Crypto Hack History: The Biggest Heists and Who Got Caught

Two thieves sit at either end of this story. The first moved 119,754 bitcoin out of the Bitfinex exchange in 2016, was arrested six years later, received a five-year sentence and walked out early. The second took between $6.3 billion and $6.4 billion from Binance last week, depending on which tracker you ask, and will never see a courtroom. It is a country.

Almost every crypto hack of the past decade fits somewhere between those two. What changed over those ten years was the kind of person breaking the code, and investigators had to change with them. Below are the biggest heists, who was behind them, how the money was followed, how much came back and who, if anyone, was convicted.

Figures on the Binance case are as of November 3, 2026, and still moving.

Crypto hack history in numbers: from millions to billions

Annual totals jump around because a single heist can double a year. The steadier signal is who is doing the stealing.

Sources: Chainalysis annual reports (2021-2022 figures as reported in the media), TRM Labs for the North Korea share.

According to Chainalysis, hackers stole more than $3.4 billion in 2025, and North Korea took at least $2.02 billion of it. The three largest hacks made up 69% of losses at crypto services. In other words, the industry does not suffer from a thousand small cuts so much as from a few enormous wounds.

The biggest crypto heists of the decade at a glance

The table covers the cases discussed below. Dollar amounts are values at the time of the theft, and "about" marks figures that come from press reports rather than official filings.

When the hacker was a person: Bitfinex, the DAO, Poly

Here is the pattern that runs through the early cases. Hardly anyone lost at the moment of the hack. They lost later, sometimes much later, when the money had to be spent, and every coin was still sitting on a public ledger that anyone could watch.

The DAO: a theft undone by rewriting the chain

The DAO, in June 2016, was an investment fund made of smart contracts. Someone found a hole in its code and pulled out about 3.6 million ether, roughly a third of the fund. Who? Nobody knows, and nobody was charged. What happened next could not happen at a bank: Ethereum's community rewrote the blockchain's history with a "hard fork" and handed the coins back.

Not everyone agreed. The holdouts kept the old chain running, and it still trades as Ethereum Classic. A year later, in July 2017, the SEC used the episode to say DAO tokens were securities. So the money came back, but only because the record itself was changed, which is an odd kind of justice.

Bitfinex: six years from theft to handcuffs

If you want one case that shows how patient investigators solve a crypto hack, this is it. In August 2016 someone got inside the exchange's network, approved more than 2,000 fake withdrawals and moved 119,754 bitcoin out. Over the next years the coins drifted through darknet markets, mixers, accounts opened under fake names and (at one point) gold coins.

IRS criminal investigators and the FBI never stopped following them. What broke the case was almost mundane: the keys to the wallet sat in a cloud account belonging to Ilya Lichtenstein. In February 2022 the government seized 94,636 bitcoin, about $3.6 billion at the time and its largest seizure to date.

Lichtenstein pleaded guilty to a money laundering conspiracy, and the Justice Department announced his 60-month sentence on November 14, 2024. Heather Morgan, his wife, received 18 months. Neither served the full term; Lichtenstein's early release was announced on January 1, 2026.

Poly Network and Euler: thieves who gave it back

Some thieves do the math and give up. In August 2021 an anonymous attacker drained about $611 million from Poly Network, a bridge that links blockchains, then returned nearly all of it and turned down a $500,000 bounty. Euler Finance lost $197 million to a crypto hack in 2023 and got back about $177 million. I suspect both thieves reached the same conclusion: coins this famous are almost impossible to spend without getting caught.

Hacker stole, court undid: Mango, Nomad and FTX

Even when a name lands on an indictment, the ending is shaky.

Avraham Eisenberg drained about $110 million from Mango Markets in October 2022 by pushing up the price of its token and borrowing against it, then called it a "legal trading strategy." A jury convicted him in April 2024. On May 23, 2025, a judge vacated every conviction.

The Nomad bridge lost about $190 million in August 2022 in a free-for-all where anyone could copy the attack. Alexander Gurevich, accused of taking about $2.89 million of it, was arrested at Israel's Ben-Gurion Airport on May 1, 2025, and extradited to the U.S.

The roughly $400 million taken from FTX in November 2022 was allegedly the work of a SIM swap ring; three people were charged in January 2024, though the indictment refers only to "Victim Company-1." And in Japan, police charged about 30 people for trading the NEM coins stolen from Coincheck in 2018. The hackers themselves were never found.

North Korea: the biggest crypto thief is a state

Since 2022 the main suspect in almost every record crypto heist has had a flag. Investigators can name it. They cannot arrest it.

Ronin: the case that named Lazarus

In March 2022 attackers took about $625 million from the Ronin bridge behind the game Axie Infinity after gaining control of five of its nine validator keys. On April 14, 2022, the FBI named North Korea's Lazarus Group, and the U.S. Treasury blacklisted the wallets. Much of the money went through the Tornado Cash mixer. About $30 million was seized, roughly a tenth. Sky Mavis, the company behind the game, repaid users.

The fake recruiter playbook: DMM, WazirX, Bybit

The method then shifted from code to people, a form of social engineering. At DMM Bitcoin in May 2024, a fake LinkedIn recruiter tricked an employee at a software contractor, and attackers used that access to steal 4,502.9 bitcoin, worth $308 million. In December 2024 the FBI, the Pentagon's cyber crime center and Japan's police named TraderTraitor, a Lazarus subgroup. DMM later closed. WazirX, India's largest exchange, lost about $235 million in July 2024, and its users are being repaid through a Singapore court scheme.

Then came Bybit. On February 21, 2025, attackers hijacked a routine transfer from a Safe{Wallet} account and redirected about $1.5 billion in ether. The FBI blamed North Korea five days later. The thieves swapped the coins into bitcoin across thousands of addresses, and most of the ether was laundered within about ten days, according to press reports. Only about 3% was frozen early.

Why nobody gets arrested

North Korea's share of hack losses rose from under 10% in 2020 and 2021 to 64% in 2025, per TRM Labs. In its December 2025 report, Chainalysis put the country's total haul at $6.75 billion, typically laundered within about 45 days. Against a state, investigators have three tools left: attribution, sanctions and the race to freeze.

Binance hack: the $6.4 billion test for investigators

The Binance hack of October 29, 2026, is the largest crypto heist on record, about four times Bybit. It also shows the new rule of the game: investigators cannot catch this thief, but they can sometimes outrun it.

The attackers used an Ethereum feature called EIP-7702 and 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper, draining ten blockchains in about 20 minutes. Binance first pointed to a compromised engineer's laptop; later reports describe fake job interviews and malware, which has not been confirmed. Chainalysis and TRM Labs both attributed the attack to TraderTraitor with high confidence, and the FBI issued an alert. On November 3, North Korea, through Kim Yo Jong, denied it.

What happened after the news broke is the interesting part. Freezes began within about an hour. By November 3, about $2.8 billion was frozen, most of it by Tether (about 1.77 billion USDT) and Circle (about 825 million USDC), according to Chainalysis and TRM.

The attacker still held about $2.4 billion, including 18,270 bitcoin, which no one can freeze. To move faster, the attackers sold stablecoins to market makers at discounts of more than 10%, a sign they expected the freezes. At Bybit, early freezes covered about 3% of the loot. At Binance, as of November 3, it is closer to 44%.

I find that shift more important than the record itself. Stablecoin issuers have become, in practice, the industry's emergency police. That works only for tokens a company controls. Bitcoin has no such switch.

Earlier in 2026, TRM linked two smaller attacks to the same country: Drift ($285 million, April 1) and KelpDAO ($292 million, April 18).

Tornado Cash on trial: can you prosecute a crypto mixer?

If laundering is where thieves get caught, the obvious target is the laundromat. That is where the law has gone round in circles.

The Treasury sanctioned Tornado Cash on August 8, 2022. Its reasoning was simple enough: more than $7 billion had passed through the mixer since 2019, over $455 million of it for Lazarus. Two years later, on November 26, 2024, a federal appeals court objected to the method, saying immutable smart contracts are not "property" and cannot be sanctioned. The Treasury lifted the sanctions on March 21, 2025.

The criminal case is just as unfinished. Roman Storm, a co-founder, was found guilty on August 6, 2025, but only of running an unlicensed money transmitting business, because the jury deadlocked on laundering and sanctions. A retrial is scheduled for April 26, 2027. And the wallet behind the Binance attack? Chainalysis says it was funded through Tornado Cash.

Crypto security lessons: how investigators trace stolen funds

What a public ledger actually gives investigators is a record, not a refund. They pair on-chain information with exchange records and walk the money forward, address by address: through "peel chains" that shave off small amounts, across bridges between blockchains, into swaps and over-the-counter desks. Sooner or later someone has to turn cryptocurrency into cash, or park it in a token a company can freeze, and that is where cases are won.

What should an ordinary user take from ten years of this? Mostly that the weak point is people. Look at the list again: a stolen key, a fake recruiter, an employee who clicked. The same social tricks hit regular holders daily, whether it is a fake support chat or an investment scam picked up somewhere on the internet.

So, can crypto be hacked? The blockchain itself, rarely. The people and companies around it, often. Leave coins on an exchange and you carry its security risk; keep them in your own digital wallet and the risk is yours.

The crypto hack that changed the rules

Lichtenstein was caught because he had to spend what he took, which is the weak point of almost every crypto hack. North Korea does not need to be caught to keep winning, and that is why the defense has moved from arrests to speed. Two things are worth watching next: how much of the Binance money stays frozen, and whether a jury in April 2027 decides that writing a mixer is a crime.

Jordan Morris

Jordan Morris is an AI expert with over a decade of experience and the author of a widely-read blog focused on artificial intelligence. His content spans a range of topics—from the ethics of machine learning to real-world applications of neural networks in business. Known for his clear writing and deep insights, Jordan has become a trusted voice in the AI community, appealing to both newcomers and seasoned professionals alike.