# Crypto Exchange Hacks: Full List and Losses

> Crypto exchange hacks list: every exchange hot wallet hack and security breach with its date, chains, wallets hit, value lost and funds recovered, on-chain.

Markdown copy of https://voltfincrypto.com/apps/crypto-exchange-hacks-list

**Question:** When were centralized exchanges hacked, and how much left their wallets each time?

- Kind: Table in Voltfin Strata
- Topic: [Security and risk](https://voltfincrypto.com/topics/security)
- Chains: Multi-chain
- Status: Planned. The data is not published yet, so this page states no figure; each figure will open its receipt when it is.

Centralized exchanges hold customer coins in hot, warm and cold wallets, and a breach of any of them moves funds out in transactions anyone can read. This table lists every known exchange breach with its date, the chains and wallets hit, how the attackers got in and how much left the wallets, measured from the outflows themselves.

An exchange's announcement and the chain do not always agree, so both are shown: the loss the exchange reported and the outflow read on-chain, valued at the attack block. Sort by value or filter by exchange, attack vector or date, then open a row for the outflow transactions, the attacker addresses and the sources.

## Blueprint

One row: One row per exchange breach

- **Exchange** (`exchange`): The exchange that was breached, as it was named at the time.
- **Date** (`date`): The day of the first outflow to the attacker.
- **Chains hit** (`chains`): Every chain from which funds left the breached wallets.
- **Wallets hit** (`wallet_type`): Hot, warm or cold wallets, as the exchange or the investigation described them.
- **Attack vector** (`attack_vector`): How the attackers got in: stolen keys, a compromised signing interface, insider access, a withdrawal system flaw or unknown.
- **On-chain outflow** (`outflow_value`, USD): Value that left the breached wallets during the incident, valued at each outflow block.
- **Reported loss** (`reported_loss`, USD): The loss the exchange announced, as published in its statement.
- **Recovered** (`recovered`, USD): Value frozen, returned or seized afterwards, from those transactions.
- **Customers reimbursed** (`reimbursed`): Whether customers were made whole, in part or not at all, according to the exchange's statements.
- **Attribution** (`attribution`): The actor a public source attributes the breach to, with that source, or unattributed.
- **Receipt** (`receipt`): The outflow transactions, attacker addresses, price reads and sources.

## How it will be measured

- An exchange breach is listed when the exchange or a public investigation confirms it and the breached wallet addresses can be identified on-chain.
- Outflows are the Transfer logs and native traces from breached wallets to attacker addresses during the incident window, summed per asset and valued at oracle or DEX pool prices at each block.
- The reported loss is the figure the exchange announced, recorded with its statement; where it differs from the on-chain outflow, both are shown.
- Breaches whose wallets were never disclosed are kept with the exchange's statement as their only source and marked as not verified on-chain.
- Customer reimbursement happens off-chain, so it is recorded from the exchange's own statements and linked to them.

## Data it needs

- `security_incidents` (to build): A registry of exploits, hacks and rug pulls: date, chain, protocol, attack type, amount lost and the transactions involved.
- `exchange_balances_daily` (to build): Balances held in labelled exchange wallets per asset, chain and exchange at day end, and net flows in and out.
- `address_labels` (to build): Labels for known addresses: exchanges, bridges, protocols, funds, treasuries, sanctioned addresses and known attackers.
- `native_prices_daily` (to build): Reference prices of major assets read from on-chain oracle feeds (Chainlink latestRoundData) at each day's last block, with each round's update time.
- Source: Exchange incident registry with breached wallet addresses, from exchange statements and public investigations
- Source: Outflow Transfer logs and native traces from breached wallets in each incident window
- Source: Bitcoin outputs spent from breached exchange addresses, for Bitcoin-era breaches
- Source: Attacker address balances at the latest block
- Source: Oracle and DEX pool prices at each incident block, or a named daily reference price for early breaches

## Questions

### Which crypto exchanges have been hacked?

Exchanges of every size have lost funds to breaches, from the earliest Bitcoin exchanges onward. The table lists each known breach; filter by exchange to see whether one has been hit and whether its customers were reimbursed.

### How do crypto exchanges get hacked?

Exchange breaches usually come from compromised keys or signing systems: stolen hot wallet keys, a tampered signing interface on a multisig or malware on staff machines. Flaws in withdrawal systems and insiders account for others. Each row names the vector its sources describe.

### What is a hot wallet hack?

A hot wallet is an exchange wallet whose keys sit on internet-connected systems so withdrawals can be processed quickly. A hot wallet hack steals those keys or abuses the systems that use them, and is limited to what the hot wallet holds unless warm or cold wallets are reached too.

### Do exchanges reimburse users after a hack?

Some cover losses from their own funds, some spread them across customers and some fail. Reimbursement happens off-chain, so the table records it from the exchange's statements and links them.

### What is the difference between hot, warm and cold wallets?

A hot wallet is online for routine withdrawals. A warm wallet needs extra approvals and refills the hot wallet. A cold wallet keeps its keys offline and holds most reserves. The table records which kind each breach reached.

## Glossary

- **Hot wallet**: An exchange wallet whose keys are kept online so it can pay out withdrawals automatically.
- **Cold wallet**: A wallet whose keys are kept offline, used to hold most of an exchange's reserves.
- **Incident window**: The span of blocks from the first to the last attack transaction of a breach, used to sum its outflows.

## Related apps

- [Biggest Crypto Hacks of All Time, Ranked](https://voltfincrypto.com/apps/biggest-crypto-hacks)
- [Proof of Reserves Tracker: Exchange Wallet Balances](https://voltfincrypto.com/apps/proof-of-reserves-tracker)
- [Crypto Hack Tracker: Exploits and Losses This Year](https://voltfincrypto.com/apps/crypto-hack-tracker)
- [North Korea Crypto Hacks: Lazarus Group Theft Tracker](https://voltfincrypto.com/apps/north-korea-crypto-hacks-tracker)
- [Bitcoin Exchange Reserves and Netflows](https://voltfincrypto.com/apps/bitcoin-exchange-reserves)
- [Bitcoin Quantum Risk: BTC in Exposed Public Key Addresses](https://voltfincrypto.com/apps/bitcoin-quantum-risk-exposed-keys)

Build it in Voltfin Studio: https://app.voltfincrypto.com/signup?next=%2F