Historical Timeline of Major Crypto Platform Hacks & Exploits (2011-2026)

The risk of hacking of exchange platforms and DeFi protocols is no longer a “residual operational risk”: it has become a systematic pricing factor for any crypto exposure, whether on-balance-sheet, collateral-based, or as a market maker. The cumulative losses from the 24 major incidents recorded between June 2011 and October 2026 amount to approximately 10.945 billion USD, including 6.3 billion USD for the single Binance episode of October 2026. The extreme concentration of the distribution tail, the Bybit episode of February 2025 alone accounted for 44% of the losses in 2025 and 32% of the cumulative losses for 2024–2025, invalidates any classical mean-variance approach.

The problem that investors, treasurers and regulators pay us to solve is threefold:

• Quantify ex ante the probability and severity of an “extreme loss” event on a given platform counterparty, taking into account the dependence between platforms (liquidity contagion, correlation of state attack vectors).

• Properly price the cost of this risk in yield strategies (yield farming, market making, collateral posting), that is, turn a qualitative “safety” judgment into a quantified cyber risk spread, comparable to a CDS spread.

• Reduce the reaction time between detection of an on-chain anomaly and deactivation of an exposure, which is currently measured in hours, while sophisticated attacks execute in less than 20 minutes across 10 blockchains simultaneously.

The service we offer is deliberately simple in its interface | a daily counterparty cyber risk index (Crypto-Counterparty Cyber Risk Index, CCCRI), broken down by platform and by aggregated portfolio | but it relies on a heavy quantitative architecture. It is distributed through a direct institutional channel (API, terminal, regulatory reports) to risk desks, crypto treasuries and compliance functions, with outreach to regulators via prudential stress tests.

The table reconstructs the chronology of major incidents on centralized exchanges (CEX) and, from 2026 onward, on critical DeFi protocols, with amounts in nominal USD at the time of the incident unless otherwise noted, the primary source for 2011-2026 being the BlockBeats inventory, supplemented by Chainalysis and SlowMist for 2025-2026. The incidents listed range from the key compromise at Mt. Gox in June 2011 (≈$450M, 850,000 BTC) to that at Binance in October 2026 (≈$6.3B gross, ≈$3B frozen) across 10 blockchains via a DevOps device and EIP-7702.

In between, notable incidents include Bitstamp in January 2015 (≈$5M), Bitfinex in August 2016 (≈$72M), Coincheck in January 2018 (≈$523M NEM), Zaif in September 2018 (≈$60M), Binance in May 2019 (≈$40M, 7,000 BTC), UPbit in November 2019 (≈$49M ETH), KuCoin in September 2020 (≈$285M), BitMart in December 2021 (≈$196M), Crypto.com in January 2022 (≈$34M), FTX in November 2022 (≈$477M, internal fraud), Deribit in November 2022 (≈$28M), DMM Bitcoin in May 2024 (≈$305M BTC), BtcTurk in June 2024 (≈$55M), WazirX in July 2024 (≈$230M), BingX in September 2024 (≈$43M), Phemex in January 2025 (≈$85M), Bybit in February 2025 (≈$1.5B ETH, attributed to Lazarus), BigONE in July 2025 (≈$27M), a Tether merchant in February 2026 (≈$120M), Poloniex in March 2026 (≈$70M), HTX in April 2026 (≈$80M), KelpDAO in April 2026 (≈$293M, with Aave contagion), CoinEx in June 2026 (≈$54M), and Bitget in September 2026 (≈$387.5M, via third-party zero-day).

Three regimes follow one another: 2011-2019, that of private keys and operational immaturity, with unit losses below ≈$0.5B USD and a dominant vector of hot wallet or API key compromise; 2020-2025, that of state-sponsored industrialization, with Lazarus emerging and changing the scale (losses in the billions, Bybit 2025, and in 2025, $2.02B out of $3.4B stolen, ≈60%, attributed to Lazarus); 2026, that of the distributed attack surface and DeFi-CeFi contagion, illustrated by KelpDAO (bridge flaw, liquidity shockwave on Aave), Bitget (dependence on a third-party zero-day), and Binance (compromise of a DevOps device, EIP-7702, gross $6.3B of which about half was frozen on-chain).

Theoretical framework: from mosaic theory to tail modeling

Mosaic theory holds that informational value resides not in a single signal but in the aggregation of public and private fragments that reveal vulnerabilities or intentions. Applied to crypto platforms, it provides the epistemological framework for the detection mechanism. The mosaic degree M_t(p) for a platform p at time t is derived from a non-additive aggregation (e.g., copula or Choquet operator) of nonlinear transformations φ_j of fragment sources (on-chain logs, security provider telemetry, governance signals, stablecoin movements, bridge governance data), weighted by coefficients ω_j calibrated via maximum likelihood on historical incidents. Two individually innocuous fragments can become critical when combined. The approach aligns with the WEF Global Cybersecurity Outlook 2025 recommendation and with BIS work on exchanges as “shadow banks.” The empirical loss distribution for 2011–2026 is heavy-tailed and non-stationary. Gaussian VaR at 99% underestimates risk: for Bitcoin, it is ≈8.1% daily versus ≈10.5% empirically. Losses L are modeled as a power-law process P(L>x)∼ℓ(x)x^(-α), with α∈(0,2). Work by Cirillo (2022) shows this form better captures “billion-dollar” events. The expected shortfall ES_κ(L) for a Pareto tail is (α/(α-1))VaR_κ(L) when α>1. Three incidents above $1 billion in 20 months (Bybit, KelpDAO with direct loss and contagion, Binance) suggest a regime change. A stability test of the Chow or sup-F type rejects stability at the 1% level. A Markov regime-switching model (HMM) is introduced for (α_t, σ_t) with three states — Low Risk, Moderate Risk, High Risk/State-Sponsored — with transition probabilities from Hamilton filtering.