7 Most Devastating Crypto Hacks in History

Seven crypto hacks changed the industry. See why they happened, what they exposed, and how they influenced blockchain security.

Crypto hacks have changed the industry for more than a decade. On February 21, 2025, a Thursday morning in Dubai, someone at Bybit authorized a transaction. The interface, approval process, and multisignature workflow protecting the exchange’s cold wallet all appeared legitimate. Nothing raised suspicion until 400,000 ETH, worth about $1.5 billion, left Bybit’s wallets and entered a laundering network that investigators later linked to North Korea’s Lazarus Group.

The theft took only minutes, but investigators spent months tracing what happened. The attackers never breached the blockchain, the smart contracts, or the cryptographic keys. Instead, they compromised the software interface that Bybit’s signers used to review and approve transactions. Security researchers had warned the industry about this risk for years, yet many organizations failed to prepare for it.

Bybit’s breach became the largest cryptocurrency theft in history, surpassing every previous attack. It was also the latest chapter in a pattern that began in 2011, when a hacker accessed a Mt. Gox administrator account and changed Bitcoin’s price to one cent, triggering the industry’s first major security crisis.

Between the 2011 Mt. Gox incident and the 2025 Bybit breach, attackers stole more than $19 billion in cryptocurrency across hundreds of attacks. Each generation of crypto hacks became more sophisticated. Every major breach exposed a new weakness that earlier defenses failed to address. The industry learned valuable lessons, but it rarely learned them quickly enough to stop the next attack.

This article tells the complete story. It covers every major hack, explains how each attack worked, examines what changed afterward, and identifies where the real vulnerability existed in each case.

How Crypto Hacks Happen: The Main Attack Categories

Before looking at the timeline, it helps to understand the attack categories behind the industry’s biggest losses. One pattern stands out across fifteen years of crypto hacks: attackers didn’t change tactics at random. They adapted whenever the industry strengthened its defenses.

In the early years, most major thefts targeted exchange hot wallets. Exchanges kept customer funds in internet-connected wallets to support daily trading, making private keys an attractive target. To reduce the risk, the industry adopted cold storage and moved most funds offline. Attackers responded by shifting their focus elsewhere.

The rise of smart contract platforms introduced a new threat: protocol exploits. Vulnerabilities such as reentrancy bugs, oracle manipulation, flash loan attacks, and governance exploits let attackers drain funds even though the underlying cryptography remained secure. The problem wasn’t stolen keys. It was flawed code. Developers responded with security audits and formal verification. Once again, attackers adapted.

As exchanges and protocols strengthened their technical defenses, sophisticated attackers turned their attention to people instead of infrastructure. They relied on social engineering, phishing, malware, and supply chain attacks against third-party software. The human layer, where authorized users review and approve transactions, became the weakest point. Defending against these attacks is far more difficult than deploying cold storage or auditing code. It requires strong processes, continuous training, and disciplined security practices for everyone with privileged access.

The Bybit hack is more than the largest theft in crypto history; it shows where the industry’s biggest security challenge now lies.

The Early Years: Mt. Gox and the Original Playbook (2011–2014)

2011

Mt. Gox — First Incident

~2,000 BTC stolen · approximately $30,000 at the time

Mt. Gox was never meant to be a Bitcoin exchange. Instead, Jed McCaleb created it in 2006 as a marketplace for Magic: The Gathering Online cards. In 2010, he repurposed the platform for Bitcoin and sold it to Mark Karpelès a year later. By 2013, Mt. Gox handled about 70% of all Bitcoin transactions worldwide. As a result, much of the world’s Bitcoin trading depended on a platform that had originally sold digital trading cards.

However, the first major crypto hack came in June 2011. A hacker gained access to an administrator account and manipulated Bitcoin’s price on Mt. Gox to one cent. The attacker then bought roughly 2,000 BTC for almost nothing before the exchange detected the manipulation and halted trading.

The financial loss was relatively small, about $30,000. However, it exposed flaws that would haunt the industry for years.

An exchange responsible for most of the world’s Bitcoin trading relied on an administrator account that attackers could compromise. Once inside, they could manipulate the platform’s pricing system with ease. The industry acknowledged the incident, patched several vulnerabilities, and then carried on.

Meanwhile, no one realized the biggest problem had only just begun. The 2011 breach exposed serious weaknesses, but it was only the first chapter in Mt. Gox’s security failures. Over the following years, attackers continued stealing Bitcoin from the exchange without anyone fully understanding the scale of the compromise.

2011-2014

Mt. Gox — The Long Drain

850,000 BTC stolen · approximately $473 million at the time · worth over $23 billion at 2026 prices

The full story of Mt. Gox is not about a single crypto hack. Instead, it is the story of a years-long theft that the exchange failed to detect.

Investigators concluded after the exchange collapsed in February 2014 that attackers likely compromised Mt. Gox’s private keys as early as 2011. They may have used an insider, a remote intrusion, or another method that investigators never confirmed. From that point, the attackers systematically withdrew Bitcoin from the exchange’s wallets. Meanwhile, Mt. Gox’s accounting system treated those withdrawals as legitimate transfers to secure addresses. As a result, the exchange continued crediting customer accounts with balances that no longer had Bitcoin backing them.

By mid-2013, Mt. Gox appeared to be thriving. It processed enormous trading volumes while Bitcoin’s price surged. In reality, the exchange had already lost almost all of its Bitcoin. It remained technically bankrupt for months before anyone noticed.

Bankruptcy and Aftermath

On February 7, 2014, Mt. Gox halted all Bitcoin withdrawals. Three weeks later, on February 28, it filed for bankruptcy in Japan. The company disclosed that 750,000 customer BTC and 100,000 of its own BTC had disappeared, roughly 7% of all Bitcoin in circulation at the time. Consequently, Bitcoin’s price fell by about 36% over the following days. Years of legal proceedings followed. Even today, more than a decade later, a bankruptcy trustee continues repaying victims through one of the most complex bankruptcy cases in cryptocurrency history.

US authorities later charged two Russian nationals, Alexey Bilyuchenko and Aleksandr Verner, for their alleged roles in laundering the stolen Bitcoin. Authorities also shut down BTC-e, the exchange that allegedly handled much of the laundering, in 2017. Its alleged operator, Alexander Vinnik, was arrested in Greece and later sentenced to prison. However, investigators still have not established exactly who carried out the original theft or how they first compromised the exchange.

Mt. Gox changed the industry’s approach to security. It showed that a centralized exchange is only as secure as its weakest internal process. As a result, exchanges gradually adopted cold storage, multi-signature wallets, independent on-chain audits, and proof-of-reserves. None of these practices were standard before Mt. Gox. Today, they form the foundation of exchange security, even if implementation still varies across the industry.

$19B+

CUMULATIVE CRYPTOCURRENCY STOLEN ACROSS ALL HACKS THROUGH MID 2024 — CRYSTAL INTELLIGENCE

The Mt. Gox collapse accounted for a fraction of this figure in dollar terms at the time of theft, but the 850,000 BTC stolen would be worth over $23 billion at 2026 prices. The delayed realization of the full loss and the decade-long bankruptcy process that followed made Mt. Gox the most consequential single hack in the industry’s history, even if not the largest in nominal dollar terms.

The Code Problem: Smart Contracts and the DAO (2016)

June 17, 2016

The DAO Hack

3.6 million ETH drained, approximately $60 million at the time

Ethereum launched in July 2015 with a promise that went beyond Bitcoin’s simple value transfer: smart contracts that could automate complex financial logic without human intermediaries. The DAO, a Decentralized Autonomous Organization launched in the spring of 2016, was the most ambitious early test of that promise. It raised $150 million worth of ETH in a token sale, making it one of the largest crowdfunding events in history at the time. Token holders would vote on investment proposals, and smart contracts would execute the results automatically. There was no board, no CEO, and no central authority. The code was intended to govern everything.

The code had a flaw.

On June 17, 2016, an attacker identified a reentrancy vulnerability in The DAO’s withdrawal function. The exploit worked like this: when a participant requested to withdraw ETH from The DAO, the smart contract sent the ETH before updating the participant’s internal balance. An attacker could request a withdrawal, receive the ETH, and then, before The DAO’s contract updated the balance to zero, trigger another withdrawal using the same balance. By repeating this process rapidly, the attacker drained 3.6 million ETH, approximately one-third of all The DAO’s funds, into a child DAO under their control. ETH’s price fell from more than $20 to below $13 within 24 hours.

Ethereum’s Controversial Response

The Ethereum community’s response to the DAO hack became one of the defining moments in blockchain history and one of the most significant crypto hacks ever recorded. After weeks of intense debate, a majority of the community voted to implement a hard fork, a change to Ethereum’s protocol that effectively rewrote the blockchain’s history. The stolen funds were moved from the attacker’s child DAO into a recovery contract, allowing original investors to reclaim their ETH.

Not everyone supported that decision. A minority argued that blockchains must remain immutable and that rewriting history, even to reverse a theft, violated the technology’s core principles. They refused to adopt the fork and continued operating the original blockchain, which became known as Ethereum Classic. The split created two separate blockchains from a shared history: Ethereum, which reversed the theft, and Ethereum Classic, which accepted the attack as a permanent part of the ledger.

The DAO hack changed how the crypto industry approached blockchain security. Smart contract audits, formal verification, bug bounty programs, and secure development standards became common because the attack showed how a single coding flaw could lead to massive losses within hours. It also sparked a debate about whether stolen funds should ever be recovered by changing a blockchain’s history. Although developers already knew about reentrancy vulnerabilities in Solidity, security auditing was still developing in 2016. Today, these practices help reduce the risk of major crypto hacks.

Exchange Hacks at Scale: Coincheck and the Hot Wallet Era (2018)

January 2018

Coincheck

$534 million in NEM tokens stolen

Coincheck was a Japanese cryptocurrency exchange that made a costly security mistake. It stored $534 million worth of NEM tokens in a single hot wallet connected to the internet without multi-signature protection. That left one of its largest holdings exposed to attackers.

In January 2018, hackers exploited weak access controls and drained the entire wallet. At $534 million, it became the largest of all crypto hacks at the time, surpassing the losses from Mt. Gox in dollar value. Japan’s Financial Services Agency responded by ordering emergency security audits for cryptocurrency exchanges across the country. Coincheck was required to strengthen its security before continuing operations under tighter regulatory oversight.

The NEM Foundation considered a hard fork to freeze the stolen funds but decided against it. The decision reflected how much the industry had changed since the DAO hack. Many developers and investors were no longer willing to rewrite a blockchain to reverse a theft. The stolen NEM tokens were gradually laundered through multiple channels over the following months. The Coincheck incident was not the result of a sophisticated exploit. It was the result of poor security practices. By 2018, cold storage, multi-signature wallets, and hardware security modules were already considered standard protections. Coincheck failed to apply those safeguards to one of its largest token reserves.

The exchange repeated many of the same mistakes seen in the Mt. Gox breach four years earlier. The incident showed that strong security policies matter just as much as advanced technology. Exchanges that fail to protect customer assets can suffer losses on a massive scale.

DeFi Opens a New Attack Surface (2020–2022)

The explosion of decentralized finance between 2020 and 2022 created a new category of attack that no previous generation of crypto security had faced. Instead of targeting private keys, attackers began exploiting weaknesses in smart contract logic.

DeFi protocols held billions of dollars in liquidity pools governed entirely by code. That code was public, allowing anyone to read it, analyze it, and search for vulnerabilities. Flash loans, which allowed users to borrow and repay funds within a single transaction without collateral, gave attackers access to large amounts of capital. They used that capital to manipulate prices, governance votes, and collateral ratios. The combination of public code, accessible capital, and complex systems created an environment that made new types of crypto hacks possible.

August 10, 2021

Poly Network

$611 million stolen across three chains—the largest DeFi hack ever recorded at the time

On August 10, 2021, Poly Network suffered a $611 million exploit across Ethereum, BNB Chain, and Polygon. It was the largest of all crypto hacks in decentralized finance (DeFi) at the time.

Poly Network was a cross-chain interoperability protocol that allowed users to move assets between multiple blockchains. The attacker exploited a flaw in the protocol’s cross-chain verification logic. By manipulating the data used to validate cross-chain transactions, the attacker convinced the protocol to approve unauthorized withdrawals. About $273 million was stolen from Ethereum, $253 million from BNB Chain, and $85 million from Polygon within hours.

The incident took an unusual turn when the attacker began communicating through messages embedded in on-chain transactions. The attacker claimed the exploit was intended to expose a security weakness rather than steal funds. Over the following days, Poly Network worked with the attacker, and nearly all of the assets were returned. The full $611 million was eventually recovered.

The attacker’s identity has never been confirmed. Poly Network offered a $500,000 bug bounty and a position as chief security advisor, but the offer was declined.

The Poly Network exploit remains one of the largest crypto hacks because it exposed the risks of cross-chain bridge infrastructure. A single vulnerability in the verification logic allowed an attacker to access assets across multiple blockchains. The incident prompted greater scrutiny of cross-chain bridge security and influenced how similar protocols approach verification and smart contract design.

March 29, 2022

Ronin Network

173,600 ETH and $25.5 million USDC stolen · approximately $625 million

On March 29, 2022, Ronin Network lost 173,600 ETH and $25.5 million USDC, worth approximately $625 million. At the time, it was one of the largest crypto hacks in history.

Ronin Network was an Ethereum sidechain developed by Sky Mavis to support Axie Infinity, the play-to-earn game that attracted millions of users during the 2021 gaming boom. The network served as the bridge between Axie Infinity’s ecosystem and Ethereum.

How the Ronin Network Hack Happened

Ronin used a validator system that required five of nine signatures to approve large withdrawals. During a period of high network activity, Sky Mavis temporarily allowed Axie DAO to sign transactions on its behalf but failed to remove that permission afterward. Attackers later compromised four Sky Mavis validator nodes through a spear-phishing attack targeting an employee. They then used the remaining Axie DAO permission to obtain the fifth required signature, giving them control of the validator threshold needed to authorize two fraudulent withdrawals totaling 173,600 ETH and $25.5 million USDC.

The breach went undetected for six days. Sky Mavis discovered the theft only after a user reported being unable to withdraw funds. By then, much of the stolen cryptocurrency had already been moved through laundering channels. In April 2022, the FBI attributed the attack to Lazarus Group, a North Korean state-sponsored hacking organization. Sky Mavis later raised $150 million from investors, including Binance, to reimburse affected users. Only a small portion of the stolen assets was recovered.

The Ronin Network breach became one of the defining crypto hacks because it showed how attackers could bypass technical defenses by targeting people instead of code. The failure to revoke an unnecessary validator permission created the opportunity, while a successful phishing attack provided access to the validator keys. The incident highlighted the importance of secure key management and strict access controls in blockchain infrastructure.

$3.8B

TOTAL CRYPTO STOLEN IN 2022 — THE WORST YEAR ON RECORD

$1.7B

TOTAL CRYPTO STOLEN IN 2023 — SIGNIFICANT IMPROVEMENT BUT STILL SUBSTANTIAL

Cross-Chain Bridges Become the Main Target Of Crypto Hacks (2022)

Cross-chain bridges became the primary target of crypto hacks in 2022 because of their design. A bridge locks assets on one blockchain and issues equivalent tokens on another. The total value locked in a bridge contract represents all user deposits waiting to be redeemed. If an attacker compromises the bridge’s verification system, they can gain access to all of the locked assets.

In February 2022, Wormhole lost $320 million after an attacker exploited a signature verification flaw to mint 120,000 wrapped ETH without depositing the ETH required to back it.

Four months later, Harmony’s Horizon Bridge lost $100 million in an attack later attributed to North Korea’s Lazarus Group.

Another major bridge exploit followed in August 2022, when Nomad Bridge lost $190 million after a configuration error allowed anyone to submit fraudulent withdrawal transactions. Once the vulnerability became public, hundreds of copycat attackers joined the exploit and drained the remaining funds.

By the end of 2022, bridge exploits accounted for most DeFi theft losses. These crypto hacks showed that concentrating large amounts of value in a single smart contract created an attractive target. Combined with complex cross-chain verification systems, bridge infrastructure became one of the highest-risk areas in decentralized finance.

Crypto Hacks and North Korea’s Lazarus Group

The attribution of the Ronin Network attack to Lazarus Group confirmed a growing trend. By 2022, the North Korean hacking group had become the most persistent source of large-scale crypto hacks, relying on social engineering instead of breaking blockchain cryptography.

Lazarus Group adapted its tactics as the cryptocurrency industry strengthened its security. Early operations targeted exchange hot wallets and stolen credentials. Later campaigns focused on employees with access to private keys and transaction approval systems. Attackers used fake job offers, professional networking platforms, and malware disguised as legitimate software or documents to gain access. Once they compromised a trusted system, they authorized fraudulent withdrawals using valid credentials rather than exploiting the blockchain code.

These attacks showed that human error and weak access controls could be as dangerous as software vulnerabilities. As social engineering became more common, cryptocurrency companies placed greater emphasis on employee training, hardware security, and multi-layer approval systems to reduce the risk of future crypto hacks.

$1.34B

CRYPTOCURRENCY STOLEN BY LAZARUS GROUP IN 2024 ALONE — CHAINALYSIS

North Korea’s state-sponsored hacking program has stolen an estimated $3+ billion in cryptocurrency since 2017. The funds are believed to support North Korea’s weapons program, bypassing international sanctions through cryptocurrency’s borderless nature. The FBI has officially attributed the Ronin Network hack, the Bybit hack, and numerous other major thefts to Lazarus Group.

Lazarus Group focused on the transaction approval process instead of breaking blockchain cryptography. This type of crypto hack is difficult to prevent because it targets the people responsible for approving transactions. Cold storage and smart contract audits cannot stop an authorized signer from approving a fraudulent transaction if the device or interface used to review it has already been compromised.

The Largest Crypto Hack in History: Bybit (2025)

February 21, 2025

Bybit

400,000 ETH stolen · approximately $1.5 billion · the largest single cryptocurrency theft ever recorded

On February 21, 2025, Bybit lost 400,000 ETH, worth approximately $1.5 billion, making it the largest of all crypto hacks and the biggest single cryptocurrency theft ever recorded.

Bybit was one of the world’s largest cryptocurrency exchanges and used a multi-signature cold wallet system designed to protect customer assets.

Instead of attacking Bybit directly, Lazarus Group compromised a workstation at Safe, the company that provided Bybit’s multi-signature wallet software. The attackers inserted malicious code into Safe’s transaction interface, causing Bybit’s authorized signers to see a legitimate internal transfer while the actual transaction sent 400,000 ETH to wallets controlled by the attackers. The compromise affected the transaction interface rather than the blockchain itself.

The theft took only minutes. Shortly after the breach became public, Bybit CEO Ben Zhou confirmed the exchange remained solvent and announced emergency funding to process customer withdrawals. Within 24 hours, Bybit secured $400 million in emergency financing. Days later, the FBI attributed the attack to Lazarus Group. Bybit also announced a $140 million bounty for information leading to the recovery of the stolen funds, the largest bounty offered after one of the biggest crypto hacks on record.

As of mid-2026, most of the stolen ETH has not been recovered. Blockchain analytics firms continue to track the movement of the funds through laundering networks.

Bybit’s Response

As of mid-2026, most of the stolen ETH has not been recovered. Blockchain analytics firms continue to track the movement of the funds through laundering networks.

The Bybit incident became the largest crypto hack in history. The $1.5 billion stolen exceeded 60% of the cryptocurrency stolen during all of 2024. The attack also showed that strong cold wallet security alone is not enough. By compromising trusted software used by authorized employees, attackers bypassed technical defenses without breaking the exchange’s cryptography or smart contracts. The breach made it clear that cryptocurrency companies must secure the entire software supply chain, not just blockchain infrastructure.

The attack vector that Bybit revealed:

The Bybit attack exposed a different type of security risk. Safe’s multi-signature wallet required multiple authorized signers to approve every transaction, making unauthorized withdrawals difficult even if one private key was compromised. Instead of stealing private keys, Lazarus Group compromised the transaction interface that signers used to review and approve transfers.

When a signer reviewed a transaction, the interface displayed what appeared to be a routine transfer to a Bybit wallet. In reality, the compromised software submitted a different transaction for approval, sending the funds to wallets controlled by the attackers. The cryptographic signatures were valid because authorized employees approved the transaction without realizing they were signing fraudulent instructions.

This crypto hack showed that attackers do not always need to break encryption or steal private keys. The multi-signature system worked as designed, and every required approval was completed. The attackers succeeded by deceiving the people responsible for authorizing the transaction.

How Crypto Hacks Evolved: A Fifteen-Year Arc

The history of crypto hacks shows how attackers adapted as the industry’s security improved. Each stage exposed a different weakness. As one vulnerability was addressed, attackers looked for another.

In the early years, private key management was the biggest weakness. Many exchanges stored keys in hot wallets with poor access controls. The attacks on Mt. Gox, Coincheck, and Bitfinex all relied on the same idea. If attackers obtained the private keys, they could steal the funds. In response, exchanges introduced cold storage and multi-signature wallets to reduce the risk.

As exchanges improved their security, many crypto hacks focused on smart contracts. Flash loan attacks, reentrancy exploits, oracle manipulation, and governance attacks did not require stolen private keys. Instead, attackers exploited flaws in the code that controlled user funds. The industry responded with more thorough smart contract audits and formal verification.

Today, many crypto hacks focus on the transaction approval process. Modern cryptography, audited smart contracts, and multi-signature systems provide strong protection. However, attackers can still compromise the software employees use to review and approve transactions. If the interface is manipulated, a fraudulent transaction can appear legitimate to an authorized signer.

Protecting against these attacks requires verifying transaction details independently of the software interface. Hardware wallets that display information directly from the raw transaction data provide one layer of protection. Air-gapped signing systems add another layer of protection by separating the approval process from internet-connected devices. Although these measures improve security, deploying them across large organizations with complex operations is still a major challenge.

What Onchain Data Reveals About Crypto Hack Recovery

Onchain data shows that recovering stolen cryptocurrency is rare. Most crypto hacks end with only a small portion of the stolen assets being recovered, while many funds are never returned.

A few major cases stand out. Poly Network recovered its entire $611 million after the attacker voluntarily returned the funds. No other crypto hack of a similar size has ended the same way.

KuCoin recovered about $204 million of the $275 million stolen in its 2020 hack. Exchanges, blockchain projects, and law enforcement worked together to freeze stolen assets and recover the funds.

In 2021, U.S. authorities seized about $3.36 billion in Bitcoin that James Zhong stole from Silk Road in 2012. He kept the funds for nearly nine years before authorities found and seized them.

Several smaller DeFi protocols also recovered part of their losses after attackers accepted bug bounty offers and returned stolen funds.

Most crypto hacks do not end this way. Creditors of Mt. Gox are still waiting for repayments more than a decade after the exchange collapsed. Attackers still control most of the $625 million stolen from Ronin Network, and the $1.5 billion taken from Bybit continues to move through laundering networks. Across the largest crypto hacks, investigators recover well below 20% of the stolen assets.

Onchain data also shows how criminals move stolen cryptocurrency. Blockchain analytics firms such as Chainalysis and Elliptic report that Lazarus Group uses mixers, moves funds across multiple blockchains, trades through peer-to-peer exchanges in countries with weak anti-money laundering rules, and uses DeFi protocols that cannot freeze assets. As crypto hacks have become more common, criminals have expanded the ways they hide and move stolen funds.

Lessons from Fifteen Years of Crypto Hacks

Fifteen years of crypto hacks have cost the industry tens of billions of dollars, but they have also changed how cryptocurrency companies protect user funds.

Major exchanges now rely on cold storage and multi-signature wallets to protect customer assets. Smart contract auditing has become a standard part of blockchain development, with security firms reviewing code before deployment. Many exchanges also publish proof-of-reserves reports to build user confidence, while bug bounty programs encourage security researchers to report vulnerabilities before criminals exploit them.

Companies still face a major challenge. Many recent crypto hacks have targeted the software employees use to review and approve transactions instead of private keys or smart contracts. To reduce this risk, organizations need independent ways to verify transaction details instead of relying on a single software interface. They also need stronger security training that covers phishing, supply chain attacks, and other social engineering tactics.

The Bybit breach showed that even organizations with strong security controls can become victims of crypto hacks. Its cold wallet system, multi-signature approvals, and other security measures worked as designed, but the attackers compromised the software used to approve transactions. As companies strengthen these defenses, attackers will continue looking for new weaknesses, making security an ongoing process rather than a one-time solution.

What I’m Watching

The first thing I watch after major crypto hacks is how quickly attackers move the stolen funds. The speed at which they use mixers, cross-chain bridges, and decentralized exchanges often indicates how prepared they are and how likely investigators are to recover the assets. After the Bybit hack, Lazarus Group moved the stolen funds faster and across more blockchains than in its previous operations, including the Ronin attack.

I also watch how the SAFE multi-signature platform responds. Many DAOs, DeFi protocols, investment funds, and exchanges rely on Safe to manage treasury assets. The Bybit attack targeted Safe’s transaction interface instead of its cryptography. Any changes to signing tools or transaction verification could influence how institutions protect cryptocurrency in the future.

Another area to watch is exchange security regulation. The Bybit hack and years of major crypto hacks have pushed governments to introduce stronger security requirements for licensed cryptocurrency businesses. South Korea, the European Union under MiCA, and the United States are all developing or enforcing new security rules. The impact of these rules will depend on whether they address today’s attack methods or focus on older threats.

The history of crypto hacks shows that security never stands still. As companies improve their defenses, attackers look for new ways to bypass them. Developers then fix those weaknesses and strengthen their systems. The question is whether today’s security measures can stop the next wave of attacks. No one knows the answer, which is why cryptocurrency security continues to evolve.

Key takeaways from this piece:

Crypto hacks have evolved through three main stages. Early attacks focused on stealing private keys from exchange hot wallets. Later attacks exploited smart contract vulnerabilities. Today, many crypto hacks target the software and people responsible for approving transactions.

Mt. Gox lost 850,000 BTC in a multi-year theft that went undetected for a long time. Although later hacks stole more money in dollar terms, the Mt. Gox breach had the greatest long-term impact on the cryptocurrency industry.

The DAO hack in 2016 led to one of the biggest decisions in Ethereum’s history. The community approved a hard fork to reverse the theft, while others rejected the decision and continued using the original blockchain, now known as Ethereum Classic.

Lazarus Group has become the most active threat to cryptocurrency security. The group has stolen billions of dollars since 2017 and now targets software used to approve transactions instead of trying to steal private keys directly.

The Bybit breach in February 2025 showed how modern crypto hacks work. Attackers did not steal private keys or break the multi-signature system. Instead, they manipulated the transaction interface and tricked authorized signers into approving a fraudulent transfer.

Recovering stolen funds remains rare. Investigators have recovered well under 20% of the value lost in the largest crypto hacks. Criminal groups such as Lazarus Group now move stolen funds across multiple blockchains, DeFi protocols, and peer-to-peer exchanges to make recovery more difficult.