A decade of exchange breaches reveals escalating threats
Centralized cryptocurrency exchanges (CEXs) have lost more than $11.3 billion across over 30 major breaches from 2014 to 2026, with North Korean state-sponsored hackers responsible for nearly 90% of the stolen funds. The data underscores a stark reality: despite advances in security, CEXs remain prime targets for sophisticated, well-funded adversaries.
From Mt. Gox to Bybit: The evolution of attack vectors
The timeline begins with the catastrophic collapse of Mt. Gox in 2014, where approximately 850,000 BTC vanished—a loss that still echoes through the industry. In the years since, attackers have continually refined their methods. Early breaches often exploited hot wallet vulnerabilities and weak key management. More recently, the focus has shifted to multi-signature systems, employee endpoints, and supply chain compromises.
The 2025 Bybit hack, which resulted in a $1.5 billion loss, exemplified this evolution. Attackers reportedly manipulated a multi-sig transaction and compromised developer tools, bypassing what was considered robust security. Similarly, the 2019 Binance breach saw hackers employ phishing and malware to obtain API keys and 2FA codes, stealing 7,000 BTC. These cases highlight that human error and third-party dependencies remain critical weak points.
- Hot wallets: Still a common entry point due to their online connectivity.
- Multi-sig systems: Increasingly targeted via social engineering and insider threats.
- Employee devices: Phishing and malware attacks on staff have led to credential theft.
- Smart contract and bridge exploits: While more common in DeFi, bridges connected to CEXs have also been hit.
North Korea’s dominance and the rise of state-sponsored cybercrime
The review indicates that North Korean hacking groups, such as Lazarus Group, have been involved in incidents accounting for nearly 90% of the total stolen value. These actors are highly organized, well-resourced, and often use stolen funds to finance state operations. Their tactics include long-term infiltration, supply chain attacks, and sophisticated social engineering. The Bybit hack is a prime example of their growing ambition and capability.
Industry analysts note that the concentration of losses among North Korean actors has significant implications. It suggests that private sector defenses, while improving, are struggling against nation-state adversaries. It also raises questions about the effectiveness of international sanctions and the need for greater cross-border cooperation in cybersecurity.
Implications for exchanges and the broader market
The cumulative losses have forced exchanges to invest heavily in security infrastructure, insurance, and regulatory compliance. Many now employ advanced monitoring, cold storage solutions, and multi-party computation (MPC) wallets. However, the review highlights that no system is impenetrable. The increasing sophistication of attacks means that exchanges must adopt a defense-in-depth approach, including regular security audits, employee training, and real-time threat intelligence.
For users, the incidents underscore the importance of self-custody and diversification. While CEXs offer convenience and liquidity, the risk of loss due to hacks remains a critical consideration. Regulators are also paying closer attention, with some jurisdictions requiring stricter security standards and reserve audits.
Looking ahead: 2026 and beyond
As the industry moves forward, the threat landscape is likely to become more complex. The integration of AI-driven attack tools, the rise of quantum computing risks, and the expanding attack surface due to cross-chain interoperability will pose new challenges. Exchanges will need to collaborate more closely with law enforcement and cybersecurity firms to stay ahead.
The $11.3 billion lost is not just a number—it represents trust eroded and capital destroyed. The industry’s ability to secure user assets will be a key determinant of its long-term viability. While progress has been made, the review serves as a stark reminder that security is an ongoing battle, not a one-time fix.
