Data
Crypto Exchange Hacks & Withdrawal-Halt Tracker (2024–2026)
Last verified: See our sources
DMM Bitcoin
2024-05-31- Estimated amount
- ~¥48.2 billion (~$305 million) — amount confirmed by Japan's FSA
- Stated cause
- Unauthorized outflow of bitcoin from a DMM Bitcoin wallet; exact technical cause not disclosed as of the FSA's reporting order.
- Users made whole?
- Yes — DMM Bitcoin committed to procuring and fully replacing the leaked BTC with support from group companies.
- Days until withdrawals resumed
- Not disclosed in our sourced data.
Indodax
2024-09-11- Estimated amount
- ~$22M — not disclosed by exchange / unverified media estimate.
- Stated cause
- Suspected unauthorized transaction activity; exchange and Indonesia's commodity futures regulator (Bappebti) said the cause was under investigation.
- Users made whole?
- Indodax said customer balances in crypto and rupiah remained fully safe during the incident.
- Days until withdrawals resumed
- ~80 hours per Indodax CEO's public statement (not in the official regulator notice itself).
BingX
2024-09-20- Estimated amount
- ~$43–44M (PeckShield) — not disclosed by exchange / unverified media estimate.
- Stated cause
- Unauthorized intrusion targeting a hot wallet, detected by BingX's security systems; technical root cause not disclosed.
- Users made whole?
- Yes — BingX said user assets were unimpaired (majority held in cold wallets) and pledged reserves cover any hot-wallet shortfall.
- Days until withdrawals resumed
- About 1 month (incident Sep 20, 2024; BingX said full operations restored Oct 24, 2024).
Phemex
2025-01-23- Estimated amount
- ~$37M–$85M (range across media reports) — not disclosed by exchange / unverified media estimate.
- Stated cause
- Unusual activity detected in a hot wallet; Phemex said cold wallets were unaffected and did not disclose the attack method.
- Users made whole?
- Phemex said it holds sufficient reserves and user funds are safe; published a Proof-of-Reserves statement, but did not detail a compensation plan in its own announcement.
- Days until withdrawals resumed
- About 1–4 weeks (gradual restoration from Jan 24, 2025; all withdrawal services restored by Phemex's Feb 2025 update).
Bybit
2025-02-21- Estimated amount
- ~$1.5 billion (ETH / stETH)
- Stated cause
- Compromised Safe{Wallet} multisig signing flow; attributed to the Lazarus Group by the FBI.
- Users made whole?
- Yes — reserves restored 1:1 within 72 hours; no customer funds reported lost.
- Days until withdrawals resumed
- Not disclosed separately in Bybit's public reporting.
Bitget
2026-09-24- Estimated amount
- ~$388 million
- Stated cause
- Zero-day in third-party security appliances reached the internal network and forged withdrawal instructions; no private-key leak, per Bitget's CEO. Cold wallets unaffected.
- Users made whole?
- Yes — Protection Fund absorbed the loss; user balances unaffected.
- Days until withdrawals resumed
- 8 days (staged restart from Sep 28, full by Oct 2, 2026).
Binance
2026-10-30- Estimated amount
- ~$6.3 billion estimated impact
- Stated cause
- A compromised DevOps engineer's laptop gave an attacker access to a service container, which submitted unauthorized withdrawal transactions, per Binance's own notice.
- Users made whole?
- Binance says it will absorb the loss from SAFU and company funds (over $6.34B set aside); not yet confirmed complete as of Oct 31, 2026 — a technical post-mortem is still pending.
- Days until withdrawals resumed
- In progress — phased restart targeted ~34 hours from the Oct 31 notice; not yet confirmed complete.
Cite this data
Feel free to cite or embed this table. Suggested citation:
CompareCEX, "Crypto Exchange Hacks & Withdrawal-Halt Tracker (2024–2026)," updated October 31, 2026, https://comparecex.com/data/exchange-hacks-tracker/
Methodology
Every figure in this table comes from the exchange's own public announcement, audit report, or CEO statement, or from a financial regulator's, police authority's, or court's official statement about the incident — the exact source is linked in each row. We do not estimate, average, or round beyond what that official source states. Where an exchange did not disclose a dollar amount itself, we still show the figure reported by media outlets so the row is useful, but label it explicitly "not disclosed by exchange / unverified media estimate" rather than presenting it as a confirmed number. Rows where a detail was not disclosed at all (for example, a precise withdrawal-resumption date) say so explicitly rather than showing a guess.
This table is derived from our longer comparison guide, Binance, Bybit, Bitget Hacks Compared, and our live Binance security incident tracker. See our methodology and sources pages for how we verify exchange data generally.
Crypto assets are volatile and unregulated in many jurisdictions. Not financial advice.