The biggest crypto hacks: Binance, Bybit, Axie Infinity, DMM and what they have in common

Crypto hacks have grown from millions to billions of dollars. The theft announced by Binance on 29 October 2026, about $6.3 billion, is the largest on record. Looking at the biggest cases side by side shows the same patterns again and again: who did it, how they got in and where the money went.

This guide uses what the FBI, the US Treasury and ethereum.org have published, plus the blockchain analytics firm TRM Labs for the Binance case, where no official findings have been published yet.

The largest crypto thefts

For more on the Binance case, see the $6.3 billion Binance hack.

The cases in more detail

Binance, 2026

Binance said an initial investigation pointed to a compromised laptop that let an attacker submit unauthorized withdrawals. TRM said about $6.36 billion moved out of Binance wallets on ten blockchains, most of it in about 20 minutes. In TRM’s assessment, the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. Binance has promised a technical post-mortem.

Bybit, 2025

The FBI says North Korea stole about $1.5 billion in crypto from the exchange Bybit on or about 21 February 2025. The attackers were “proceeding rapidly”, it said, converting some of the stolen assets to bitcoin and spreading them across thousands of addresses on multiple blockchains.

Axie Infinity, 2022

On 23 March 2022, according to the US Treasury, North Korea’s Lazarus Group stole almost $620 million from a blockchain project linked to the online game Axie Infinity. Treasury said the mixer Blender was used to process over $20.5 million of the proceeds, and in May 2022 made Blender the first crypto mixer it had ever sanctioned. In April 2022, the FBI said Lazarus Group and APT38 were responsible for the theft of $620 million in ether reported on 29 March.

DMM Bitcoin, 2024

The FBI’s account is the clearest example of how these attacks begin. In late March 2024, a North Korean hacker posing as a recruiter on LinkedIn contacted an employee of Ginco, a Japanese company that makes wallet software for businesses. The employee was sent a malicious Python script disguised as a pre-employment test. The attackers later used stolen session information to impersonate the employee and, in late May 2024, likely manipulated a legitimate transaction request by a DMM employee. The result: the loss of 4,502.9 BTC, worth $308 million at the time.

Harmony bridge, 2022

The FBI says Lazarus Group stole $100 million from Harmony’s Horizon bridge in June 2022. In January 2023 the attackers used the privacy protocol RAILGUN to launder over $60 million of the stolen ether, then sent part of it to crypto service providers to convert into bitcoin. A portion was frozen in coordination with some of those providers.

The DAO, 2016

An insecure smart contract called The DAO was drained of over 3.6 million ETH. Ethereum’s community responded with the DAO fork on 20 July 2016, which moved the funds to a new contract so that people who lost funds could withdraw them. See what is a hard fork?

What the biggest hacks have in common

1. A state-backed group behind many of them. The FBI has attributed the Bybit, DMM and Harmony thefts to North Korean hackers, Treasury attributes the Axie Infinity-linked theft to them too, and analysts link the Binance hack to the same group. See TraderTraitor explained.

2. People are the way in. Fake recruiters, fake tests and impersonated colleagues appear repeatedly in FBI accounts. The weak point is often a person with access, not the cryptography.

3. Hot wallets and signing systems. Exchange thefts often target the systems that approve withdrawals, rather than cracking keys. See how exchanges store your crypto.

4. Bridges. ethereum.org says bridges account for the top three biggest hacks in DeFi, and cites Solana’s Wormhole bridge, where 120,000 wETH (about $325 million) was stolen. See crypto bridges explained.

5. Fast laundering. Stolen funds are split, swapped and moved across chains within hours. See how stolen crypto is laundered and traced.

What it means for you

• Exchange risk is real. When your coins sit on an exchange, you rely on its security and on its willingness and ability to cover losses. See when a crypto exchange is hacked, who pays?
• Consider self-custody for long-term holdings, if you’re comfortable managing your own keys. See hot vs cold wallets.
• Be wary of unsolicited job offers and “tests” if you work in crypto or tech. See fake crypto apps and phishing.
• Expect scams after big hacks. Fake refund and recovery offers follow every major theft. See crypto recovery scams.