Crypto Exchange Hacks and Incidents 2025–2026: What Happened and Who Paid Users Back
By Alex Wu · Published · Updated
2025 and 2026 brought the two largest exchange thefts in crypto history. They also showed something reassuring: the big exchanges that were hit paid their users back. We went through the security records of all 21 exchanges on TradeSavings to see who was hit, how much was lost and what happened to customers' money.
Data checked: November 2026. Figures come from the exchanges' statements and major news coverage; early loss estimates often change.
The short version
- Two record thefts in two years. Bybit lost about $1.5 billion in February 2025. Binance lost about $6.3 billion in October 2026 (early estimates started at $5.8 billion).
- North Korea is the common thread. The FBI attributed the Bybit theft to the Lazarus group, and TRM Labs and Elliptic linked the Binance attack to TraderTraitor, a North Korean unit within the wider Lazarus group that was also tied to Bybit.
- Exchanges with reserve funds paid users back. Bybit, Bitget and Phemex all covered customer losses.
- 15 of 21 exchanges publish proof of reserves, a regular check that customer balances are backed one-to-one.
- Most attacks hit "hot" wallets that are online for withdrawals. Funds held in your own wallet were not affected.
Major incidents, 2025–2026
| Date | Exchange | What was hit | Amount | What happened to users |
|---|---|---|---|---|
| 29 Oct 2026 | Binance | Hot wallets on about ten blockchains | About $6.3 billion | Binance said users would not bear the losses (covered by SAFU and company funds); withdrawals reopened from 1 November |
| 24 Sep 2026 | Bitget | 12 hot and warm wallets via a third-party security tool | About $388 million | Covered by its Protection Fund, refilled to over $300M; withdrawals fully back on 2 Oct |
| Aug 2026 | Bitget | Abnormal mark-price liquidations on four tokens | Not stated | Users compensated in USDT |
| Jul 2025 | MEXC | Funds of one large trader frozen | About $3 million | MEXC apologised and released the funds |
| Apr 2025 | Bitget | VOXEL market-making fault | Over $20 million taken by eight accounts | Trades reversed |
| Mar 2025 | Weex | ETH/USDT order-matching fault | 6,123,393 USDT | 5,022 users compensated |
| 21 Feb 2025 | Bybit | Ethereum cold wallet via a compromised developer machine | About $1.46–1.5 billion | Bybit stayed open and covered the loss |
| Jan 2025 | Phemex | Hot wallets on several chains | About $69 million or more | User losses covered; withdrawals reopened in steps |
Older incidents still worth knowing
- BingX, September 2024: about $43 million from a hot wallet; BingX said it would cover user losses.
- HTX, 2023: two hot-wallet thefts (about $8 million and $30 million) plus $86.6 million from the HECO bridge; users were compensated.
- CoinW, 2023: about $13 million from a hot wallet, after which it moved to MPC wallets.
- Crypto.com, January 2022: about $34 million from 483 accounts; users were reimbursed.
- KuCoin, September 2020: about $275–281 million; most was recovered and the insurance fund covered the rest.
Exchanges with no reported hack
We found no reported exchange-wallet hack for OKX, Bitunix, BloFin, Coinstore, LBank, OurBit, Toobit, WhiteBIT in the sources we checked. That is not a guarantee, so use the same precautions everywhere.
How to protect yourself
- Keep only trading money on exchanges. Long-term holdings are safer in your own wallet.
- Use an authenticator app for 2FA, not SMS.
- Turn on a withdrawal allowlist and an anti-phishing code where the exchange offers them.
- Spread large balances across more than one exchange.
- Prefer exchanges that publish proof of reserves and keep a protection or insurance fund.
Our longer guide on keeping funds safe on exchanges covers each step in detail.
How we collected the data
We collected security incidents from each exchange's official statements, proof-of-reserves pages and major crypto news coverage (TechCrunch, Cointelegraph, Finance Magnates and others), focusing on 2025–2026. Amounts are the figures reported at the time; final figures can differ.
TradeSavings may earn a commission when you sign up with a code or link on this site, at no extra cost to you. Trading crypto, forex and CFDs, especially with leverage, carries a high risk of loss. This page is information, not financial advice.
Frequently asked questions
- What is the biggest crypto exchange hack?
- The Binance hack of 29 October 2026, with losses of about $6.3 billion, is the largest reported. The previous record was Bybit's $1.5 billion in February 2025.
- Did Bybit pay users back after the hack?
- Yes. Bybit stayed open, processed withdrawals and covered the loss, so customer balances were not reduced.
- Was Bitget hacked?
- Yes. On 24 September 2026 about $388 million was taken from hot and warm wallets. Bitget covered it from its Protection Fund and fully reopened withdrawals on 2 October 2026.
- Which crypto exchanges have never been hacked?
- We found no reported exchange-wallet hack for OKX, Bitunix, BloFin, Coinstore, LBank, Ourbit, Toobit and WhiteBIT in the sources we checked, though that is no guarantee.
- How can I keep my crypto safe on an exchange?
- Keep only trading funds there, use app-based 2FA, set a withdrawal allowlist, and hold long-term savings in your own wallet.