal agents seized about 94,000 of the stolen bitcoin, then worth $3.6 billion, after decrypting a file of private keys.
Sources: [4], [5]
January 26, 2018 · Exchange
Coincheck
About $530 million (¥58 billion)
523 million NEM
How
The NEM sat in an internet-connected hot wallet without the multisignature protection the NEM network supported. One compromise emptied it.
Attribution
No government has named the thief. Japanese prosecutors later charged people who traded the stolen NEM.
What happened after
Japan's Financial Services Agency issued a business improvement order and raided the firm, the first such raid in Japan. Coincheck repaid about 260,000 customers in yen from its own funds, about ¥46.3 billion. Monex Group bought the exchange in April 2018.
Sources: [6], [7], [8]
September 26, 2020 · Exchange
KuCoin
About $281 million
How
Attackers drained the exchange's hot wallets on Bitcoin, Ethereum and other networks.
Attribution
Chainalysis linked the laundering pattern to North Korea's Lazarus Group. A UN panel report counted the theft among North Korean hacks without naming the exchange.
What happened after
KuCoin recovered about 84% of the assets through on-chain tracing, token contract upgrades and court action, and covered the remainder from its insurance fund.
Sources: [9], [10], [11]
August 10, 2021 · Bridge
Poly Network
About $611 million
How
An attacker exploited a flaw in the protocol's cross-chain contract functions to redirect assets on Ethereum, BNB Smart Chain and Polygon.
Attribution
None. The attacker, whom Poly called "Mr. White Hat," said the attack was done "for fun."
What happened after
The attacker returned nearly all of the funds within days and declined a $500,000 bounty. Tether froze about $33 million in USDT and reissued it to Poly Network.
Sources: [12]
February 2, 2022 · Bridge
Wormhole
About $320 million
120,000 wrapped ETH
How
The attacker bypassed signature verification on the Solana side of the bridge and minted 120,000 wrapped ether with no ether deposited behind it.
Attribution
No official attribution.
What happened after
Jump Crypto, the parent of Wormhole's developer, deposited 120,000 ETH the next day to restore the backing. In February 2023, Jump and Oasis recovered about $140 million from the attacker's vaults, Blockworks reported.
Sources: [13], [14]
March 23, 2022 (found March 29) · Bridge
Ronin Network (Axie Infinity)
About $625 million
173,600 ETH and 25.5 million USDC
How
Withdrawals needed five of nine validator signatures. A Sky Mavis engineer opened a fake job offer carrying spyware, which gave the attackers four Sky Mavis keys; a permission left in place supplied the fifth, from the Axie DAO validator.
Attribution
On April 14, 2022, the FBI attributed the theft to North Korea's Lazarus Group and APT38. Treasury's Office of Foreign Assets Control added the receiving Ethereum address to its sanctions list.
What happened after
Sky Mavis raised $150 million in a round led by Binance and, with its own funds, reimbursed users. The bridge reopened on June 28, 2022.
Sources: [15], [16], [17]
June 23, 2022 · Bridge
Harmony Horizon Bridge
About $100 million
How
Withdrawals from the bridge's Ethereum side needed two signatures from a small multisignature group. The attacker obtained and decrypted enough private keys to sign.
Attribution
On January 23, 2023, the FBI attributed the theft to Lazarus Group and APT38 and tied it to the TraderTraitor campaign.
What happened after
The FBI reported that more than $60 million was laundered through the Railgun privacy protocol in January 2023. Harmony offered a $1 million bounty for the return of funds.
Sources: [18], [19]
October 6, 2022 · Bridge
BNB Chain Token Hub (Binance)
About $570 million minted; about $100 million moved out
2 million BNB
How
A bug in the BSC Token Hub, the bridge between BNB Beacon Chain and BNB Smart Chain, let the attacker forge proofs and mint 2 million new BNB to itself.
Attribution
No official attribution.
What happened after
Validators halted BNB Smart Chain for several hours, which stranded most of the minted BNB. The attacker had already bridged out roughly $100 million to $110 million; about $7 million was frozen.
Sources: [20], [21]
November 11–12, 2022 · Exchange
FTX
About $477 million
How
Hours after FTX filed for bankruptcy, assets drained from its wallets. A 2024 federal indictment describes a SIM swap of an employee's phone account that gave the thieves access to more than $400 million.
Attribution
In January 2024 a grand jury indicted Robert Powell, Carter Rohn and Emily Hernandez. The indictment names a "Victim Company-1"; Elliptic and press reports identify it as FTX.
What happened after
The theft struck while FTX was entering bankruptcy, so the loss fell on the bankrupt estate and its creditors.
Sources: [22], [23]
May 31, 2024 · Exchange
DMM Bitcoin
About $308 million
4,502.9 BTC
How
An operative posing as a LinkedIn recruiter compromised an employee of Ginco, DMM's wallet software vendor, then used stolen session cookies to manipulate a legitimate DMM transaction.
Attribution
In December 2024 the FBI, the Defense Department Cyber Crime Center and Japan's National Police Agency attributed the theft to North Korea's TraderTraitor.
What happened after
DMM Bitcoin pledged to reimburse customers, then chose to close. Its customer accounts and assets were scheduled to move to SBI VC Trade in March 2025.
Sources: [24], [25]
July 18, 2024 · Exchange
WazirX
About $235 million
How
Attackers took control of a multisignature Ethereum wallet with six signers, five held by WazirX and one by its custody provider, Liminal.
Attribution
The United States, Japan and South Korea linked the theft to North Korea in a joint statement on January 14, 2025.
What happened after
WazirX suspended trading and restructured under a Singapore court process. Creditors approved a revised plan, and trading resumed on October 24, 2025.
Sources: [26], [27], [28]
February 21, 2025 · Exchange
Bybit
About $1.5 billion
About 401,000 ETH
How
Attackers compromised a developer's machine at Safe{Wallet}, Bybit's multisignature wallet provider, and planted code in its interface. Bybit's signers approved what looked like a routine transfer and handed control of the wallet to the attackers.
Attribution
On February 26, 2025, the FBI attributed the theft to North Korea and named the activity TraderTraitor.
What happened after
Bybit stayed open and covered the loss with bridge loans and reserves, including 40,000 ETH borrowed from Bitget and since repaid. The FBI published the attacker addresses and asked exchanges and node operators to block them.
Sources: [29], [30]
April 18, 2026 · Bridge
KelpDAO
About $292 million
116,500 rsETH
How
Kelp's LayerZero bridge relied on a single verifier. The attacker took over two RPC nodes that fed it data, knocked the others offline, and passed the verifier a forged message that released rsETH.
Attribution
Analysts, including Halborn, attribute it to North Korea's Lazarus Group. No government attribution had been published when this entry was written.
What happened after
The attacker posted the rsETH as loan collateral. Aave, SparkLend and Fluid froze their rsETH markets, and more than $13 billion left lending platforms within two days.
Sources: [31], [32]
September 24, 2026 · Exchange
Bitget
About $387.5 million
How
Attackers breached a backend system in Bitget's wallet infrastructure and spoofed transaction data, which led the exchange's own authorization process to release funds from hot and warm wallets. Cold wallets were unaffected.
Attribution
Chainalysis attributed it to North Korea-linked actors, and Bitget's chief executive said the patterns matched. No government attribution had been published when this entry was written.
What happened after
Bitget pledged to cover losses from its User Protection Fund, offered a 5% bounty for frozen or recovered funds, and restarted withdrawals in phases.
Sources: [33], [34]
October 29, 2026 · Exchange
Binance
Developing; figures as reported Oct 30, 2026
About $6.3 billion affected, per Binance; $6.36 billion, per TRM Labs
Ten blockchains; one Ethereum sweep moved 167,464 ETH and 1.615 billion USDT
How
Binance's first look points to a compromised DevOps engineer's laptop that gave the attacker a service container able to submit withdrawals; Binance reports no evidence that wallet private keys leaked. TRM Labs points to the hot-wallet signing infrastructure. Hours earlier the attacker tested its code on its own Ethereum accounts, moving a couple of dollars at a time. The theft ran through 50 pre-signed EIP-7702 authorizations, so every transfer carried a valid signature. Most of it took about 20 minutes from 20:05 UTC, and as the hot wallets were drained, fresh exchange funds kept arriving in them and were swept too.
Attribution
TRM Labs attributes it, with high confidence, to North Korea's TraderTraitor, the unit the FBI named for Bybit. CNN reports that Chainalysis reached the same conclusion. On October 31 the FBI formally attributed the theft to TraderTraitor. Binance says it is working with law enforcement.
What happened after
Binance paused withdrawals and says it will cover all losses from its SAFU fund and company funds. Tether froze more than 1.5 billion USDT and Circle about 800 million USDC; Binance put the total frozen with partners at about $3 billion. TRM counted more than 420,000 ETH and 18,270 BTC still in the attacker's hands, beyond any issuer's reach. Ripple froze 40.5 million RLUSD, and Arbitrum's Security Council moved 8,426 ETH out of the attacker's reach. On October 31 Binance said it had already replaced about 90% of the stolen funds by buying tokens with company money, and set withdrawals to restart November 1.
Sources: [35], [41], [42], [43], [36], [37], [38], [39], [40]

The pattern

Granaries, temple treasuries and bank vaults each gathered wealth behind a door a few people could open. Exchanges and bridges repeat the arrangement in code: a large store, a small set of keyholders, and an adversary who studies the keyholders.

Custody concentrates keys: An exchange holds the keys for millions of customers, and whoever controls its signing process controls their coins. Mt. Gox, Coincheck, KuCoin, DMM Bitcoin, Bybit, Bitget and Binance each lost funds held for customers.
Hot wallets trade safety for speed: Exchanges keep a working balance online so withdrawals clear in minutes. Coincheck held its NEM in a hot wallet without multisignature protection. KuCoin, Bitget and Binance lost hot-wallet balances.
Bridges are a lock with a few keys: A bridge locks coins on one chain and issues a claim on another. When the lock opens to a forged message or a handful of keys, the backing is gone. Ronin needed five of nine signatures; Harmony needed two. Poly Network, Wormhole, BNB Chain's Token Hub and KelpDAO failed at the message check.
The entry point is a person: A fake job offer opened Ronin. A fake recruiter opened DMM Bitcoin's wallet vendor. Malware on a developer's machine opened Safe{Wallet}, and Bybit with it. A SIM swap is charged in the FTX theft. Binance's first look points to an engineer's laptop.
The North Korea thread: US authorities have attributed Ronin and Harmony (2022), DMM Bitcoin and WazirX (2024), and Bybit (2025) to North Korean state hackers. The FBI calls the unit behind DMM Bitcoin and Bybit TraderTraitor, and TRM Labs assigns Binance to the same unit. The US and allied governments say the proceeds fund North Korea's weapons programs.

What can be frozen and what can't

Issuer stablecoins: freezable: USDT and USDC are tokens issued by companies, Tether and Circle, whose contracts let the issuer freeze an address. In the Binance theft, Tether froze more than 1.5 billion USDT and Circle about 800 million USDC within hours. Tether froze about $33 million in the Poly Network case in 2021.
Native coins: no issuer to call: Bitcoin and ether have no issuer and no freeze function on their ledgers. Stolen coins stop when they reach an exchange that freezes the deposit, or when investigators obtain the keys, as US agents did with about 94,000 Bitfinex bitcoin in 2022. In the Binance theft, more than 420,000 ETH and 18,270 BTC stayed beyond any issuer's reach.
Governed networks: emergency powers: Some networks give a council or validator set the power to act. Arbitrum's Security Council froze about 8,426 ETH and 74.6 million ARB tied to the Binance theft. BNB Chain's validators halted the whole chain in 2022 to contain the Token Hub exploit.
The tradeoff: A freeze that recovers stolen funds can reach any holder of the same token. Holders of issuer stablecoins accept that power along with the token; holders of native coins accept that a theft is usually final.

Read the market like an institution

A free 5-day email series: rates, oil, the dollar, liquidity, and how to grade anyone's calls. One short email a day, each with a free live screen.

Free. Data and tools for your own research, never investment advice. Stop the series in one click.

Watch the short films:Instagram YouTube

See what the five days cover

Money, plainlyWhere money comes from →ExhibitCrypto's hidden origins →

Sources

Education only, not financial advice. Dollar figures are as reported at the time of each theft; where sources differ, the entry gives the figure from the named source. Attributions are labeled by who made them: a government agency, a blockchain analytics firm, or the victim. The Binance entry is developing and will be updated as Binance publishes its post-mortem.

The biggest crypto hacks in history

From Mt. Gox to Binance: who lost what, how, and who took it.

16 heists · 43 sources · amounts in US dollars at the time, as reported

The timeline

September 2011 to February 2014 · Exchange

Mt. Gox

About $473 million at the 2014 filing

About 850,000 BTC reported missing; 199,999.99 BTC later found

How: Prosecutors say intruders used unauthorized access to the exchange's server to move bitcoin out of its wallets from September 2011 until at least May 2014. The loss came to light when the exchange stopped withdrawals in February 2014.
Attribution: In 2023 the US Justice Department charged two Russian nationals, Alexey Bilyuchenko and Aleksandr Verner, with laundering about 647,000 of the stolen bitcoin. Alexander Vinnik of the BTC-e exchange was indicted in 2017 over the same flows.
What happened after: Mt. Gox filed for civil rehabilitation in Tokyo on February 28, 2014. Weeks later it reported finding 199,999.99 BTC in an old wallet, cutting the loss to about 650,000 BTC. Chief executive Mark Karpelès was convicted in 2019 of falsifying records and received a suspended sentence. The trustee has extended the creditor repayment deadline several times, most recently in October 2025.

Sources: [1], [2], [3]

August 2016 · Exchange

Bitfinex

About $72 million at the time

119,754 BTC

How: The attacker authorized more than 2,000 transactions that moved bitcoin out of customers' multisignature wallets, run with the custody firm BitGo, into a wallet he controlled.
Attribution: Ilya Lichtenstein, a US citizen, admitted to the hack and was sentenced to five years in prison in November 2024. His wife, Heather Morgan, received 18 months for helping launder the funds.
What happened after: Bitfinex reduced every customer balance by 36% and issued BFX tokens against the loss. In 2022 federal agents seized about 94,000 of the stolen bitcoin, then worth $3.6 billion, after decrypting a file of private keys.

Sources: [4], [5]

January 26, 2018 · Exchange

Coincheck

About $530 million (¥58 billion)

523 million NEM

How: The NEM sat in an internet-connected hot wallet without the multisignature protection the NEM network supported. One compromise emptied it.
Attribution: No government has named the thief. Japanese prosecutors later charged people who traded the stolen NEM.
What happened after: Japan's Financial Services Agency issued a business improvement order and raided the firm, the first such raid in Japan. Coincheck repaid about 260,000 customers in yen from its own funds, about ¥46.3 billion. Monex Group bought the exchange in April 2018.

Sources: [6], [7], [8]

September 26, 2020 · Exchange

KuCoin

About $281 million

How: Attackers drained the exchange's hot wallets on Bitcoin, Ethereum and other networks.
Attribution: Chainalysis linked the laundering pattern to North Korea's Lazarus Group. A UN panel report counted the theft among North Korean hacks without naming the exchange.
What happened after: KuCoin recovered about 84% of the assets through on-chain tracing, token contract upgrades and court action, and covered the remainder from its insurance fund.

Sources: [9], [10], [11]

August 10, 2021 · Bridge

Poly Network

About $611 million

How: An attacker exploited a flaw in the protocol's cross-chain contract functions to redirect assets on Ethereum, BNB Smart Chain and Polygon.
Attribution: None. The attacker, whom Poly called "Mr. White Hat," said the attack was done "for fun."
What happened after: The attacker returned nearly all of the funds within days and declined a $500,000 bounty. Tether froze about $33 million in USDT and reissued it to Poly Network.

Sources: [12]

February 2, 2022 · Bridge

Wormhole

About $320 million

120,000 wrapped ETH

How: The attacker bypassed signature verification on the Solana side of the bridge and minted 120,000 wrapped ether with no ether deposited behind it.
Attribution: No official attribution.
What happened after: Jump Crypto, the parent of Wormhole's developer, deposited 120,000 ETH the next day to restore the backing. In February 2023, Jump and Oasis recovered about $140 million from the attacker's vaults, Blockworks reported.

Sources: [13], [14]

March 23, 2022 (found March 29) · Bridge

Ronin Network (Axie Infinity)

About $625 million

173,600 ETH and 25.5 million USDC

How: Withdrawals needed five of nine validator signatures. A Sky Mavis engineer opened a fake job offer carrying spyware, which gave the attackers four Sky Mavis keys; a permission left in place supplied the fifth, from the Axie DAO validator.
Attribution: On April 14, 2022, the FBI attributed the theft to North Korea's Lazarus Group and APT38. Treasury's Office of Foreign Assets Control added the receiving Ethereum address to its sanctions list.
What happened after: Sky Mavis raised $150 million in a round led by Binance and, with its own funds, reimbursed users. The bridge reopened on June 28, 2022.

Sources: [15], [16], [17]

June 23, 2022 · Bridge

Harmony Horizon Bridge

About $100 million

How: Withdrawals from the bridge's Ethereum side needed two signatures from a small multisignature group. The attacker obtained and decrypted enough private keys to sign.
Attribution: On January 23, 2023, the FBI attributed the theft to Lazarus Group and APT38 and tied it to the TraderTraitor campaign.
What happened after: The FBI reported that more than $60 million was laundered through the Railgun privacy protocol in January 2023. Harmony offered a $1 million bounty for the return of funds.

Sources: [18], [19]

October 6, 2022 · Bridge

BNB Chain Token Hub (Binance)

About $570 million minted; about $100 million moved out

2 million BNB

How: A bug in the BSC Token Hub, the bridge between BNB Beacon Chain and BNB Smart Chain, let the attacker forge proofs and mint 2 million new BNB to itself.
Attribution: No official attribution.
What happened after: Validators halted BNB Smart Chain for several hours, which stranded most of the minted BNB. The attacker had already bridged out roughly $100 million to $110 million; about $7 million was frozen.

Sources: [20], [21]

November 11–12, 2022 · Exchange

FTX

About $477 million

How: Hours after FTX filed for bankruptcy, assets drained from its wallets. A 2024 federal indictment describes a SIM swap of an employee's phone account that gave the thieves access to more than $400 million.
Attribution: In January 2024 a grand jury indicted Robert Powell, Carter Rohn and Emily Hernandez. The indictment names a "Victim Company-1"; Elliptic and press reports identify it as FTX.
What happened after: The theft struck while FTX was entering bankruptcy, so the loss fell on the bankrupt estate and its creditors.

Sources: [22], [23]

May 31, 2024 · Exchange

DMM Bitcoin

About $308 million

4,502.9 BTC

How: An operative posing as a LinkedIn recruiter compromised an employee of Ginco, DMM's wallet software vendor, then used stolen session cookies to manipulate a legitimate DMM transaction.
Attribution: In December 2024 the FBI, the Defense Department Cyber Crime Center and Japan's National Police Agency attributed the theft to North Korea's TraderTraitor.
What happened after: DMM Bitcoin pledged to reimburse customers, then chose to close. Its customer accounts and assets were scheduled to move to SBI VC Trade in March 2025.

Sources: [24], [25]

July 18, 2024 · Exchange

WazirX

About $235 million

How: Attackers took control of a multisignature Ethereum wallet with six signers, five held by WazirX and one by its custody provider, Liminal.
Attribution: The United States, Japan and South Korea linked the theft to North Korea in a joint statement on January 14, 2025.
What happened after: WazirX suspended trading and restructured under a Singapore court process. Creditors approved a revised plan, and trading resumed on October 24, 2025.

Sources: [26], [27], [28]

February 21, 2025 · Exchange

Bybit

About $1.5 billion

About 401,000 ETH

How: Attackers compromised a developer's machine at Safe{Wallet}, Bybit's multisignature wallet provider, and planted code in its interface. Bybit's signers approved what looked like a routine transfer and handed control of the wallet to the attackers.
Attribution: On February 26, 2025, the FBI attributed the theft to North Korea and named the activity TraderTraitor.
What happened after: Bybit stayed open and covered the loss with bridge loans and reserves, including 40,000 ETH borrowed from Bitget and since repaid. The FBI published the attacker addresses and asked exchanges and node operators to block them.

Sources: [29], [30]

April 18, 2026 · Bridge

KelpDAO

About $292 million

116,500 rsETH

How: Kelp's LayerZero bridge relied on a single verifier. The attacker took over two RPC nodes that fed it data, knocked the others offline, and passed the verifier a forged message that released rsETH.
Attribution: Analysts, including Halborn, attribute it to North Korea's Lazarus Group. No government attribution had been published when this entry was written.
What happened after: The attacker posted the rsETH as loan collateral. Aave, SparkLend and Fluid froze their rsETH markets, and more than $13 billion left lending platforms within two days.

Sources: [31], [32]

September 24, 2026 · Exchange

Bitget

About $387.5 million

How: Attackers breached a backend system in Bitget's wallet infrastructure and spoofed transaction data, which led the exchange's own authorization process to release funds from hot and warm wallets. Cold wallets were unaffected.
Attribution: Chainalysis attributed it to North Korea-linked actors, and Bitget's chief executive said the patterns matched. No government attribution had been published when this entry was written.
What happened after: Bitget pledged to cover losses from its User Protection Fund, offered a 5% bounty for frozen or recovered funds, and restarted withdrawals in phases.

Sources: [33], [34]

October 29, 2026 · Exchange

Binance

Developing; figures as reported Oct 30, 2026

About $6.3 billion affected, per Binance; $6.36 billion, per TRM Labs

Ten blockchains; one Ethereum sweep moved 167,464 ETH and 1.615 billion USDT

How: Binance's first look points to a compromised DevOps engineer's laptop that gave the attacker a service container able to submit withdrawals; Binance reports no evidence that wallet private keys leaked. TRM Labs points to the hot-wallet signing infrastructure. Hours earlier the attacker tested its code on its own Ethereum accounts, moving a couple of dollars at a time. The theft ran through 50 pre-signed EIP-7702 authorizations, so every transfer carried a valid signature. Most of it took about 20 minutes from 20:05 UTC, and as the hot wallets were drained, fresh exchange funds kept arriving in them and were swept too.
Attribution: TRM Labs attributes it, with high confidence, to North Korea's TraderTraitor, the unit the FBI named for Bybit. CNN reports that Chainalysis reached the same conclusion. On October 31 the FBI formally attributed the theft to TraderTraitor. Binance says it is working with law enforcement.
What happened after: Binance paused withdrawals and says it will cover all losses from its SAFU fund and company funds. Tether froze more than 1.5 billion USDT and Circle about 800 million USDC; Binance put the total frozen with partners at about $3 billion. TRM counted more than 420,000 ETH and 18,270 BTC still in the attacker's hands, beyond any issuer's reach. Ripple froze 40.5 million RLUSD, and Arbitrum's Security Council moved 8,426 ETH out of the attacker's reach. On October 31 Binance said it had already replaced about 90% of the stolen funds by buying tokens with company money, and set withdrawals to restart November 1.

Sources: [35], [41], [42], [43], [36], [37], [38], [39], [40]

The pattern

Custody concentrates keys

An exchange holds the keys for millions of customers, and whoever controls its signing process controls their coins. Mt. Gox, Coincheck, KuCoin, DMM Bitcoin, Bybit, Bitget and Binance each lost funds held for customers.

Hot wallets trade safety for speed

Exchanges keep a working balance online so withdrawals clear in minutes. Coincheck held its NEM in a hot wallet without multisignature protection. KuCoin, Bitget and Binance lost hot-wallet balances.

Bridges are a lock with a few keys

A bridge locks coins on one chain and issues a claim on another. When the lock opens to a forged message or a handful of keys, the backing is gone. Ronin needed five of nine signatures; Harmony needed two. Poly Network, Wormhole, BNB Chain's Token Hub and KelpDAO failed at the message check.

The entry point is a person

A fake job offer opened Ronin. A fake recruiter opened DMM Bitcoin's wallet vendor. Malware on a developer's machine opened Safe{Wallet}, and Bybit with it. A SIM swap is charged in the FTX theft. Binance's first look points to an engineer's laptop.

The North Korea thread

US authorities have attributed Ronin and Harmony (2022), DMM Bitcoin and WazirX (2024), and Bybit (2025) to North Korean state hackers. The FBI calls the unit behind DMM Bitcoin and Bybit TraderTraitor, and TRM Labs assigns Binance to the same unit. The US and allied governments say the proceeds fund North Korea's weapons programs.

What can be frozen and what can't

Issuer stablecoins: freezable

USDT and USDC are tokens issued by companies, Tether and Circle, whose contracts let the issuer freeze an address. In the Binance theft, Tether froze more than 1.5 billion USDT and Circle about 800 million USDC within hours. Tether froze about $33 million in the Poly Network case in 2021.

Native coins: no issuer to call

Bitcoin and ether have no issuer and no freeze function on their ledgers. Stolen coins stop when they reach an exchange that freezes the deposit, or when investigators obtain the keys, as US agents did with about 94,000 Bitfinex bitcoin in 2022. In the Binance theft, more than 420,000 ETH and 18,270 BTC stayed beyond any issuer's reach.

Governed networks: emergency powers

Some networks give a council or validator set the power to act. Arbitrum's Security Council froze about 8,426 ETH and 74.6 million ARB tied to the Binance theft. BNB Chain's validators halted the whole chain in 2022 to contain the Token Hub exploit.

The tradeoff

A freeze that recovers stolen funds can reach any holder of the same token. Holders of issuer stablecoins accept that power along with the token; holders of native coins accept that a theft is usually final.

Read the market like an institution

A free 5-day email series: rates, oil, the dollar, liquidity, and how to grade anyone's calls. One short email a day, each with a free live screen.

Free. Data and tools for your own research, never investment advice. Stop the series in one click.