A Review of Global CEX Theft Incidents from 2014 to 2026

This article reviews publicly disclosed CEX theft incidents in history, arranged chronologically, focusing on the amount stolen and the specific reasons for each incident.

Written by: Biteye

Since the first serious attack on Mt.Gox in 2011, followed by thefts from major exchanges like Binance and Bybit, security issues at exchanges have never truly disappeared.

Hot wallets, private keys, multi-signature systems, employee computers, and even wallet service providers and third-party security devices have all become entry points for attackers.

The amount stolen has been continuously rising, and the methods of attack have become increasingly complex. Early attackers primarily sought technical vulnerabilities within the exchanges themselves; later, phishing, malware, and private key theft gradually became common tactics; in recent years, attacks have extended to multi-signature front ends, internal employees, and software supply chains.

This article reviews publicly disclosed CEX theft incidents in history, arranged chronologically, focusing on the amount stolen and the specific reasons for each incident.

TL;DR:

• From 2014 to 2026, there were over 30 major theft incidents at centralized exchanges, with cumulative losses estimated at approximately $11.3 billion to $11.4 billion based on the cryptocurrency prices at the time of the incidents.
• Attack methods have continuously evolved: from early thefts of hot wallet private keys to employee phishing, multi-signature interface tampering, and supply chain attacks.
• The amounts stolen are increasing, and the attack paths are becoming more covert. Exchanges now need to protect not only wallets but also employees, permission systems, and third-party services.
• Among these incidents, 15 have been attributed or suspected to be related to North Korean hackers, involving approximately $10.1 billion, accounting for nearly 90% of the total amount.

2014

Mt.Gox | $450 million to $480 million

In February 2014, Mt.Gox announced that approximately 850,000 BTC were missing, worth about $450 million to $480 million at the time. The platform later recovered about 200,000 BTC.

Investigations revealed that attackers may have gained access to server and wallet private key permissions as early as 2011, continuously transferring assets from the platform. Long-term theft combined with internal management chaos ultimately led to Mt.Gox's bankruptcy.

2015

Bitstamp | Approximately $5 million

In January 2015, attackers approached Bitstamp employees through social engineering, sending a file containing malware to the system administrator. After the administrator ran the file, the computer was compromised, and files containing hot wallet information were stolen.

2016

Bitfinex | Approximately $71 million

At the time, Bitfinex collaborated with BitGo to manage multi-signature wallets. After obtaining relevant credentials and API permissions, attackers increased the withdrawal limits and bypassed the existing multi-signature security mechanism to complete the transfer.

2018

Coincheck | Approximately $530 million

Coincheck stored 523 million XEM in a hot wallet without multi-signature protection. After an employee's computer was infected with malware, attackers gained control of the wallet and transferred assets.

Bithumb | Approximately $31.5 million

Bithumb's hot wallet was breached, resulting in approximately 35 billion KRW being transferred out, with no public disclosure of the specific attack path.

Zaif | Approximately $60 million

Zaif's hot wallet was compromised, leading to the theft of Bitcoin, Bitcoin Cash, and MonaCoin among other assets.

2019

Cryptopia | Approximately $16 million

Multiple hot wallets of Cryptopia were attacked. After the incident, funds continued to flow out, indicating that attackers likely had control of the relevant private keys, while the exchange could not promptly cut off their access.

Binance | Approximately $40.7 million

Attackers collected users' API keys and two-factor authentication information through long-term phishing and malware, subsequently initiating withdrawals and transferring 7,000 BTC from Binance's hot wallet.

Upbit | Approximately $49 million

Upbit's Ethereum hot wallet was drained of 342,000 ETH. Public information did not disclose the specific process by which attackers gained wallet access.

2020

KuCoin | Approximately $280 million

Private keys of multiple hot wallets at KuCoin were leaked, allowing attackers to control the wallets and transfer Bitcoin, Ethereum, and a large number of ERC-20 tokens.

2021

Liquid | Approximately $97 million

Liquid's warm wallet was breached, leading to the theft of Bitcoin, Ethereum, and other tokens. Although warm wallets are not continuously online, they remain connected to the network system, thus still posing a risk of permission loss.

BitMart | Approximately $196 million

BitMart's hot wallet private keys on Ethereum and Binance Smart Chain were stolen. Attackers transferred tokens in bulk and exchanged assets through decentralized trading platforms.

2022

Crypto.com | Approximately $33.8 million

Attackers bypassed Crypto.com's two-factor authentication process, transferring Bitcoin, Ethereum, and other assets from 483 user accounts.

2023

CoinEx | Approximately $54 million to $70 million

CoinEx's hot wallet private keys were leaked, allowing attackers to gain control and transfer assets from multiple wallets across chains.

Poloniex | Approximately $114 million to $130 million

Poloniex's hot wallet was attacked, with a large number of tokens rapidly transferred out and exchanged. Attackers likely obtained private keys or equivalent permissions.

HTX and Heco Cross-Chain Bridge | Approximately $113 million in total

HTX's hot wallet and Heco cross-chain bridge experienced abnormal transfers, both incidents pointing to private key or high permission account breaches. Heco is not a centralized exchange, but due to its close relationship with HTX, the statistics are combined.

2024

DMM Bitcoin | Approximately $308 million

Attackers contacted wallet service provider employees under the guise of recruitment, inducing them to run malicious scripts, subsequently tampering with transfer requests and transferring 4,502.9 BTC to the attackers' address.

BtcTurk | Approximately $55 million

Multiple hot wallets at BtcTurk were stolen. The specific method of intrusion was not disclosed, but attackers clearly gained control of the hot wallets.

WazirX | Approximately $230 million

WazirX multi-signature personnel saw transaction content on the interface that did not match what was executed on-chain. Attackers exploited this discrepancy of 'what you see is not what you sign' to induce signers to approve malicious transactions, subsequently upgrading wallet contracts and transferring assets.

Indodax | Approximately $22 million

Multiple hot wallets at Indodax were attacked, with no public disclosure of the specific method of intrusion, only confirming that attackers gained wallet transfer permissions.

BingX | Approximately $43 million to $52 million

Multiple hot wallets across chains at BingX experienced abnormal outflows. Public information did not disclose the attack entry point, and attackers may have controlled the private keys or wallet system.

2025

Phemex | Approximately $70 million to $85 million

Multiple hot wallets across chains at Phemex had assets concentrated and transferred out. The platform did not disclose the initial method of intrusion, but attackers clearly gained control of multiple wallets.

Bybit | Approximately $1.5 billion

Attackers infiltrated the Safe wallet front end, tampering with the transaction content seen by multi-signature personnel. Signers believed they were approving a normal transfer, but what they actually signed was a malicious transaction modifying wallet control, leading to the transfer of approximately 400,000 ETH.

Nobitex | Approximately $90 million

Attackers transferred Nobitex's assets to a special address that no one could control, effectively destroying the funds. The main goal of this attack was not profit, but political sabotage.

BigONE | Approximately $27 million

BigONE suffered a supply chain attack. Attackers entered the exchange's server environment and tampered with operational logic, causing the system to transfer assets according to their instructions.

CoinDCX | Approximately $44.2 million

An engineer at CoinDCX was lured by a fake part-time job and installed malware on their work computer. Attackers accessed the exchange system through the compromised terminal and transferred assets from internal operational accounts.

BtcTurk | Approximately $48 million to $54 million

BtcTurk experienced abnormal transfers from hot wallets again. The specific method of intrusion was not disclosed, but the incident indicates that even if most assets are stored in cold wallets, online wallets and permission systems can still become entry points.

Upbit | Approximately $30.4 million

Upbit's administrator account was compromised, and attackers used high permission accounts to initiate unauthorized withdrawals from the Solana hot wallet.

2026: Security Devices and Signature Permissions Continue to Fail

Bitget | Approximately $387.5 million

Attackers exploited a zero-day vulnerability in third-party security devices to access wallet servers, subsequently forging transactions and transferring assets. The breakthrough point of this attack was not Bitget's own system, but external security products.

Binance | Approximately $6.3 billion in assets affected

A DevOps engineer's computer at Binance was compromised, allowing attackers to enter internal service containers and submit unauthorized withdrawal transactions. The incident involved approximately $6.3 billion in assets, of which about $3 billion has been frozen, with the final losses still being calculated.

In Conclusion: In the AI Era, Asset Security is More Important Than Ever

CEX thefts are becoming more frequent, and the amounts involved are increasing.

From 2024 to 2025, there were 12 major incidents, nearly equal to the total of nine years from 2014 to 2022; the amounts stolen and affected from 2025 to 2026 account for over 70% of the total statistics.

In addition to the increasing amount of assets held by exchanges, AI is also enhancing the efficiency of hacker attacks. It can help attackers quickly gather employee information, generate phishing emails, fake recruitment materials, and malware in bulk.

Therefore, regardless of which exchange you use, do not easily click on links in emails or private messages, try to enable Passkey, hardware keys, and withdrawal address whitelists, and regularly clean up unused API permissions. Security is no small matter.