Crypto Exchange and Wallet Security Incidents

Attackers posed as a quantitative trading firm and built trust with Drift contributors over several months, including in-person meetings. They obtained pre-signed authority from Drift's Security Council using a Solana durable nonce, whitelisted a fake CVT token with a self-controlled oracle, deposited it as collateral, and withdrew funds in 128 seconds.

User impact

Around 285 million dollars, drained using only legitimate Solana features and admin permissions. No smart contract bug was exploited, which made the attack especially hard to detect in advance.

Platform response

Drift disclosed the incident, worked with investigators and law enforcement, and reviewed its admin key and listing processes.

Lesson for beginners

Social engineering can defeat technical controls entirely. Admin actions need multi-party verification with out-of-band confirmation, and pre-signed authority should expire quickly.

Attackers compromised a LayerZero developer's session keys in March, poisoned the RPC infrastructure feeding the bridge's verifier network, and minted 116,500 unbacked rsETH on April 18. No smart contract was exploited.

User impact

Around 291 million dollars, the largest DeFi hack of 2026's first half. The stolen tokens were funneled into Aave as collateral, triggering a 6.28 billion dollar TVL drop and market freezes at nine DeFi platforms. KelpDAO later fully re-backed rsETH.

Platform response

KelpDAO paused the protocol, executed a recovery plan that re-backed every minted token, and worked with bridge and infrastructure providers on verifier security.

Lesson for beginners

Bridge security lives in off-chain infrastructure, RPC nodes, verifier keys, failover design, as much as in contracts. A single compromised operator key can be enough.

A bug introduced in March 2021 reduced seed randomness on some Coldcard devices by falling back to a predictable software random number generator. In 2026, attackers exploited that weakness to brute force keys and drain funds from addresses created on vulnerable firmware.

User impact

Across multiple waves, more than one thousand bitcoins, about 116 million dollars, were taken from thousands of wallets, making this one of the largest hardware wallet failures recorded. Only wallets seeded on fixed firmware or other devices were unaffected.

Platform response

Coinkite released patched firmware and urged users to move funds to wallets generated with corrected randomness. However, upgrading firmware could not repair seeds that had already been created under the flawed generator.

Lesson for beginners

Even specialised hardware can have subtle cryptographic bugs. For large holdings, many users now consider multi-signature setups, diverse vendors and occasional migrations to fresh seeds as part of defence in depth.

Ostium, a perpetuals protocol on Arbitrum, suffered an exploit after an attacker compromised its off chain price reporting system. They submitted forged but validly signed oracle prices and routed them through a task scheduler to manufacture artificial trading profits.

User impact

Around 18 to 24 million dollars in stablecoins were drained from the liquidity vault backing trader positions. Trader collateral remained safe, but liquidity providers bore the loss.

Platform response

The protocol paused trading, brought in external investigators, hardened its off chain price signing environment and began to design recovery options for affected liquidity providers.

Lesson for beginners

Ostium's experience showed that DeFi risk is not limited to smart contracts. Off chain infrastructure such as oracle signers and automation keys must be treated as critical security components.

Separate incidents at SafePal and a Trezor shipping provider exposed tens of thousands of customer order records, including names, email addresses and home addresses. The leaks did not reveal recovery phrases or keys but made hardware wallet buyers more visible to attackers.

User impact

Around fifty thousand records were exposed across both companies, raising the risk of targeted phishing, extortion attempts and physical threats against self-custody users.

Platform response

SafePal and Trezor fixed the underlying issues, notified customers and authorities, and worked to remove malicious phishing sites and communications that used the leaked lists.

Lesson for beginners

These incidents showed that privacy around who owns hardware wallets is itself a safety issue. Users benefit from treating any breach-linked email or message as suspect and keeping recovery phrases completely offline.

Attackers exploited the Liquid Network bridge in early September 2026, moving roughly 4,000 BTC out of the protocol. It became the second largest incident of the year by value.

User impact

Around 319 million dollars, the second biggest single loss of 2026 after Bitget, according to CertiK's quarterly figures.

Platform response

Investigators traced the flows as the industry coordinated on freezing and monitoring the stolen funds. Details of the exploit vector were still being established in the weeks after the incident.

Lesson for beginners

Bridges remain the highest-value targets in crypto. Until details are public, the standing lesson holds: bridge deposits are among the riskiest positions in DeFi.

On September 24, 2026, attackers compromised a critical backend system inside Bitget's wallet infrastructure, spoofed transaction data, and triggered the authorisation process to move funds from hot and warm wallets. Bitget said no private keys were stolen and cold wallets stayed untouched.

User impact

About 387.5 million dollars across ETH, XRP, BNB, AVAX, USDT, USDC and other assets, moved across seven blockchains within hours. Chainalysis and Elliptic linked the laundering patterns to North Korea-linked actors. Customer balances were reported intact and withdrawals were paused as a precaution.

Platform response

Bitget paused withdrawals, engaged Mandiant and SlowMist for investigation, patched the exploited third-party security product flaw, resumed withdrawals in phases from September 28, and pointed to its 464 million dollar User Protection Fund.

Lesson for beginners

Backend authorisation systems are as critical as key storage. Forged internal commands bypassed risk checks without any key theft, which is why withdrawal anomaly detection and rapid pause procedures matter.

Attackers compromised the signing flow for Bybit's main Ethereum wallet and associated contracts. They tricked signers into approving changes that moved control to a malicious implementation, then drained large holdings of Ether and staked Ether in a short period.

User impact

Roughly 1.4 to 1.5 billion dollars in Ether and related assets, the largest single exchange theft on record at the time. The FBI attributed the attack to North Korea's TraderTraitor group.

Platform response

Bybit processed an intense wave of withdrawals, secured emergency funding and loans, and worked to restore reserves. The platform launched bounty offers and detailed post incident communications while regulators and law enforcement investigated.

Lesson for beginners

Bybit's loss highlighted that custody risk remains central even for large and well-known exchanges. Blind signing defeating a multisig shows that the human approval step is itself an attack surface.

An attacker used flash loans to exploit a flawed donation and liquidation mechanism in Euler's lending markets, draining funds across several asset pools.

User impact

Around 197 million dollars. After on-chain negotiations, the attacker returned the majority of the funds.

Platform response

Euler negotiated publicly with the attacker, offered a bounty, recovered most assets, and later relaunched with a redesigned protocol and bug bounty program.

Lesson for beginners

Complex DeFi lending logic needs formal verification, not just audits. Negotiation recovered funds here, but it only works when the attacker is willing to talk.

A former Ledger employee's credentials were compromised, allowing attackers to push malicious versions of the Ledger Connect Kit JavaScript library to npm. Many DeFi frontends loaded that library directly, and the poisoned versions injected wallet drainer logic into dApps.

User impact

Around 600,000 dollars in crypto was stolen as users connected hardware wallets to compromised DeFi sites and signed transactions that had been silently altered.

Platform response

Ledger and affected dApps pulled and replaced the malicious library versions, coordinated with WalletConnect to cut off the rogue project, and published technical incident reports for developers.

Lesson for beginners

Protecting self-custody involves both wallet firmware and the web applications people use. Projects benefit from pinning dependencies, using integrity checks and reacting quickly to upstream compromises.

Attackers compromised five of the nine Ronin validator private keys, reportedly through a social-engineered fake job offer to an Axie Infinity developer, then approved fraudulent withdrawals from the Ronin bridge. The theft went unnoticed for nearly a week.

User impact

About 173,600 ETH and 25.5 million USDC, roughly 625 million dollars at the time. US authorities attributed the attack to North Korea's Lazarus Group.

Platform response

Sky Mavis raised a 150 million dollar round led by Binance to help reimburse users, hardened validator operations, and worked with law enforcement to trace and seize laundered funds over the following years.

Lesson for beginners

Five-of-nine multisig means little when four keys sit with one organisation. Operational security around people, not just code, decides bridge safety.

An attacker exploited a missing signature check in Wormhole's Solana program, minting 120,000 wrapped ETH on Solana without depositing collateral on Ethereum.

User impact

Around 325 million dollars. Jump Crypto, Wormhole's parent backer, immediately backfilled the missing ETH so users were made whole.

Platform response

Jump Crypto replaced the stolen funds within a day and Wormhole patched the vulnerability, later launching a large bug bounty program.

Lesson for beginners

Audits do not catch everything, especially in complex cross-chain code. A deep-pocketed backstop saved users here, which is the exception rather than the rule.

An attacker exploited a bug in the BSC Token Hub's cross-chain proof verification, forging proofs to mint two million BNB directly.

User impact

Roughly 560 million dollars minted. Validators halted the chain within hours, so most of the minted BNB never moved; just over 100 million dollars was actually taken cross-chain.

Platform response

BNB Chain validators coordinated a chain halt, froze the attacker's accounts, and later voted through governance to handle the frozen funds and reimburse affected parties.

Lesson for beginners

The ability to halt a chain is itself a form of centralisation. It limited losses here, but users of supposedly decentralised networks should know who can pull that lever.

Trader Avraham Eisenberg used large orders to pump the thinly traded MNGO perpetual price, then borrowed against the inflated collateral and drained the protocol's treasury.

User impact

Around 110 million dollars. Eisenberg publicly called it a legal trading strategy, but was later convicted of fraud in the United States.

Platform response

Mango's DAO negotiated a partial return of funds and pursued legal action alongside federal prosecutors.

Lesson for beginners

Oracles that read thin markets can be weaponised. And as Eisenberg learned, calling an exploit a trading strategy does not make it legal.

From 2019 to 2022, FTX marketed itself as a safe and liquid exchange while its affiliate Alameda Research quietly drew billions of dollars of customer assets via hidden credit lines and bank accounts. Special code paths exempted Alameda from standard risk controls, letting it run a large negative balance backed by user deposits.

User impact

Regulators later alleged that over 8 billion dollars of customer deposits had been misappropriated or lost. When confidence broke in November 2022, withdrawal requests revealed a massive shortfall and both companies filed for bankruptcy.

Platform response

New management began forensic work inside the bankruptcy estate. The SEC, CFTC and other regulators filed civil charges, and criminal proceedings targeted the former leadership. Recovery efforts continue with partial distributions to creditors.

Lesson for beginners

FTX showed that financial failure can come not only from external hacks but from internal misuse and commingling of funds. Transparent proof of reserves, clear segregation of customer assets and strong governance are critical when choosing an exchange.

An attacker exploited a cryptography flaw in Poly Network's cross-chain message verification, tricking the contract into authorising transfers, and drained funds across Ethereum, BNB Chain and Polygon.

User impact

Around 611 million dollars, then the largest DeFi exploit on record. Unusually, the attacker later returned nearly all of it, claiming white-hat motives.

Platform response

Poly Network publicly negotiated with the attacker, offered a 500,000 dollar bug bounty, and recovered the bulk of the funds over several weeks.

Lesson for beginners

Cross-chain message verification is extremely hard to get right. Recovery here depended on the attacker's cooperation, an outcome nobody should plan around.

In September 2020, KuCoin detected unauthorised outflows from its hot wallets. Private keys controlling those wallets had been exposed, allowing attackers to move funds into their own addresses and immediately begin swapping assets on on-chain markets. Investigators later traced the laundering trail through decentralised exchanges and mixing services.

User impact

Roughly 281 million dollars across Bitcoin, Ether and many ERC-20 tokens. Cold wallets stayed intact. Coordination with token issuers let a majority of stolen ERC-20 tokens be frozen and reissued, while base-layer coins proved irrecoverable.

Platform response

KuCoin moved remaining hot wallet funds to new wallets, paused deposits and withdrawals, and worked with law enforcement and analytics firms. An insurance fund and issuer support eventually covered most user losses.

Lesson for beginners

KuCoin underlined strict hot wallet key management and fast incident response. It also showed the practical difference between token contracts that can be frozen or reissued and base-layer coins that cannot be rolled back.

An attacker gained access to Ledger's e-commerce and marketing database via a leaked API key. A later incident involving a rogue partner support agent compounded the problem and led to a large set of customer records being exposed online.

User impact

Around one million email addresses and more than 270,000 detailed records, including names, postal addresses and phone numbers, were leaked. Hardware wallets and private keys remained secure, but affected customers faced waves of phishing and extortion attempts.

Platform response

Ledger patched the underlying issues, notified authorities and users, and published several updates explaining what happened. The company increased focus on data minimisation and partner oversight.

Lesson for beginners

The Ledger breach highlighted that data about who owns hardware wallets can be almost as sensitive as private keys themselves. Users should expect phishing after such breaches and never type recovery phrases into software or forms that claim to be checking wallet safety.

Attackers stole roughly 523 million NEM (XEM) tokens from Coincheck. The funds sat in a hot wallet that did not use multisignature protection, making a single breach catastrophic.

User impact

Around 530 million dollars, affecting about 260,000 users. At the time it was the largest single crypto theft on record.

Platform response

Coincheck reimbursed all affected users from its own funds, about 425 million dollars, and was later acquired by Monex Group, which invested heavily in security upgrades.

Lesson for beginners

Storing large balances in a hot wallet without multisig is a basic failure. Full reimbursement came from company reserves, a privilege of a profitable operator, not something users should expect elsewhere.

Attackers breached Bitfinex's hot wallet infrastructure, which used BitGo multisignature wallets, and stole close to 120,000 bitcoin in a single incident.

User impact

Around 72 million dollars at the time. Bitfinex socialized the loss with a 36 percent haircut across all customer balances and issued BFX recovery tokens.

Platform response

Bitfinex repaid all BFX tokens within eight months through trading profits and equity conversion, an unusually complete recovery for an exchange hack.

Lesson for beginners

Multisig alone does not guarantee safety if the signing flow is compromised. Bitfinex also showed that transparent loss-sharing plus a credible repayment plan can preserve a platform, though users should never count on being made whole.

Launched in 2010, Mt. Gox grew into the dominant Bitcoin exchange before collapsing in early 2014. Later analysis suggested that most of the missing coins had been leaking from its hot wallet since late 2011, far beyond a single one-off hack.

User impact

Around 744,408 customer bitcoins and 100,000 company-held bitcoins were lost. Trading halted, the site was taken offline and the company entered bankruptcy, leaving many early users locked in multi-year recovery proceedings.

Platform response

The company first blamed transaction malleability, then entered civil rehabilitation. Ongoing court-supervised processes aim to redistribute remaining assets to creditors and former customers.

Lesson for beginners

Mt. Gox showed that basic hot-wallet security failures could silently drain an exchange over years. It is one reason modern platforms lean heavily on cold storage, multi-signature controls and external audits.