The figure taken from Binance in October 2026 — about $6.3bn — is large enough that it is worth setting beside the thefts it displaced, because the recovery record is more varied than the totals suggest.
The list
Binance, October 2026 — about $6.3bn. The record. Binance says more than $2.83bn had already been frozen and that the company will bear the whole loss itself.
Bybit, February 2025 — about $1.5bn. The previous record. The FBI identified North Korea as responsible. Customer funds were protected afterwards.
Ronin Network / Axie Infinity, March 2022 — about $620m. Also attributed to North Korean hackers. Users’ money was subsequently returned.
Poly Network, August 2021 — about $610m. The unusual one: the hacker returned almost all of it voluntarily.
Coincheck, January 2018 — about $530m. Affected customers were compensated in yen.
Mt Gox, February 2014 — about 850,000 bitcoin. One of the worst episodes in the history of the sector. The exchange went bankrupt, and repayments to affected customers only began in 2024 — a decade later.
FTX, November 2022 — about $470m left the company unaccounted for on the day it went bankrupt.
Bitget, September — about $350m. And in May 2019, Binance itself lost 7,000 bitcoin to a hack.
What the list actually shows
Two things, and they pull in opposite directions.
The first is that losses on this scale are not new, and that in several cases the money came back — through freezing, through compensation, and once because the attacker changed his mind. An exchange with a balance sheet large enough to absorb the loss is a meaningful protection, and it is the one Binance is relying on now.
The second is Mt Gox, where there was no such balance sheet. The exchange failed, and the people owed money waited ten years for the process to start. The difference between those outcomes is not the security of the blockchain. It is whether the company holding your assets can survive losing them.
The pattern in the attributions
Read the list again and one name recurs. Binance, Bybit and Ronin — the first, second and third largest on it — have all been attributed to North Korean hackers, by the FBI in two of those cases. That is not a coincidence of scale; it is the result of one actor deliberately moving to the largest available targets.
Three different ways money came back
Freezing. Works when the stolen assets are still identifiable on-chain and an exchange or issuer will act on a request. It is why the hours immediately after a theft matter more than the weeks afterwards.
Corporate absorption. The exchange pays, as Binance is doing and Bybit did. Reliable, and available only from companies with the reserves to survive it.
Bankruptcy process. Mt Gox and FTX. Money may eventually be returned, but through courts, over years, at whatever the assets are worth at the end rather than the beginning.
What this means for anyone holding crypto here
The practical conclusion is unglamorous. The security of the blockchain itself was not the failure point in any of these cases — the custodian was. What determined whether people got their money back was not cryptography but corporate balance sheets and how quickly somebody picked up the phone.
If you hold assets on an exchange, you are relying on that company being both solvent and responsive. That is a credit judgement about a business, and it is the same kind of judgement you would make about a bank.
