Over the past five years, the crypto industry has recorded more than 1,000 security incidents, 28 of which were major events involving associated value exceeding $100 million.
Written by Joe Zhou, Foresight News
This is the "golden age" for hackers.
Per the author’s statistics, at least 28 major security incidents involving over $100 million in associated losses have occurred in the crypto industry across the five-year window from January 2022 to October 2026.
This means that over the past nearly five years, the crypto industry has on average seen one $100-million-scale major security incident every two months.
The total value involved in these 28 incidents alone has exceeded $14.2 billion.
The largest of these incidents was the Binance security breach in October 2026, where official preliminary estimates put the total affected value at roughly $6.3 billion. This was followed by the Bybit security incident in February 2025, involving around $1.46 billion in assets.
Hacking incidents targeting the crypto industry are not only generating larger per-event losses, but also occurring with growing frequency.
If we expand our scope beyond these 28 high-value incidents, data from the DeFiLlama security incident database shows that the crypto industry has logged over 1,000 total security incidents between January 2022 and October 2026. This equates to roughly 18 incidents per month, or one security event every two days.
With losses scaling from hundreds of millions to billions of dollars, and attacks shifting from rare, isolated events to high-frequency occurrences, the crypto industry is facing a sustained, ongoing security challenge.
Two Hardest-Hit Sectors
Which areas should hackers target to maximize their returns?
The answer: centralized exchanges and cross-chain bridges.
After analyzing the 28 major security incidents involving over $100 million across the five-year period, the author found that 7 of them took place on centralized crypto exchanges, accounting for one quarter of all high-value incidents.
Calculated by the initial value of funds involved in each event, the seven incidents are as follows: $6.3 billion at Binance, $1.46 billion at Bybit, $477 million at FTX, $351.6 million at Bitget, $305 million at DMM Bitcoin, $235 million at WazirX, and $120 million at Poloniex.
Total assets involved in these seven exchange-targeted hacks reached as high as $9.2486 billion.
The second most targeted category is cross-chain bridges, a critical piece of crypto industry infrastructure. Of the 28 major security incidents, 7 are related to cross-chain bridges and other cross-chain infrastructure.
Cross-chain bridges typically require the establishment of trust mechanisms between disparate blockchains. Any failure in validator nodes, signing systems, or message verification processes can lead to large-scale asset gap exposures.
Ranked by the total value of stolen assets, the seven cross-chain bridge-related security incidents are: the $625 million hack on Ronin Network, the $586 million incident on BNB Chain Bridge (with roughly $120 million in actual transferred assets), the $326 million breach on Wormhole, the $292 million attack on KelpDAO, the $190 million exploit on Nomad Bridge, the $125 million incident involving Multichain, and the $100 million hack on Harmony Horizon Bridge. Note that KelpDAO’s core business is liquidity restaking, but the attack entry vector involved its rsETH cross-chain bridge.
Put another way, half of the 28 major security incidents occurred on centralized exchanges and cross-chain bridges, making these two sectors the most concentrated hotspots for ultra-high-value security events in the crypto industry.
Interestingly, not all hackers set out for "bare-faced plunder"; two white-hat hacking events occurred within this set of incidents.
For example, after the 2022 hack targeting Nomad Bridge, some participants acted as white-hat actors, claiming they took funds to protect assets, and eventually returned roughly $36 million worth of crypto.
The case of Liquid Network is even more unusual. In September 2026, the attacker identified themselves as a white-hat actor, exploited a vulnerability to transfer roughly 4,000 BTC, later returned around 3,400 BTC, and retained approximately 598.5 BTC.
White-hat hackers have brought a glimmer of light to this cyber attack-and-defense world that resembles a dark forest.
North Korean Hackers: Professional Predators
Every year, North Korean hackers come to the crypto industry to "withdraw funds".
They have built a highly professionalized cyber attack ecosystem, long targeting global financial systems, enterprises, and government institutions to steal funds and intelligence.
In their early operations, North Korean hackers primarily targeted traditional financial systems. As early as 2016, they hacked into the central bank of Bangladesh, initiated roughly $951 million in fraudulent transfers via the SWIFT system, and successfully moved $81 million out of the accounts.
But as the crypto industry has grown, North Korean hackers’ target set has shifted. Based on publicly disclosed major theft cases in recent years, crypto exchanges, wallets, cross-chain bridges, and DeFi protocols have become critical targets for their fund-raising activities.
Of the 28 major crypto security incidents the author tracked, 10 have been explicitly attributed, or attributed with high confidence by security firms, to North Korea-linked hacker groups.
More notably, the author found that North Korean hackers’ attack methods and preferences are also evolving: they are no longer solely focused on finding code vulnerabilities in smart contracts, but are increasingly targeting people.
North Korea-linked actors have even forged identities to apply directly for remote positions at crypto companies. At the same time, attackers will also impersonate recruiters, business partners, or investment institutions to build trust with project teams over long periods of engagement, before looking for opportunities to compromise employee devices, development environments, and critical signing workflows.
A man widely suspected by outside observers of having ties to North Korean hacker groups
The Bybit hack is a typical example. Instead of directly breaching Bybit’s core systems, attackers first compromised the work environment of Safe developers, manipulated the content displayed on the multi-sig transaction interface, induced Bybit’s signers to sign malicious transactions, and eventually transferred out roughly $1.46 billion worth of assets.
The attack on Drift Protocol was even more deceptive. Per Drift’s post-incident investigation, attackers spent months building relationships with the project team, disguising themselves as a quantitative trading team to gradually gain trust. They then exploited Solana’s Durable Nonce mechanism to induce Security Committee members to sign transactions in advance. These pre-signed transactions were later executed, ultimately granting attackers administrative permissions over Drift and enabling them to transfer roughly $290 million in assets. Security firms have noted signs linking this attack to North Korean hackers, but formal attribution remains to be confirmed.
From exchanges to cross-chain bridges, from code vulnerabilities to human trust, hackers are breaking through every line of defense in the crypto industry.
When billions of dollars in assets can change hands overnight, when a single act of trust can become an attack entry point, the speed at which this industry creates wealth appears to have already outpaced its ability to protect that wealth.
And this, precisely, is the "golden age" for hackers.
Note: The figures counted in this article refer to the initially disclosed stolen amounts, abnormal asset scale, or preliminary estimated affected value of each incident, and do not equate to final net losses. Some incidents involved asset freezes, recovered funds, or abnormal minting, so actual losses may differ from the initially reported involved amounts.