Hacks & losses

An early miner's wallet file was stolen from his computer; 25,000 BTC moved out overnight. The first big theft in Bitcoin's history.

Fate: Never recovered.

Nine fake Silk Road accounts and 140+ rapid withdrawals tricked the marketplace into releasing about 50,000 BTC.

Fate: Seized by US authorities on 9 Nov 2021 (about 50,676 BTC); Zhong pleaded guilty to wire fraud in 2022.

The largest exchange of its time stopped withdrawals and filed for bankruptcy; about 850,000 BTC were reported missing after years of undetected theft.

Fate: 200,000 BTC were later found in an old wallet. The trustee began repaying creditors on 5 Jul 2024 (about 142,000 BTC owed).

Hackers drained the exchange's operational hot wallets of fewer than 19,000 BTC.

Fate: The exchange covered the loss; customer balances held before the suspension were honored in full.

More than 2,000 unauthorized transactions sent 119,754 BTC from Bitfinex to the hacker's wallet.

Fate: US authorities seized 94,643 BTC in Feb 2022 and 16,514 BTC more later. Ilya Lichtenstein admitted the hack and was sentenced to 5 years in Nov 2024.

Attackers broke into the Japanese exchange's hot wallets and took 5,966.1 BTC plus BCH and MONA (about ¥7 billion in total).

Fate: Not recovered; the business was transferred to Fisco in Nov 2018.

A large-scale breach of Binance's hot wallet: 7,000 BTC stolen in one transaction.

Fate: Binance covered users from its emergency SAFU fund.

North Korean TraderTraitor hackers compromised a wallet-software vendor and manipulated a legitimate transfer: 4,502.9 BTC lost.

Fate: DMM replaced customers' bitcoin with group loans and later closed the exchange. Attribution: FBI, DC3 and Japan's NPA (Dec 2024).

A build/link error in Coldcard firmware from March 2021 (Mk2/Mk3 4.0.1–4.1.9, plus affected Mk4/Mk5/Q releases) made seed generation use MicroPython's software PRNG instead of the hardware RNG. Effective seed strength fell from 128 bits to ~40 bits on Mk2/Mk3 and ~72 bits on Mk4/Q/Mk5 (Coinkite's preliminary estimates). From 30 July 2026 attackers regenerated weak seeds offline and swept single-sig wallets in several waves; the devices themselves were not hacked.

Fate: Galaxy Research (14 Aug 2026): 1,778.84 BTC (~$112.7M) confirmed stolen from 8,600+ addresses; up to 2,417.35 BTC if unconfirmed footprints and 'Wave 4' are included. Earlier tallies: 1,596 BTC confirmed / 2,055 BTC with Wave 4 (Galaxy, 3 Aug) and ~1,816 BTC (TRM, 5 Aug). 1,531 BTC sat unmoved at attacker addresses; no multisig wallet was hit. Coinkite shipped fixes: 4.2.0 (Mk2/Mk3), 5.6.0 (Mk4/Mk5), 1.5.0Q (Q), Edge 6.6.0X/6.6.0QX. Updating does not repair an old seed.

Reported range 1,596–2,417 BTC depending on what is counted; the total uses Galaxy's latest high-confidence figure.

Physical supply-chain attack on Ledger signers sold by the Southeast Asian reseller CryptoBilis (Indonesia, Malaysia, Philippines). Ledger's Donjon team found an unauthorized LTE/eSIM implant soldered inside the enclosure: during setup it reads the 24-word recovery phrase off the screen and transmits it over the mobile network. It does not modify the Secure Element, Ledger OS, transactions or signatures. Ledger says its software, systems and services were not breached. Not related to the 2020 data leak or the 2023 Connect Kit incident. On 9 Oct 2026 (from 05:07 UTC) one actor drained hundreds of wallets on 6 chains within an hour, after two weeks of test runs; on Bitcoin, 111 wallets were swept in a single block at 05:54 UTC.

Fate: Losses (not confirmed by Ledger, which says it has not verified the number of victims or the total): Bitquery (13 Oct) counts $102.0M from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain, Polygon, incl. 203.8 BTC (~$16.8M at $82,300) from 122 Bitcoin wallets, sitting unmoved in two drain addresses; most of the rest was USDT on TRON. Earlier: >$86M (on-chain investigator Specter, 10 public addresses); ~$91M / 213.42 BTC (Alex Thorn, includes a third BTC address Bitquery treats as separate). Tether froze $10.0M USDT; ~6,840 ETH laundered via Tornado Cash and Zcash; ~$84M still traceable on-chain as of 13 Oct 09:24 UTC. Status: ongoing. Ledger (13 Oct) asked resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to pull devices; all confirmed drains involve CryptoBilis units. Unconfirmed: MediaMarkt Saturn halted Ledger sales in Europe after a tampered unit in Germany (no loss reported); Mark Karpelès reported an implant in a Ledger Flex bought at Singapore airport — Ledger has not linked it.

Reported Bitcoin loss 203.8–213.42 BTC (Bitquery vs Alex Thorn); total across all chains $86M–$102M (Specter vs Bitquery). The BTC total uses Bitquery's lower figure.