The crypto industry recorded more than 1,000 security incidents between January 2022 and October 2026, according to a Foresight News review. Within that period, at least 28 major cases involved initial amounts above $100 million, with a combined figure of more than $14.2 billion.
On that basis, the industry saw one nine-figure security incident roughly every two months over nearly five years. Using the broader DeFiLlama security incident database, the article says the sector averaged about 18 incidents a month during the same period, or about one every two days.
The largest case in the review was the Binance security incident in October 2026, with an official preliminary estimate of about $6.3 billion in impact. The second-largest was the Bybit incident in February 2025, involving about $1.46 billion.
Foresight argues that losses from individual attacks are getting larger and that major incidents are also becoming more frequent. In its framing, crypto is no longer dealing with isolated breaches but with a sustained security test.
Centralized exchanges and cross-chain bridges accounted for half of the biggest incidents
After breaking down the 28 major cases, the article identifies centralized exchanges and cross-chain bridges as the two most heavily hit areas.
Seven of the 28 incidents involved centralized crypto exchanges, or one-quarter of the total. Based on the initial amount tied to each event, the list includes:
- Binance: $6.3 billion
- Bybit: $1.46 billion
- FTX: $477 million
- Bitget: $351.6 million
- DMM Bitcoin: $305 million
- WazirX: $235 million
- Poloniex: $120 million
Those seven exchange-related attacks totaled $9.2486 billion.
Another seven incidents were tied to cross-chain bridges and related infrastructure. Foresight says bridges rely on trust mechanisms across different blockchains, and failures in validator nodes, signing systems, or message verification can open large asset gaps.
- Ronin Network: $625 million
- BNB Chain Bridge: $586 million, with actual outflows of about $120 million
- Wormhole: $326 million
- KelpDAO: $292 million
- Nomad Bridge: $190 million
- Multichain: $125 million
- Harmony Horizon Bridge: $100 million
In KelpDAO’s case, the article notes that the project’s main business is liquid restaking, but the attack entry point involved the rsETH bridge.
Taken together, centralized exchanges and cross-chain bridges accounted for half of the 28 major incidents in the review.
Not every attacker kept the funds
The article also points to two white-hat cases.
After the 2022 Nomad Bridge attack, some participants said they had taken funds to protect assets and later returned about $36 million.
Liquid Network was presented as a more unusual example. In September 2026, an attacker who described themselves as a white hat exploited a vulnerability to move about 4,000 BTC, later returned about 3,400 BTC, and still kept about 598.5 BTC.
North Korean-linked groups featured prominently in major cases
Foresight says North Korean hackers have built a professionalized cyberattack system that has long targeted financial systems, companies, and government agencies around the world for money and intelligence.
Earlier operations were more focused on traditional finance. The article cites the 2016 Bangladesh central bank breach, in which attackers used the SWIFT system to initiate about $951 million in fraudulent transfers and ultimately moved $81 million.
As crypto expanded, exchanges, wallets, cross-chain bridges, and DeFi protocols became major targets. Of the 28 major crypto security incidents in the review, 10 were either explicitly attributed, or attributed with relatively high confidence by security firms, to North Korean-linked hacking groups.
Attack methods are shifting from code to people
The article says the tactics and preferences of North Korean-linked actors are changing. Rather than looking only for smart contract flaws, they are increasingly targeting people.
According to the report, North Korean-linked operatives may fake identities to apply for remote jobs at crypto companies. Attackers may also pose as recruiters, business partners, or investment institutions, spend time building trust with teams, and then look for openings into employee devices, development environments, and critical signing processes.
Foresight presents the Bybit theft as a representative case. It says the attackers did not directly break into Bybit’s core systems. Instead, they first compromised the work environment of a Safe developer, manipulated what appeared on the multisig transaction interface, and induced Bybit signers to approve a malicious transaction, leading to the transfer of about $1.46 billion in assets.
The Drift Protocol case was described as even more deceptive. Based on Drift’s post-incident investigation, the attackers spent months building a relationship with the team while posing as a quantitative trading group. They then used Solana’s Durable Nonce mechanism to induce security council members to sign transactions in advance. Those pre-signed transactions were later executed, giving the attackers control over Drift governance and allowing them to move about $290 million in assets. Security firms believe the attack shows signs of a North Korean link, though attribution still requires more confirmation.
Foresight adds one important caveat: all figures in the article are based on initially disclosed stolen amounts, abnormal asset sizes, or preliminary impact estimates. They do not necessarily equal final net losses. Some incidents involved freezes, recoveries, or abnormal minting, so actual losses may differ from the initial figures.
