by AK Arora 
On February 21, 2025, the unthinkable happened.
Bybit — one of the world’s largest and most trusted crypto exchanges — lost $1.5 billion in a single attack. The hackers did not crack the blockchain. They did not break any cryptographic code. Instead, they used malware-infected trading applications to infiltrate Bybit’s internal systems. Within minutes, 400,000 ETH were gone. The FBI later attributed the attack to North Korea’s Lazarus Group.
That single hack made 2025 the worst year for crypto theft in history. According to Chainalysis, hackers stole $3.4 billion across all of 2025 — a 55% increase from 2024.
So, can crypto be hacked? The honest answer is: it depends on what you mean by “crypto.”
The Blockchain Itself vs Everything Around It
This is the most important distinction in the entire conversation.
Bitcoin’s blockchain has been running continuously since January 2009. In 17 years, it has never been successfully hacked. Not once. The same is true for Ethereum’s core network. The cryptographic foundation of these blockchains is, for all practical purposes, unbreakable with today’s computing power.
However, everything built around the blockchain is a different story entirely.
Exchanges can be hacked. Wallets can be compromised. Smart contracts can have bugs. Users can be tricked through phishing. The blockchain itself is not the vulnerability — the human infrastructure surrounding it is.
This distinction matters enormously. When people say “crypto got hacked,” they almost never mean the blockchain was broken. They mean an exchange was breached, a wallet was compromised, or a user was deceived.
How Much Crypto Has Been Stolen?
The numbers are significant. According to multiple security firms tracking 2025 and 2026 data:
- $3.4 billion was stolen in crypto hacks in 2025 alone — the highest annual total ever recorded
- $2.02 billion of that was stolen by North Korean state-backed hackers — primarily the Lazarus Group
- The top 3 hacks in 2025 accounted for 69% of all losses for the year
- In April 2026, crypto lost a record $629 million in a single month — the worst month in history
- By end of April 2026, cumulative losses for the year reached $771 million across 47 incidents
- All-time, over $16.5 billion in crypto has been stolen across all hacks since Bitcoin launched
However, context matters. Total crypto transaction volume in 2025 exceeded $100 trillion. Illicit activity, including hacks, represented well under 1% of all transactions. The mainstream banking system loses hundreds of billions annually to fraud. The scale of crypto theft is significant — but it is not uniquely catastrophic compared to traditional finance.
6 Ways Crypto Gets Hacked
Understanding how crypto gets stolen helps you understand how to protect yourself. These are the most common attack vectors in 2026.
1. Exchange Hacks — The Biggest Losses
Centralised exchanges hold vast amounts of crypto in shared wallets. That makes them the highest-value targets in the industry.
The Bybit hack — $1.5 billion in February 2025 — remains the single largest theft in crypto history. Hackers used malware to compromise signing infrastructure, not the blockchain itself. The WazirX hack — $234.9 million in July 2024 — similarly exploited multisig wallet infrastructure rather than any blockchain vulnerability.
In both cases, the blockchain worked exactly as intended. The exchange’s internal security failed.
The risk to you: If your crypto is on an exchange, you are exposed to that exchange’s security. You do not hold the keys.
2. Smart Contract Exploits — DeFi’s Weak Point
Smart contracts are self-executing code deployed on the blockchain. However, code can have bugs. When a smart contract has a vulnerability, an attacker can exploit it to drain funds.
In April 2026, cross-chain bridges were the primary target. According to PeckShield, 14 bridge exploits drained $340 million in just the first half of 2026. The KelpDAO breach alone caused $292 million in losses when attackers faked a deposit of collateral to trigger the release of real funds.
DeFi protocols suffered 68% more incidents in the first four months of 2026 compared to the same period in 2025.
The risk to you: Any DeFi protocol you interact with carries smart contract risk. Unaudited or newly launched protocols carry especially high risk.
3. Phishing and Social Engineering — The Human Hack
The biggest shift in 2026 is this: hackers are increasingly targeting people, not code.
Social engineering and phishing were the single most damaging attack category in Q1 2026, responsible for $290 million in losses — more than all technical exploits combined. Government-impersonation scams grew 1,400% year-over-year in 2025. AI-enabled fraud generates 4.5x more revenue per operation than traditional scams.
The mechanism is straightforward. A hacker poses as exchange support staff, a wallet recovery service, or even a government official. They convince the target to share seed phrases, approve malicious transactions, or hand over account access. Once the seed phrase is shared, the funds are gone.
One investor lost $91 million in a single social engineering attack where scammers impersonated hardware wallet support.
The risk to you: No one legitimate will ever ask for your seed phrase. Ever. If someone does, it is a scam.
4. SIM Swapping — Taking Over Your Phone
SIM swapping is a technique where an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can intercept SMS two-factor authentication codes and gain access to your accounts.
This attack does not require breaking any cryptography. It exploits the mobile carrier’s customer verification process — which is often weaker than it should be.
The risk to you: Use an authenticator app — not SMS — for two-factor authentication on all crypto accounts. Google Authenticator and Authy are not vulnerable to SIM swaps.
5. Malware and Clipboard Hijacking
Malware on your device can intercept crypto transactions in ways you would never notice. Clipboard hijackers replace wallet addresses you copy with an attacker’s address while you are not looking.
In December 2025, a single clipboard poisoning attack resulted in $50 million in USDT losses when a victim copied a spoofed address just 26 minutes after a test transaction. Blockaid flagged over 65 million address poisoning transactions since January 2025 — averaging more than 160,000 per day.
The risk to you: Always verify the first and last four characters of any wallet address after pasting. Never copy wallet addresses from untrusted sources.
6. Rug Pulls — The Scam Built Into the Project
A rug pull is not a hack in the traditional sense. However, it is one of the most common ways people lose crypto.
Developers create a new token, generate artificial excitement around it, attract investors, and then drain the liquidity pool — abandoning the project entirely. The token crashes to zero. The developers disappear with the funds.
In 2025, total crypto scam losses reached $17 billion — far exceeding direct hack losses. Rug pulls represent a significant portion of that total.
The risk to you: Research any project thoroughly before investing. Check whether the smart contract has been audited. Verify that the team is publicly identifiable. Be extremely sceptical of tokens promising guaranteed returns.
Can Bitcoin’s Blockchain Actually Be Hacked?
This is a common question. The short answer is: not practically.
To attack Bitcoin’s blockchain directly, you would need to control more than 50% of Bitcoin’s total mining hash rate — known as a 51% attack. At that point, you could potentially double-spend Bitcoin or rewrite recent transaction history.
However, Bitcoin’s hashrate as of 2026 is approximately 800 exahashes per second — the highest ever recorded. Controlling 51% would require more computing power than the world’s top supercomputers combined. Furthermore, it would cost billions of dollars per hour to maintain.
Even if someone somehow achieved this, they could only rewrite recent transactions. They could not steal Bitcoin from wallets they do not control. They could not create new Bitcoin beyond the 21 million cap.
Smaller proof-of-work blockchains are more vulnerable to 51% attacks. Ethereum Gold, Bitcoin Gold, and others have been successfully attacked this way. However, Bitcoin itself has never experienced one.
The verdict: Bitcoin’s blockchain is not practically hackable with any known technology. The same is largely true for Ethereum. Smaller blockchains carry more risk.
North Korea — The World’s Most Prolific Crypto Hacker
One fact about crypto security stands out above all others: a single country is responsible for an extraordinary proportion of all stolen crypto.
North Korea’s Lazarus Group — specifically a cluster the FBI calls TraderTraitor — stole $2.02 billion in 2025 alone. That is 76% of all exchange compromises for the year. Their all-time cumulative theft has reached $6.75 billion, according to Chainalysis.
North Korea uses stolen crypto to fund its weapons programme, bypassing international sanctions. The country has built what is effectively the world’s most sophisticated state-sponsored cyber-theft operation. They do not hack blockchains — they hack the humans and systems that secure them.
The Bybit attack specifically involved using malware-laden trading applications to compromise the signing infrastructure that authorises transactions. It was a sophisticated, months-long operation targeting a single exchange.
For more detail on North Korea’s crypto operations, read our guide on the North Korea crypto theft and Lazarus Group.
How to Protect Your Crypto From Being Hacked
Understanding the threat is the first step. Taking action is the second.
Move crypto off exchanges If you are not actively trading, move your holdings to a personal wallet. Exchanges are the highest-value targets for hackers. Read our full guide on how to store cryptocurrency safely for step-by-step instructions.
Use a hardware wallet for significant holdings Hardware wallets store private keys offline. Even if your computer is compromised, the private key never leaves the device. Ledger and Trezor are the two most established options.
Never share your seed phrase Your 12 or 24-word seed phrase is the master key to your wallet. No exchange, no wallet company, no “support agent” will ever legitimately ask for it. If someone asks, it is a scam. Every time.
Use an authenticator app, not SMS Switch from SMS-based two-factor authentication to Google Authenticator or Authy for all crypto accounts. SMS is vulnerable to SIM swapping. Authenticator apps are not.
Verify addresses carefully After pasting any wallet address, verify the first four and last four characters match the original. Clipboard malware replaces addresses without showing any visible change on your screen.
Be sceptical of DeFi protocols Only interact with DeFi protocols that have been audited by reputable security firms. Avoid unaudited protocols. Be especially cautious with newer cross-chain bridges — they were the primary target in 2026.
Research before investing If a project promises guaranteed returns, an anonymous team, and has no audit — it is likely a scam. Check platforms like CertiK and CoinGecko for project security information.
Comparison: Types of Crypto Hacks and Their Risk to Retail Investors
| Attack Type | What Gets Hacked | Your Risk Level | Prevention |
|---|---|---|---|
| Exchange hack | Exchange’s hot wallet | High — if on exchange | Move to personal wallet |
| Smart contract exploit | DeFi protocol code | Medium — if using DeFi | Use audited protocols only |
| Phishing / social engineering | You | High — universal risk | Never share seed phrase |
| SIM swap | Your phone number | Medium | Use authenticator app |
| Clipboard hijacking | Your device | Medium | Verify addresses manually |
| Rug pull | The project itself | High — new tokens | Research thoroughly |
| 51% attack on blockchain | The blockchain | Very low for BTC/ETH | Stick to major blockchains |
FAQ
Can Bitcoin itself be hacked?
Not practically. Attacking Bitcoin’s blockchain directly would require controlling more than 50% of its total hashrate — which would cost billions of dollars per hour. Bitcoin has operated continuously since 2009 without a single successful blockchain hack.
Are crypto exchanges safe?
The largest exchanges — Binance, Coinbase, Kraken — invest heavily in security. However, as the Bybit hack showed, even sophisticated exchanges can be compromised. No exchange is completely safe. The safest approach is to keep only what you need for active trading on an exchange and store the rest in a personal wallet.
What happened to WazirX users after the hack?
After the $234.9 million WazirX hack in July 2024, users faced prolonged withdrawal restrictions. Recovery has been partial. For full details, read our WazirX hack story.
Is DeFi safe to use?
DeFi carries genuine risk. Smart contract bugs, oracle manipulation, and bridge exploits have collectively drained billions. However, risk varies significantly by protocol. Established, audited protocols like Aave and Uniswap have strong security track records. New, unaudited protocols carry much higher risk.
What should I do if my crypto is stolen?
Act immediately. Contact the exchange if the theft occurred on an exchange. Report to your local cybercrime authority. In India, file a complaint at cybercrime.gov.in. For full steps, read our guide on how to report crypto fraud in India.
How do I know if a crypto project is a scam?
Watch for anonymous teams, no working product, guaranteed returns, unaudited contracts, and aggressive social media promotion. Platforms like CertiK, DeFiLlama, and CoinGecko provide security information and audit status for most major projects.
Final Word
Can crypto be hacked? Yes — but not in the way most people imagine.
The blockchain itself is not the vulnerability. Bitcoin and Ethereum’s core networks have never been successfully attacked. However, the exchanges, wallets, smart contracts, and people who interact with crypto are vulnerable to a wide range of sophisticated attacks.
In 2025, hackers stole $3.4 billion from the crypto ecosystem. However, they did so by hacking humans, infrastructure, and code — not the blockchain. The security gap is not in the mathematics. It is in the systems and behaviours built around it.
The good news is that almost all of these risks are manageable. Use a hardware wallet. Never share your seed phrase. Use an authenticator app. Verify addresses before sending. Research before investing. These steps eliminate the vast majority of your exposure to crypto theft.
The blockchain is secure. Your job is to make sure everything around it is too.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research and consult professionals before making investment decisions.
