The biggest Bitcoin and crypto thefts in history

Bitcoin has security as one of its greatest features. Among its fundamental aspects is protecting the privacy of users, avoiding theft of assets and avoiding harmful practices such as double spending. That Bitcoin implements important security measures does not mean that it is inviolable or in other words, that there can be no cases of theft of Bitcoin or other cryptocurrencies.

For decades banks have been expanding and improving security mechanisms to prevent robberies and even so, they continue happening. Bitcoin is not even ten years old and there is still a lot of work to do in making the system much more secure.

There are many methods by which a third party can be done with our funds. The most common are behind Ponzi-type pyramid schemes and fraudulent pages asking for our private key. Although these actions are of high importance that deserves to be monitored, attacks on exchanges that steal users' money and exploit security holes in wallets are even more serious.

We will see some of the biggest thefts of Bitcoin and also of other cryptocurrencies, because all the cryptocurrencies on the market have value and all are liable to be stolen.
In this post we will deal with the largest thefts, and therefore the most notorious, but in the following button you have access to an external resource with an extensive complete list:

Chronicle of insecurity: The biggest Bitcoin thefts in history

If the last decade has taught us anything, it's that code is law, but human error and infrastructure gaps are the downfall. The following cases aren't just figures of losses; they are the scars that have shaped the current robustness of our crypto assets.

The systemic collapse of Mt. Gox

Estimated figure: Between 640.000 and 850.000 BTC

Located in Shibuya, Tokyo, this platform launched on July 18, 2010. What began as a collectible card trading portal ended up managing the bulk of the global market. However, its structure was a giant with feet of clay that finally collapsed on February 25, 2014.

We can break down this disaster into two critical phases:

The first warning (June 2011): An attacker managed to steal 25.000 BTC. The lack of transparency fueled theories about a possible inside job, even pointing the finger at Jed McCaleb, although no solid evidence ever surfaced. The thief's trail led us to IPs in Hong Kong after a clumsy money laundering attempt, but the funds vanished into thin air.

The Final Blow (2013-2014): By the end of 2013, insolvency was an open secret. A subsequent audit revealed that the drain of 744.408 BTC had been a “silent leak” for years. No one stopped the flow. To this day, the liquidation and compensation process remains a legal labyrinth that tests the patience of creditors.

The zombie network 'Pony'

Social ImpactMillions of compromised devices

Sometimes a large-scale attack against a centralized infrastructure isn't necessary; infecting users' computers is enough. Between September 2013 and January 2014, the Pony botnet demonstrated that personal security is the weakest link.

Using malware, attackers took control of millions of machines. They only needed one line of code to extract the private keys from local wallets. They made off with approximately $220.000 worth of various tokens at the time. The lesson? If you use a software wallet on a network-connected computer without taking precautions, you're playing Russian roulette.

Silk Road: The FBI's loot and internal corruption

Figure: 173.655 BTC

The Silk Road case straddles the line between cybercrime and state intervention. This Dark Web marketplace was dismantled by US authorities in October 2013, in an operation that seized nearly 30.000 BTC from the site and another 144.000 BTC belonging to its founder, Ross Ulbricht.

What makes this case fascinating—and murky—is the police corruption scandal. During the investigation, officers Shaun Bridges and Carl Force tried to pocket between $700.000 and $1 million. They ended up in prison with sentences of nearly seven years, proving that greed knows no badges or protocols.

Bitfinex: The hack that couldn't take down the platform

Figure: 121.256 BTC

Bitfinex has survived what would have sunk any other company. After a small warning in May 2015 (1.500 BTC stolen), the big blow came on August 2, 2016. A massive breach allowed the theft of almost 120.000 BTC.

Unlike Mt. Gox, the platform opted for a strategy of socializing losses and issuing debt to compensate users. It was a risky move that, surprisingly, worked: most of those affected recovered the value of their digital assets, and the exchange continues to operate with enhanced security today.

The abrupt closure of BitFloor

Figure: 24.000 BTC

BitFloor was the jewel of New York until September 4, 2012, when an attack emptied its coffers. The attackers accessed the keys to the "hot wallet" and made off with 24.000 BTC. The crisis management was disastrous: after promising refunds that ceased in December 2012, the platform stopped responding to customers and finally shut down on April 17, 2013, under suspicion of money laundering.

YouBit and the North Korean siege

Figure4.000 BTC and 17% of its total assets

South Korea has always been a hub for cryptocurrency activity, making it a prime target. YouBit suffered two attacks in a single year: the first in April 2017 and the second on December 19, 2017. After losing nearly a fifth of its equity, the company filed for bankruptcy. It's a stark reminder that, in this industry, second chances are rarely given if your security architecture fails twice.

NiceHash: The blow to cloud mining

Figure: 4.700 BTC

Even those who didn't directly buy tokens were affected. In December 2017, NiceHash, the mining giant, saw its payment wallets drained. Mark Kobal, the firm's CEO, confirmed the theft of 4.700 BTC. Unlike others, NiceHash implemented a systematic refund plan that allowed them to regain the community's trust and continue operating to this day.

Vulnerabilities beyond Bitcoin: The siege on altcoins

While Bitcoin often grabs the headlines, the ecosystem of digital assets It has suffered equally devastating blows on its alternative networks. In fact, the complexity of smart contracts and cross-chain interoperability have opened vulnerabilities that attackers have exploited with alarming creativity. Are altcoins a testing ground for hackers? The data suggests so.

Coincheck and the negligence of hot storage

Date: January 26, 2018 | Figure: 523 million NEM

The Japanese exchange Coincheck was at the center of one of the most shameful episodes in digital financial history. The theft of 523 million NEM tokens (worth approximately $534 million at the time) was not due to a complex protocol flaw, but rather to a complete lack of basic security management.

Since the platform stored funds in a simple hot wallet—connected to the internet and without multi-signature authentication—the attackers only needed to obtain a single private key to empty the coffers. Unlike other cases, the exchange survived, initiating a refund plan on March 12th 2018 and subjected to extreme surveillance by the Japanese authorities, who did not forgive such technical oversight.

The DAO: When the code turns against its creator

Date: June 17, 2016 | Amount: 3,6 million Ether

Ethereum wouldn't be what it is today without the trauma of The DAO. This crowdfunding project aimed to create an autonomous organization, but a bug in its code allowed a third party to drain 3,6 million ETH. The most bizarre aspect was the attacker's attitude, who cynically claimed that his action was legal because it was permitted by the rules written in the smart contract.

This incident forced the community to make a drastic decision: to perform a hard fork to recover the funds. This split the network in two, giving rise to what we know today as Ethereum Classic. It was the first major lesson about the risks of decentralized governance: Is code truly law if we can change it when we lose money?

The double disaster of Parity Wallet

Dates: July 19 and November 8, 2017 | Amount: 153.000 ETH stolen / 513.774 ETH frozen

Gavin Wood, one of the minds behind Ethereum and Parity, had a year to forget in 2017. The story of Parity is a tragedy in two acts:

1. The robbery (July): A flaw in version 1.5 of the utility allowed an anonymous attacker to steal 153.000 ETH from several wallets.
2. Freezing (November): While the ecosystem was still recovering, a user nicknamed 'devopps199' allegedly caused the permanent lockup of over 500.000 ETH in multi-signature wallets by mistake. While attempting to fix a library, he deleted the code that allowed the funds to be moved. Currently, those token usage They remain trapped in the blockchain, like a digital monument to the fragility of software.

CoinDash: The repentant hacker (or extreme marketing)

Date: July 17, 2017 | Amount: 43.400 ETH returned

The CoinDash case seems straight out of a spy novel. During its ICO, an attacker changed the receiving wallet address, diverting investors' funds. However, in an unprecedented plot twist, the attacker began returning the money in several installments between September 2017 and March 2018.

Many analysts questioned whether this was a genuine attack or a marketing ploy by the founders themselves to gain notoriety. Regardless, it is the only relevant case where the loot ultimately exceeded the original loss due to the asset's appreciation during the repayment process.

The Kelp DAO disaster and the winter of the bridges

Date: February 15, 2026 | Amount: $290 million in mixed assets

Looking at the current situation, attacks have evolved towards bridges or bridges between networks. The exploit of Kelp DAO This is the most recent and technical case on our list. Attackers exploited a vulnerability in the interchain messaging protocol, allowing the generation of synthetic assets without any real backing.

This incident has reopened the debate about whether full interoperability is an unacceptable risk. Today, security no longer depends solely on your own code, but on the robustness of all the networks you interact with. What good is fortifying your house if the bridge leading to it is about to collapse?

FAQ – The biggest Bitcoin and cryptocurrency thefts in history