Unicorn Private Research
EN

Exchange hacks and crypto thefts: the largest cases, from Mt. Gox to Bitget, and what they teach

From Mt. Gox in 2014 to Bybit's 1.5 billion dollar loss in 2025 and Bitget's 387.5 million in September 2026, the largest thefts share a pattern. Dates, amounts, sources and lessons for custody.

Every few years a single theft resets the record for the crypto industry. The amounts have grown with the market, but the weak points have changed less than one might expect: the online wallets that exchanges use for daily withdrawals, the people and suppliers who can approve transactions, and the bridges that move tokens between blockchains.

Mt. Gox, 2014. The Tokyo exchange, then the largest bitcoin platform, suspended trading and sought bankruptcy protection in February 2014 after announcing that about 850,000 bitcoins belonging to customers and the company were missing, worth about 450 million dollars at the time, Fortune recalled on 26 January 2018. About 200,000 of them were later found in an old wallet. Customers waited years for repayment through the bankruptcy process.

Coincheck, 2018. On 26 January 2018 the Japanese exchange reported that 523 million NEM tokens had been sent from its wallet, worth 58 billion yen, or about 530 million dollars, Dark Reading reported. The tokens were held in an online wallet rather than in offline storage. Coincheck said two days later it would use its own funds to repay about 46.3 billion yen to some 260,000 affected customers, Gulf News reported.

Ronin, 2022. In March 2022 attackers took about 620 million dollars in ether and USDC from the Ronin bridge, which serves the game Axie Infinity, after gaining control of enough validator keys to approve withdrawals. On 14 April 2022 the FBI attributed the theft to the North Korean groups known as Lazarus and APT38, BleepingComputer reported.

DMM Bitcoin, 2024. In late May 2024 the Japanese exchange lost 4,502.9 bitcoins, worth about 308 million dollars at the time. On 23 December 2024 the FBI, the US Defense Department's Cyber Crime Center and Japan's National Police Agency attributed the theft to TraderTraitor, a North Korean group, saying it had manipulated a legitimate transaction request after an employee of a wallet software supplier was approached by a fake recruiter, The Record reported. DMM Bitcoin later closed and transferred its accounts to SBI VC Trade.

Bybit, 2025. On or about 21 February 2025 the Dubai-based exchange lost about 1.5 billion dollars in virtual assets, mostly ether, the largest theft on record. In a public service announcement on 26 February 2025 the FBI said North Korea was responsible, under the name TraderTraitor, and that the thieves were converting assets into bitcoin and other tokens across thousands of addresses on several blockchains.

Bitget, 2026. On 24 September 2026 Bitget detected unauthorised transfers from its hot and warm wallets and suspended withdrawals. It first estimated the loss at 351.6 million dollars, then raised it to 387.5 million after on-chain tracing. The company said attackers had breached a backend system of its wallet infrastructure and spoofed transaction data to trigger its own authorisation process; it said user balances were unaffected, its Protection Fund covered the loss, and it attributed the attack to North Korean hackers, BleepingComputer reported on 28 September 2026.

The totals. Chainalysis counted more than 3.4 billion dollars stolen from January to early December 2025, of which at least 2.02 billion, about 60 percent, was attributed to North Korea; the three largest hacks made up 69 percent of losses at services, according to its report of 18 December 2025. For 2026, CertiK counted 658 incidents and about 2.68 billion dollars in gross losses through September, with about 420.4 million frozen or returned; September, at about 766.5 million dollars, was the worst month of the year, CryptoSlate reported on 2 October 2026. Elliptic attributed more than 1 billion dollars of 2026 thefts to suspected North Korean operations.

What the cases teach. First, losses are concentrated: a few large breaches account for most of the money. Second, the target has shifted from code to people and processes, with fake recruiters, compromised suppliers and spoofed approval screens. Third, the way an exchange holds assets matters as much as its size: funds kept in offline cold storage were not touched at Bitget, while Coincheck's tokens sat in an online wallet. Fourth, recovery depends on the platform's own capital, as at Coincheck and Bitget, or on a long insolvency process, as at Mt. Gox. Rules such as MiCA in Europe now require segregation of client assets and custody policies, but they do not remove operational risk.

Why it matters: for anyone who holds crypto, the question is not only which token to own but who holds the keys, how much sits on an exchange and for how long, and what happens if the platform is breached.

Unicorn Club, the members-only club of Unicorn Private for pre-IPO club deals, accepts BTC, ETH, USDT and USDC on ERC-20; payments are confirmed on the blockchain, and members can send them from a self-hosted wallet or from an exchange account. The guide How to invest in pre-IPO companies with crypto explains the steps. This article is general information, not personalised advice. Investing involves the risk of losing capital.

Sources

More news

This page in other languages

IPO forecasts from the Unicorn Watch community

Newsletter

Research on unicorns and pre-IPO companies, by email. No spam, unsubscribe at any time.

Subscribe on Substack