Biteye has published a chronological review of publicly disclosed hacks involving centralized exchanges, outlining the amount lost in each case and the cause described in public records. The article says more than 30 major CEX thefts were recorded between 2014 and 2026, with total losses estimated at about $11.3 billion to $11.4 billion based on token prices at the time of each incident.
It adds that 15 of those cases were officially attributed, or suspected by security organizations, to North Korean hackers, involving about $10.1 billion, nearly 90% of the total counted in the review. The attack path has also changed over time, from early hot wallet private key theft to employee phishing, tampered multisig interfaces, and supply-chain attacks.
2014 to 2020: hot wallets and private keys were the main weak points
In February 2014, Mt.Gox said about 850,000 BTC had gone missing, worth roughly $450 million to $480 million at the time. The platform later recovered about 200,000 BTC. According to the review, investigators found that attackers may have gained access to server systems and wallet private keys as early as 2011 and kept draining assets over time. The prolonged theft, combined with internal management failures, eventually pushed Mt.Gox into bankruptcy.
In January 2015, Bitstamp lost about $5 million. Attackers used social engineering to approach employees and sent a file containing malware to a system administrator. After the file was opened, the administrator's computer was compromised and files containing hot wallet information were stolen.
Bitfinex lost about $71 million in 2016. Biteye says the exchange was using BitGo to manage multisig wallets at the time. After obtaining relevant credentials and API permissions, the attackers raised withdrawal limits and bypassed the existing multisig protections to complete transfers.
In 2018, Coincheck lost about $530 million. The exchange had stored 523 million XEM in a hot wallet without multisig protection. After an employee computer was infected with malware, the attackers gained control of the wallet and moved the funds. That same year, Bithumb lost about $31.5 million after a hot wallet was compromised, though the exact intrusion path was not disclosed. Zaif also suffered a hot wallet breach, with bitcoin, bitcoin cash, MonaCoin, and other assets stolen, for losses of about $60 million.
In 2019, Cryptopia lost about $16 million after multiple hot wallets were attacked. Funds continued to flow out after the incident, which the article says suggests the attackers had already obtained the relevant private keys and the exchange could not cut off their control in time. Binance lost about $40.7 million that year after attackers used long-running phishing and malware campaigns to collect user API keys and two-factor authentication information, then launched a coordinated withdrawal that moved 7,000 BTC from a hot wallet. Upbit also saw 342,000 ETH moved out of its hot wallet, worth about $49 million by the article's estimate, though public records did not disclose how wallet access was obtained.
In 2020, KuCoin lost about $280 million after private keys for multiple hot wallets were exposed. That gave attackers control of the wallets, allowing them to move bitcoin, ether, and a large number of ERC-20 tokens.
2021 to 2023: warm wallets, multi-chain hot wallets, and bridge-linked systems came under pressure
Liquid lost about $97 million in 2021 after its warm wallets were compromised and bitcoin, ether, and other tokens were moved out. The article notes that warm wallets are not continuously online, but they still remain connected to network systems and can still fail if permissions are lost. BitMart also suffered a theft that year after private keys for hot wallets on Ethereum and BNB Smart Chain were stolen. Attackers moved tokens in bulk and swapped them through decentralized trading platforms, with losses estimated at about $196 million.
In 2022, Crypto.com lost about $33.8 million. Attackers bypassed the exchange's two-factor authentication process and moved bitcoin, ether, and other assets out of 483 user accounts.
In 2023, CoinEx lost about $54 million to $70 million after hot wallet private keys were exposed, giving attackers control over wallets across multiple chains. Poloniex lost about $114 million to $130 million after a hot wallet was attacked and large amounts of tokens were quickly moved and swapped. Biteye says the attackers likely had private keys or equivalent permissions.
That same year, HTX hot wallets and the Heco cross-chain bridge both saw abnormal transfers, with combined losses of about $113 million. The article says both incidents pointed to compromised private keys or high-privilege accounts. Heco is not a centralized exchange, but Biteye included it in the same count because of its close relationship with HTX.
2024 to 2025: multisig interface tampering, fake recruiting, and supply-chain attacks became more visible
DMM Bitcoin lost about $308 million in 2024. According to the review, attackers approached an employee at a wallet service provider under the pretense of recruitment, tricked the person into running a malicious script, then altered a transfer request and sent 4,502.9 BTC to an attacker-controlled address. BtcTurk lost about $55 million after multiple hot wallets were compromised. The exact intrusion method was not disclosed, but the attackers clearly gained control of the hot wallets.
WazirX lost about $230 million. Biteye says the content shown to multisig signers in the interface did not match what was actually executed on-chain. Attackers exploited that "what you see is not what you sign" gap, induced signers to approve a malicious transaction, then upgraded the wallet contract and moved the assets. Indodax lost about $22 million after multiple hot wallets were attacked. The intrusion path was not disclosed, but the article says the attackers obtained transfer authority over the wallets. BingX also saw abnormal outflows from hot wallets on multiple chains, with losses estimated at about $43 million to $52 million. Public materials did not disclose the entry point, though the article says the attackers may have controlled private keys or the wallet system.
In 2025, Phemex lost about $70 million to $85 million after assets were drained from hot wallets across multiple chains. The platform did not disclose the initial intrusion path, but the attackers clearly gained control over several wallets.
Bybit lost about $1.5 billion, one of the largest single incidents in the review. Biteye says attackers compromised the Safe wallet front end and altered the transaction details shown to multisig signers. The signers believed they were approving a normal transfer, but what they actually signed was a malicious transaction that changed wallet control. About 400,000 ETH were then moved out.
Nobitex lost about $90 million. The article says the attackers sent assets to special addresses that nobody could control, effectively destroying the funds. It describes the main purpose of the attack as political sabotage rather than profit. BigONE lost about $27 million in a supply-chain attack after attackers entered the exchange's server environment and altered runtime logic so the system would transfer assets according to their instructions.
CoinDCX lost about $44.2 million. Biteye says an engineer was lured by a fake part-time job and installed malware on a work computer. The attackers then used the compromised endpoint to enter the exchange system and moved assets from an internal operations account. BtcTurk suffered another abnormal hot wallet transfer in 2025, with losses of about $48 million to $54 million. The intrusion method was not disclosed. Upbit also lost about $30.4 million that year after an administrator account was abused and unauthorized withdrawals were initiated from a Solana hot wallet.
2026: security devices and signing authority remained exposed
The article describes 2026 as a year in which security devices and signing permissions continued to fail. Bitget lost about $387.5 million after attackers used a zero-day vulnerability in a third-party security device to enter wallet servers, then forged transactions and moved assets. Biteye says the point of compromise was not Bitget's own system, but an external security product.
Binance saw about $6.3 billion in assets affected. According to the review, a DevOps engineer's computer was compromised, allowing attackers to enter internal service containers and submit unauthorized withdrawal transactions. About $3 billion had been frozen at the time of writing, while the final loss was still being counted.
What the review concludes
Biteye says major CEX thefts are becoming more frequent and more expensive. By its count, 12 major incidents took place in 2024 and 2025, close to the total seen across the nine years from 2014 to 2022. It also says the amount stolen, or otherwise affected, in 2025 and 2026 accounted for more than 70% of the total in its dataset.
The article adds that, beyond the growth in assets held by exchanges, AI is also improving the efficiency of attackers. It says AI can help collect employee information quickly and generate phishing emails, fake recruiting materials, and malware at scale.
Biteye ends with a user-facing security reminder: avoid clicking links in emails or direct messages, enable Passkey, hardware keys, and withdrawal address whitelists where possible, and regularly remove API permissions that are no longer in use.
