From Bitget to Bybit: 5 biggest crypto exchange hacks

​Bitget has become the latest major crypto exchange to suffer a nine-figure security breach. The attack puts it alongside some of the industry's most notorious names, from Mt. Gox to FTX. Which exchange hacks caused the biggest losses?

Crypto exchanges have always been attractive targets for hackers. They hold billions of dollars in digital assets, move funds around the clock and rely on complex systems in which a single weakness can have enormous consequences. Over the years, attackers have exploited everything from poorly protected hot wallets to compromised employees and the software used to authorize transactions.

The biggest breaches also tell the story of how crypto security has evolved. Mt. Gox collapsed when the industry was still relatively young, while more recent attacks have managed to bypass safeguards specifically designed to prevent another disaster on that scale. And the sums involved have grown with the market.

So which hacks were the biggest? We compare them by the estimated dollar value of the assets when they were stolen rather than what those coins would be worth today. That distinction matters for older cases involving Bitcoin, whose price has risen dramatically since some of the earliest thefts.

Bitget, 2026: $351.6 million

Bitget detected unauthorized transfers from some of its hot wallets at 18:31 UTC on September 24 and activated its emergency response procedures. The exchange later said approximately $351.6 million in assets had been affected, with the breach contained to parts of its hot and warm wallet infrastructure. Cold wallets remained secure.

View post on X Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Withdrawals were temporarily suspended while deposits and trading continued. Bitget said customer balances remained intact and that its User Protection Fund, which held more than $464 million, was sufficient to cover the loss.

“We will not run from this,” CEO Gracy Chen said. “Every dollar and every decision will be accounted for, transparently and in full.”

The investigation has already provided some clues about how the attack happened. Chen said Bitget's preliminary investigation had ruled out a private-key leak and pointed instead to a critical backend system in its wallet infrastructure. According to the exchange, the attacker was able to spoof transaction data and trigger Bitget's authorization process, although the exact method used to breach the system is still under investigation.

Mt. Gox, 2014: about $473 million

Long before Binance, Coinbase or Bybit became major names in crypto, Mt. Gox dominated Bitcoin trading. At its peak, the Tokyo-based exchange handled the majority of Bitcoin transactions worldwide.

That dominance came to an abrupt end in February 2014. Mt. Gox suspended withdrawals and then filed for bankruptcy after saying it had lost around 850,000 Bitcoin belonging to customers and the company. The missing coins were valued at roughly $473 million around the time of the bankruptcy filing.

The story soon became more complicated. Mt. Gox later said it had discovered 200,000 Bitcoin in an old wallet, reducing the number that remained missing to about 650,000 BTC. Creditors then spent years waiting for bankruptcy proceedings to determine what could be recovered.

FTX, 2022: about $477 million

FTX filed for Chapter 11 bankruptcy in the United States on November 11, 2022, after a liquidity crisis exposed a multibillion-dollar hole in its finances. Hours later, suspicious transfers began draining crypto from FTX-controlled wallets, adding another crisis to an exchange that was already collapsing.

Blockchain analytics firm Elliptic estimated that about $477 million was stolen. FTX's new management confirmed that unauthorized access to certain assets had occurred and moved remaining digital assets into cold storage.

More details about the attack emerged later. In 2024, U.S. authorities confirmed that FTX had been the victim of a SIM-swap attack. Three people were indicted over a SIM-swapping scheme linked to the incident, although their precise roles in the theft and subsequent laundering of the assets remained unclear.

The attacker quickly exchanged many of the stolen tokens for Ether, while issuers managed to freeze about $100 million in assets including USDT and Paxos Gold. Some of the remaining crypto was subsequently moved through decentralized exchanges, cross-chain bridges and mixers in an effort to obscure its trail.

Coincheck, 2018: about $534 million

Hackers stole 523 million NEM tokens from Japanese exchange Coincheck in January 2018, worth about 58 billion yen, or roughly $534 million at the time. Unlike the more sophisticated attacks that would follow, the Coincheck breach exposed a relatively basic weakness: a large amount of cryptocurrency had been kept in an internet-connected hot wallet.

Coincheck froze withdrawals and most trading after discovering the theft. Japanese regulators ordered the company to improve its security and scrutinized other domestic exchanges as questions grew over how platforms were protecting customer assets during the crypto boom.

The exchange promised to reimburse affected customers from its own funds. Coincheck ultimately survived the breach and was acquired by Japanese financial services company Monex Group later that year.

Bybit, 2025: about $1.5 billion

For seven years, Coincheck remained the largest crypto exchange hack on record. Then, in February 2025, Bybit lost almost three times as much during what appeared to be a routine transfer from an Ethereum cold wallet to a warm wallet.

The transaction required multiple signatures through Safe{Wallet}, a system intended to make unauthorized transfers more difficult. But the attackers did not have to compromise Bybit's private keys directly. Investigators found that a Safe developer's computer had been compromised, allowing malicious code to alter what Bybit's signers saw. They appeared to be approving a legitimate transaction while actually authorizing changes that allowed the attackers to take control of the wallet.

Around $1.46 billion in Ether and related tokens was drained. The FBI subsequently attributed the attack to North Korea and linked it to the country's TraderTraitor activity.

Bybit CEO Ben Zhou said shortly after the attack that the exchange remained solvent and that customer assets were fully backed. Bybit continued processing withdrawals and replenished its Ether reserves through purchases, loans and transfers from other crypto companies.

Exchange security has changed, but so have the attacks

The five hacks span more than a decade, and the weaknesses behind them are very different. Coincheck exposed the danger of keeping huge amounts of crypto in hot wallets, while the chaos surrounding FTX coincided with a SIM-swap attack that resulted in hundreds of millions of dollars being stolen.

Bybit showed how much more sophisticated the threat had become. Cold storage and multiple signatures were no longer necessarily enough if attackers could compromise the software and people involved in approving a transaction. Bitget's preliminary findings point to another variation on that problem, with the exchange saying its private keys remained secure while attackers instead manipulated a backend system involved in authorizing transfers.

Securing the wallet itself is only part of the challenge. Every system, interface and person involved in moving assets can become another target.