Documented crypto incidents, 2015–2025

A supply chain attack on Safe{Wallet} compromised 401,000 ETH —the largest single crypto theft recorded.

A second 2024 attack: North Korea-linked malware compromised developer devices, so malicious transactions were signed behind a benign-looking interface — $51 million lost.

A hot wallet breach impacted the Singapore-based exchange, resulting in $43 million stolen.

A private key leak led to a $290 million loss from the South Korean NFT platform.

India’s largest exchange lost $234.9 million due to a multisig wallet exploit.

Japan’s DMM Bitcoin lost 4,502.9 BTC (~$305 million) in a theft later attributed to North Korea.

A flaw in the BSC Token Hub allowed hackers to mint 2 million BNB ($570M).

North Korea's Lazarus Group exploited validator nodes to steal $625 million from the Axie Infinity network.

A $611 million exploit via a smart contract bug. The hacker returned most of the funds after public negotiations.

A hot wallet breach resulted in $534 million in NEM being stolen, linked to North Korea.

Hackers stole 4,700 BTC (~$70M) by breaching NiceHash’s payment system and hot wallet.

A user-triggered bug froze 513,774 ETH (~$150M). Not stolen, but permanently inaccessible.

Over 5,500 accounts were breached, with $100 million in losses attributed to North Korea’s Lazarus Group.

Three Justin Sun-linked projects lost over $200 million collectively, likely due to private key breaches.

A flash loan exploit drained $197 million from Euler Finance, later mostly recovered.

Hackers exploited a cloud service provider’s database, stealing $200 million from Mixin Network.

A smart contract flaw enabled minting of 120,000 unbacked wETH, resulting in a $325 million loss.

Following FTX’s bankruptcy, $477 million was stolen in unauthorized withdrawals—suspected insider or external exploit.

Private keys were leaked, leading to a $285 million theft. Most funds were recovered through cooperation with exchanges.

Hackers used phishing and API vulnerabilities to steal $40 million in BTC. Losses were covered by Binance's SAFU fund.

New Zealand exchange Cryptopia lost $16 million. A second breach later pushed the company into liquidation.

An exploit in Parity’s multi-sig contract led to the loss of 153,037 ETH (~$32M).

A smart contract vulnerability allowed recursive withdrawals of 3.6 million ETH, prompting Ethereum's fork.

Multi-signature wallet exploit drained 119,756 BTC ($72M). Considered one of the largest crypto thefts at the time.

Employee phishing allowed attackers to access hot wallets, stealing ~19,000 BTC. Cold storage limited further damage.