Get Quartz in your inbox

Free daily briefing on global business news.

10 major crypto hacks in history, from Mt. Gox to Bybit's $1.5 billion theft

These 10 major crypto hacks in history, from Mt. Gox and The DAO to Bybit's roughly $1.5 billion theft, show how exchanges, bridges and smart contracts became targets

Most of the money lost in crypto's major thefts did not disappear because someone broke the underlying cryptography. It vanished through the systems built around it: exchanges holding customer coins, smart contracts with flawed code and bridges that move tokens between blockchains. Each of those layers concentrated value in one place, and each became a target.

This list covers 10 major crypto hacks in history, arranged in the order they happened. It is a selection, not a complete ranking. The incidents run from the collapse of the Tokyo-based exchange Mt. Gox in 2014 to the theft at Bybit in February 2025. Together, they trace how the targets changed as the industry grew.

Early cases centered on exchanges and on code. Mt. Gox reported about 850,000 bitcoin missing when it filed for bankruptcy. The DAO, a venture fund built on Ethereum, lost about 3.6 million ether through a flaw in its code. The community responded with a hard fork, and the original chain carried on as Ethereum Classic.

Later cases moved to cross-chain bridges. These hold large pools of tokens so users can shift assets from one network to another. Poly Network, Wormhole, Ronin Network and the BSC Token Hub bridge on BNB Chain all fall into this group. The BNB Chain incident was a bridge exploit. It was not a breach of the Binance exchange.

The attackers changed too. The FBI attributed the Ronin Network theft to North Korea-linked groups known as Lazarus Group and APT38. It later attributed the Bybit theft to North Korea as well, naming a group called TraderTraitor. Bybit, at about $1.5 billion at the time of the theft, is the largest dollar-value theft in this list.

What happened after each theft varied. The Poly Network attacker returned nearly all of the funds taken. A substantial part of the KuCoin losses was later recovered. Jump Crypto, a backer of Wormhole, replaced that bridge's missing funds. In the Bitfinex case, the U.S. Department of Justice announced in February 2022 that it had seized about 94,000 bitcoin tied to the 2016 theft.

Crypto prices move sharply. A theft's dollar value therefore depends on when it is measured. Each dollar figure in this list is the rounded value at the time of the theft. Mt. Gox appears in bitcoin only, because the cause and timing of its losses remained contested.

Mt. Gox bitcoin losses and the 2014 collapse of a Tokyo exchange

Mt. Gox, a Tokyo-based bitcoin exchange, filed for bankruptcy in February 2014 after reporting that about 850,000 bitcoin were missing.

The missing coins fell into two groups. About 750,000 bitcoin belonged to customers who had left funds on the platform. The remaining 100,000 or so belonged to the company itself.

That split shows where the damage landed. Most of the loss fell on account holders rather than on the business. Customers who left coins with the exchange did not control the private keys to those coins. When the bitcoin disappeared, those customers became creditors in a bankruptcy case. They were no longer owners of coins they could move or sell.

The picture changed after the filing. About 200,000 bitcoin were later found. That reduced the net shortfall to roughly 650,000 coins. The recovery did not answer the central questions. It remained unclear how much was taken by outside attackers and how much was lost through internal failures. The period over which the coins drained away was also never pinned down.

Mt. Gox did not start as a bitcoin business. Its name came from "Magic: The Gathering Online eXchange," a site first meant for trading cards from the fantasy card game. Jed McCaleb turned the domain into a bitcoin exchange in 2010. He sold it to Mark Karpelès the following year. Karpelès ran Mt. Gox as its chief executive until the collapse.

Japanese police arrested Karpelès in August 2015. In March 2019, the Tokyo District Court convicted him of manipulating electronic data to falsify the exchange's records. He received a suspended sentence. The court acquitted him of embezzlement charges.

In 2018, a Tokyo court moved the case out of bankruptcy and into civil rehabilitation. That process allowed creditors to be repaid in part with recovered bitcoin. Repayments to creditors began in 2024.

Mt. Gox kept customer bitcoin under a single operator's control. When that operator failed, the coins of every customer on the platform were exposed at once.

The DAO hack of 2016 and the Ethereum Classic split

In June 2016, an attacker exploited a flaw in the code of The DAO, a venture fund built on Ethereum, and drained about 3.6 million ether. That haul was worth roughly $60 million at the time of the theft.

The DAO took its name from the term decentralized autonomous organization. It had no managers or board in the usual sense. Investors bought tokens with ether, and those tokens gave them votes on which projects the fund would back. Smart contracts — programs that run on the Ethereum blockchain — held the money and enforced the fund's rules.

That design placed the entire fund inside a single body of code. The weakness the attacker used was a reentrancy bug. The contract sent ether out before it updated its own record of the balance. That gap let the attacker request withdrawals again and again before the books caught up.

The drained ether did not leave right away. It moved into a so-called child DAO, a split-off copy of the original contract. The rules of that structure imposed a holding period of 28 days before the funds could be withdrawn. The delay gave the Ethereum community time to debate a........

© Quartz