# Biggest Crypto Hacks of All Time, Ranked

> The biggest crypto hacks of all time ranked by value taken at the time: the largest DeFi, bridge and exchange hacks with attack type, chain and funds recovered.

Markdown copy of https://voltfincrypto.com/apps/biggest-crypto-hacks

**Question:** What are the largest crypto hacks of all time, ranked by value stolen?

- Kind: Table in Voltfin Strata
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

This table ranks the largest crypto hacks and exploits on record by the value taken, measured at the moment of each attack. Exchanges, bridges, DeFi protocols and wallets appear in one list, each with its date, chain, attack type, what was recovered and the transactions that moved the funds.

Value at the time and value today tell different stories: an old attack priced at today's rates can look far larger or smaller than it was. The table ranks by value at the attack block and shows today's value of the same tokens beside it, so the list can be read either way. Open any row to see the attack transactions and the sources that confirmed the incident.

## Blueprint

One row: One row per incident, across every chain and year recorded

- **Rank** (`rank`): Position by value taken at the time, largest first.
- **Incident** (`incident`): The victim's name and a short description of what was attacked.
- **Date** (`date`): The day of the first attack transaction.
- **Victim type** (`victim_type`): Exchange, bridge, DeFi protocol, wallet or other kind of victim.
- **Chain** (`chain`): The chain where most of the value was taken; an incident across several chains lists each in its details.
- **Attack type** (`attack_type`): How the attacker got in: key compromise, contract flaw, oracle manipulation, signing interface compromise or phishing.
- **Value taken** (`value_taken`, USD): Tokens and coins that left victim addresses, valued at the attack block.
- **Value today** (`value_today`, USD): The same tokens and coins valued at the latest day-end price.
- **Recovered** (`recovered`, USD): Value frozen, returned or seized afterwards, from the recovery transactions.
- **Attribution** (`attribution`): The actor a public source attributes the attack to, with that source, or unattributed.
- **Receipt** (`receipt`): The attack transactions, the price reads and the incident's sources.

## How it will be measured

- Incidents come from a reviewed registry; each needs identified attack transactions and a public source, and both are linked from its row.
- Value taken is the sum of tokens and native coins that left victim addresses in the attack transactions, valued at oracle or DEX pool prices at the attack block.
- Incidents older than reliable on-chain price feeds are valued at an off-chain reference price for the day, which is named in the row.
- Recovered value counts issuer freezes, attacker returns and seizures, each from its own transactions, and is never subtracted from the ranking value.
- Breaches whose wallets were never disclosed are listed with the victim's own statement as their only source and marked as not verified on-chain.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- `stablecoin_freezes` (to build): Addresses frozen or blacklisted by stablecoin issuers, the balances frozen, and later unfreezes or destroyed funds, per stablecoin and chain.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- Source: Outflow Transfer logs and native traces from victim addresses in each attack's block range
- Source: Oracle rounds or DEX pool prices at each attack block, and a named daily reference price for older incidents
- Source: Freeze events, attacker return transfers and disclosed seizures, for recovered value
- Source: Public disclosures and post-mortems, recorded with each incident's date and link

## Questions

### What is the biggest crypto hack of all time?

The first row of the table answers it, ranked by value at the time of each attack. Lists disagree because some value losses at today's prices and some count insider frauds or exchange collapses as hacks; this table counts only thefts from wallets and contracts.

### What are the biggest DeFi hacks?

Filter the table by victim type to see DeFi protocols and bridges only. Large DeFi losses have come from flawed contract logic, oracle manipulation and compromised validator or multisig keys on bridges, and each row names its cause.

### Why are bridge hacks so large?

A bridge holds the assets backing every token it has issued on other chains in one place, often controlled by a small set of validator or multisig keys. Compromising those keys or the verification logic can release the whole escrow at once.

### Are hack values adjusted for today's prices?

No. The ranking uses value at the attack block, because that is what was taken. Today's value of the same tokens has its own column, since price moves can make an old hack look much larger or smaller today.

### How much stolen crypto is ever recovered?

It varies widely from one incident to the next. The recovered column counts freezes by stablecoin issuers, returns by attackers and seizures by authorities, each from its transactions, so the share recovered can be compared row by row.

## Glossary

- **Value at the time**: The value of stolen tokens at prices read at the block of the attack, rather than at today's prices.
- **Bridge escrow**: The contract that holds locked assets on one chain while tokens representing them circulate on another.
- **Seizure**: Funds taken back from an attacker or launderer by authorities, usually through an exchange or a court order.

## Related apps

- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [Crypto Exchange Hacks: Full List and Losses](https://voltfincrypto.com/apps/crypto-exchange-hacks-list)
- [Crypto Hacks and Exploits: Monthly Report](https://voltfincrypto.com/apps/crypto-hacks-monthly-report)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Stolen Crypto Tracker: Where Hacked Funds Went](https://voltfincrypto.com/apps/stolen-crypto-tracker)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F