Crypto Hacks Explained: Biggest Hacks and How to Stay Safe
How crypto hacks happen, the biggest exchange and DeFi hacks including WazirX and CoinDCX, and steps Indian investors can take to protect their crypto.
Crypto hacks make headlines several times a year, and India has had its share: WazirX lost about $235 million in July 2024 and CoinDCX about $44 million in July 2025. For an ordinary investor, the lesson is not to avoid crypto altogether but to understand where the risks sit and how to limit them. This guide explains the main types of crypto hack, looks at the biggest cases, and lists practical steps to keep your own coins safe.
Key takeaways
- Most large losses come from attacks on exchanges, bridges and DeFi code, not on individual users.
- Individual users are mostly hit through phishing, SIM swaps, malware and fake apps.
- Coins held on an exchange depend on that exchange's security; self-custody shifts the risk to you.
- Authenticator 2FA, withdrawal whitelisting and never sharing a seed phrase stop most personal attacks.
How crypto hacks happen
Attacks on exchanges
Exchanges keep some funds in "hot wallets" connected to the internet so withdrawals are fast. Attackers target those wallets, the servers that control them, or the staff who approve transactions. In several recent cases, attackers tricked the people signing transactions into approving something different from what their screens showed.
Bridge and DeFi exploits
DeFi apps and cross-chain bridges run on smart contracts. A bug in the code, a stolen key or a manipulated price feed can let an attacker drain pooled funds within minutes. Read what DeFi is to understand the risk.
Attacks on individual users
- Phishing: fake login pages and fake support agents collect passwords and OTPs.
- SIM swap: criminals take over your mobile number to receive SMS OTPs.
- Malware: apps that read your screen or swap copied wallet addresses for their own.
- Wallet drainers: websites that ask you to "connect wallet" and sign an approval that lets them take your tokens.
- Address poisoning: tiny transfers from look-alike addresses, hoping you copy the wrong one from your history.
The biggest crypto hacks
| Year | Target | Approx. loss | What happened |
|---|---|---|---|
| 2014 | Mt. Gox | About 850,000 BTC | Years of undetected theft led to the collapse of the largest exchange of its time |
| 2018 | Coincheck | About $530 million | NEM tokens stolen from a hot wallet in Japan |
| 2021 | Poly Network | About $610 million | Bridge exploit; most funds were later returned |
| 2022 | Ronin bridge | About $625 million | Validator keys compromised on a gaming blockchain bridge |
| 2024 | WazirX (India) | About $235 million | Multisig wallet drained; users faced a long freeze and a court-supervised restructuring |
| 2025 | Bybit | About $1.5 billion | Largest theft on record; signers tricked into approving a malicious transaction |
| 2025 | CoinDCX (India) | About $44 million | Server breach hit an internal account; the exchange said customer funds were not affected |
| 2026 | Bitget | About $352 million | Exchange breach; see our report on the Bitget hack |
Figures are rounded US dollar values at the time of each hack. Several of the largest recent thefts have been attributed by investigators to hacking groups linked to North Korea.
What happens to users after an exchange hack
Outcomes depend on the exchange. Some cover losses from company reserves or an insurance fund, and users barely notice. Others pause withdrawals, "socialise" the loss across all users, or enter court-supervised restructuring, which can lock funds for months or years. Indian crypto holdings have no deposit insurance, so the exchange's reserves and honesty are your only protection. This is one reason to spread holdings and move long-term coins to self-custody.
How to protect your crypto
On exchanges
- Use an FIU-registered exchange with a clear security record; see the registered exchanges list.
- Use authenticator 2FA or a passkey, not SMS alone. See our crypto login safety guide.
- Turn on withdrawal address whitelisting and an anti-phishing code.
- Do not keep your whole portfolio on one platform.
In your own wallet
- Write your seed phrase on paper or metal, store it offline, and never type it into a website or share it. Read how to store a seed phrase safely.
- Consider a hardware wallet for larger amounts; see hot wallet vs cold wallet.
- Check the full address before sending, and send a small test first.
- Review and revoke old token approvals, and do not connect your wallet to unknown sites.
On your phone
- Install apps only from official stores; see how to download a crypto app safely.
- Keep the operating system updated, and avoid remote access apps.
- Ask your mobile operator about extra protection against SIM swaps.
If your crypto is stolen
- Move remaining funds to a new, safe wallet or account immediately.
- Contact your exchange through its official app so it can flag the addresses.
- Report at cybercrime.gov.in or call 1930, with transaction IDs and addresses.
- Ignore anyone offering to "recover" stolen crypto for a fee.
Also read how to avoid crypto scams in India and our report on 2026 DeFi losses and account takeovers.
Frequently asked questions
What is the biggest crypto hack ever?
The February 2025 attack on the Bybit exchange, with about $1.5 billion in Ethereum-based assets stolen, is the largest crypto theft on record.
Can Bitcoin itself be hacked?
The Bitcoin network has never been successfully hacked. Losses come from exchanges, apps, wallets and users being targeted, not from the underlying blockchain.
Is my crypto safe on an Indian exchange?
Registered exchanges use security measures, but hacks have happened in India and there is no deposit insurance. Use 2FA, spread your holdings and keep long-term coins in self-custody if you can manage it safely.
Can stolen crypto be recovered?
Sometimes. Exchanges and investigators can freeze stolen funds that reach regulated platforms, which is why fast reporting matters. Most stolen crypto is never fully recovered.
This article is AI-assisted, educational and general in nature. It is not financial advice and never a guarantee of profit. Every trade is at your own risk on your own exchange. See our risk disclosure and editorial policy.
