The Golden Age of Hackers

Over the past five years, the cryptocurrency industry has experienced more than 1,000 security incidents, with 28 major security incidents involving amounts exceeding $100 million.

Written by: Joe Zhou, Foresight News

This is the "golden age" of hackers.

According to my statistics, from January 2022 to October 2026, the cryptocurrency industry has seen at least 28 major security incidents involving amounts exceeding $100 million.

This means that on average, every two months, there is a major security incident in the cryptocurrency industry involving $100 million.

These 28 incidents alone involve amounts exceeding $14.2 billion.

The largest incident was the Binance security breach in October 2026, with an estimated impact of about $6.3 billion. The second largest was the Bybit security incident in February 2025, involving approximately $1.46 billion.

Hacker attacks in the cryptocurrency industry are not only causing increasingly larger losses but are also becoming more frequent.

If we broaden our view beyond these 28 major incidents, according to the DeFiLlama security incident database, from January 2022 to October 2026, the cryptocurrency industry has recorded over 1,000 security incidents. This averages about 18 incidents per month, equivalent to one security incident every two days.

From hundreds of millions to billions of dollars, from sporadic attacks to high-frequency occurrences, the cryptocurrency industry is undergoing a continuous security test.

Two Major Disaster Areas

Where do hackers attack to gain the most profit?

The answer is: centralized exchanges and cross-chain bridges.

After analyzing the 28 major security incidents involving amounts exceeding $100 million over the past five years, I found that 7 of them occurred in centralized cryptocurrency exchanges, accounting for one-quarter of the total.

Based on the initial amounts involved, these seven incidents are: Binance's $6.3 billion, Bybit's $1.46 billion, FTX's $477 million, Bitget's $351.6 million, DMM Bitcoin's $305 million, WazirX's $235 million, and Poloniex's $120 million.

These seven attacks on exchanges total an amount of up to $9.2486 billion.

In second place is an important infrastructure of the cryptocurrency industry—cross-chain bridges. Among these 28 major security incidents, 7 are related to cross-chain bridges and cross-chain infrastructure.

Cross-chain bridges typically require establishing trust mechanisms between different blockchains. Once there are issues with verification nodes, signature systems, or message validation, it can lead to large-scale asset gaps.

Based on the scale of stolen funds, the 7 cross-chain bridge-related security incidents are: Ronin Network's $625 million, BNB Chain Bridge's $586 million (with an actual transfer amount of about $120 million), Wormhole's $326 million, KelpDAO's $292 million, Nomad Bridge's $190 million, Multichain's $125 million, and Harmony Horizon Bridge's $100 million. Notably, KelpDAO's main business is liquidity re-staking, but the attack entry involved the rsETH cross-chain bridge.

In other words, half of these 28 major security incidents occurred in centralized exchanges and cross-chain bridges. These two areas have become the most concentrated places for large-scale security incidents in the cryptocurrency industry.

Interestingly, not all hackers aim for "blatant plunder"; there have also been two white-hat hacker incidents.

For example, after the 2022 attack on Nomad Bridge, some participants acted as white hats, claiming that taking the funds was to protect assets, ultimately returning about $36 million.

The Liquid Network case is even more special. In September 2026, attackers claiming to be white hats exploited a vulnerability to transfer about 4,000 BTC, later returning about 3,400 BTC while retaining approximately 598.5 BTC.

White-hat hackers have left a glimmer of light in this dark forest-like world of network offense and defense.

North Korean Hackers: Professional Plunderers

Every year, North Korean hackers come to the cryptocurrency industry to "withdraw funds."

They have formed a highly professionalized network attack system, targeting the global financial system, enterprises, and government agencies for funds and intelligence.

In the early days, North Korean hackers focused more on traditional financial systems. For instance, as early as 2016, they hacked the Bangladesh Central Bank, initiating fraudulent transfers of about $951 million using the SWIFT system, ultimately successfully transferring $81 million.

However, with the development of the cryptocurrency industry, the targets of North Korean hackers are also changing. From the major theft cases publicly disclosed in recent years, cryptocurrency exchanges, wallets, cross-chain bridges, and DeFi protocols have become important targets for them to obtain funds.

Among the 28 major security incidents in the cryptocurrency industry that I have compiled, 10 have been explicitly attributed or attributed with high confidence to North Korean hacker organizations.

More notably, I found that the attack methods and preferences of North Korean hackers are also changing. For example, they are no longer just looking for code vulnerabilities in smart contracts but are increasingly targeting people.

North Korean personnel even forge identities to directly apply for remote work positions in cryptocurrency companies. Meanwhile, attackers impersonate recruiters, business partners, or investment institutions, gaining team trust through long-term contact, and then look for opportunities to invade employee devices, development environments, and key signing processes.

A man widely suspected of being related to North Korean hacker organizations

The Bybit theft incident is a typical case. The attackers did not directly breach Bybit's core system but first infiltrated the work environment of Safe developers, manipulated the content displayed on the multi-signature transaction interface, and induced Bybit's signers to sign malicious transactions, ultimately transferring assets worth about $1.46 billion.

The attack on Drift Protocol was even more deceptive. According to Drift's post-incident investigation, the attackers spent months building relationships with the project team, disguising themselves as a quantitative trading team to gradually gain trust. Subsequently, they exploited Solana's Durable Nonce mechanism to induce members of the security committee to sign transactions in advance. These pre-signed transactions were executed later, ultimately allowing the attackers to gain management rights over Drift and transfer approximately $290 million in assets. Security agencies believe this attack shows signs of North Korean hacker involvement, but the attribution still needs further confirmation.

From exchanges to cross-chain bridges, from code vulnerabilities to human trust, hackers are breaking through every line of defense in the cryptocurrency industry.

When billions of dollars in assets can change hands overnight, and a single trust can become the entry point for an attack, the speed at which this industry creates wealth seems to have surpassed its ability to protect that wealth.

And this is the "golden age" of hackers.

Note: The amounts reported in this article are the initial disclosed amounts of stolen funds, abnormal asset scales, or preliminary estimated impact amounts, and do not equate to final net losses. Some incidents involve freezing, recovery, or abnormal minting, and the actual losses may differ from the initial amounts involved.