Biggest Crypto Hacks of All Time, Ranked
The largest hacks and exploits on record, ranked by value taken at the time, with the attack type, the chain and how much came back.
Multi-chainTable · StrataPlanned
Crypto Exchange Hacks: Full List and Losses
When were centralized exchanges hacked, and how much left their wallets each time?
Every known centralized exchange breach, when it happened, which wallets were hit and how much left them, tied to the on-chain outflows.
- Multi-chain
ShareEmail it
Blueprint
What the table will hold.
The table as it will open in Strata. Each figure is named here and arrives with its receipt; until its data is published, its place stays empty.
One row One row per exchange breachSorted by On-chain outflow, highest first
| Exchange | Date | Chains hit | Wallets hit | Attack vector | On-chain outflowUSD | Reported lossUSD | RecoveredUSD | Customers reimbursed | Attribution | Receipt |
|---|---|---|---|---|---|---|---|---|---|---|
- Exchange exchange Text
- The exchange that was breached, as it was named at the time.
- Date date Date
- The day of the first outflow to the attacker.
- Chains hit chains Text
- Every chain from which funds left the breached wallets.
- Wallets hit wallet_type Text
- Hot, warm or cold wallets, as the exchange or the investigation described them.
- Attack vector attack_vector Text
- How the attackers got in: stolen keys, a compromised signing interface, insider access, a withdrawal system flaw or unknown.
- On-chain outflow outflow_value Exact amount
- Value that left the breached wallets during the incident, valued at each outflow block.
- Reported loss reported_loss Exact amount
- The loss the exchange announced, as published in its statement.
- Recovered recovered Exact amount
- Value frozen, returned or seized afterwards, from those transactions.
- Customers reimbursed reimbursed Text
- Whether customers were made whole, in part or not at all, according to the exchange's statements.
- Attribution attribution Text
- The actor a public source attributes the breach to, with that source, or unattributed.
- Receipt receipt Link
- The outflow transactions, attacker addresses, price reads and sources.
Filter by Exchange, Attack vector, Wallets hit, Date.
About
What it answers, and for whom.
Centralized exchanges hold customer coins in hot, warm and cold wallets, and a breach of any of them moves funds out in transactions anyone can read. This table lists every known exchange breach with its date, the chains and wallets hit, how the attackers got in and how much left the wallets, measured from the outflows themselves.
An exchange's announcement and the chain do not always agree, so both are shown: the loss the exchange reported and the outflow read on-chain, valued at the attack block. Sort by value or filter by exchange, attack vector or date, then open a row for the outflow transactions, the attacker addresses and the sources.
Method
How it will be measured.
Every figure will be read at a block, kept with its source and its exact read, and open a receipt anyone can re-check.
How receipts work →- An exchange breach is listed when the exchange or a public investigation confirms it and the breached wallet addresses can be identified on-chain.
- Outflows are the Transfer logs and native traces from breached wallets to attacker addresses during the incident window, summed per asset and valued at oracle or DEX pool prices at each block.
- The reported loss is the figure the exchange announced, recorded with its statement; where it differs from the on-chain outflow, both are shown.
- Breaches whose wallets were never disclosed are kept with the exchange's statement as their only source and marked as not verified on-chain.
- Customer reimbursement happens off-chain, so it is recorded from the exchange's own statements and linked to them.
The data it needs
Chain data, with some off-chain sources
- security_incidentsTo buildHacks and exploitsA registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- exchange_balances_dailyTo buildExchange wallet balancesBalances held in labelled exchange wallets per asset, chain and exchange at day end, and net flows in and out.
- address_labelsTo buildAddress labelsLabels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- native_prices_dailyTo buildOracle prices by dayReference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Exchange incident registry with breached wallet addresses, from exchange statements and public investigations
- Outflow Transfer logs and native traces from breached wallets in each incident window
- Bitcoin outputs spent from breached exchange addresses, for Bitcoin-era breaches
- Attacker address balances at the latest block
- Oracle and DEX pool prices at each incident block, or a named daily reference price for early breaches
Questions
Questions people ask.
Which crypto exchanges have been hacked?
Exchanges of every size have lost funds to breaches, from the earliest Bitcoin exchanges onward. The table lists each known breach; filter by exchange to see whether one has been hit and whether its customers were reimbursed.
How do crypto exchanges get hacked?
Exchange breaches usually come from compromised keys or signing systems: stolen hot wallet keys, a tampered signing interface on a multisig or malware on staff machines. Flaws in withdrawal systems and insiders account for others. Each row names the vector its sources describe.
What is a hot wallet hack?
A hot wallet is an exchange wallet whose keys sit on internet-connected systems so withdrawals can be processed quickly. A hot wallet hack steals those keys or abuses the systems that use them, and is limited to what the hot wallet holds unless warm or cold wallets are reached too.
Do exchanges reimburse users after a hack?
Some cover losses from their own funds, some spread them across customers and some fail. Reimbursement happens off-chain, so the table records it from the exchange's statements and links them.
What is the difference between hot, warm and cold wallets?
A hot wallet is online for routine withdrawals. A warm wallet needs extra approvals and refills the hot wallet. A cold wallet keeps its keys offline and holds most reserves. The table records which kind each breach reached.
- Hot wallet
- An exchange wallet whose keys are kept online so it can pay out withdrawals automatically.
- Cold wallet
- A wallet whose keys are kept offline, used to hold most of an exchange's reserves.
- Incident window
- The span of blocks from the first to the last attack transaction of a breach, used to sum its outflows.
Related
More apps like this.
Proof of Reserves Tracker: Exchange Wallet Balances
What exchanges hold in the reserve wallets they publish, chain by chain, read at each day's last block beside what they report owing.
Multi-chainBitcoinEthereum+1Crypto Hack Tracker: Exploits and Losses This Year
Every major hack and exploit of the year with the amount taken, how the attackers got in and where the stolen funds sit now.
Multi-chainNorth Korea Crypto Hacks: Lazarus Group Theft Tracker
Thefts attributed to North Korea-linked groups, what their attributed wallets still hold and how the funds move across chains.
Multi-chainEthereumBitcoinBitcoin Exchange Reserves and Netflows
Bitcoin held in exchange wallets by exchange, and the daily net flow in or out, read from the Bitcoin chain with sourced address lists.
BitcoinBitcoin Quantum Risk: BTC in Exposed Public Key Addresses
Bitcoin held in outputs whose public keys are already visible on-chain, split by script type and tracked day by day.
BitcoinBuild Crypto Exchange Hacks: Full List and Losses on verified data.
Start free in Voltfin Studio: boards, tables and reports where every number opens its receipt. Tell us which data you need first and we will build it next.