{ "title": "Crypto exchange hack tracker 2026: withdrawal pauses and outcomes", "description": "Major thefts from centralized exchange wallets since 2022, with the amount stolen, whether withdrawals were paused, how long until they reopened, and whether customers were made whole. Each record carries a public source.", "publisher": "CoinVast Research", "canonicalPage": "https://coinvast.io/articles/exchange-hack-tracker-2026", "dataUrl": "https://coinvast.io/data/hacks.json", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "attribution": "CoinVast Research, https://coinvast.io/articles/exchange-hack-tracker-2026", "contact": "info@coinvast.io", "lastFullCheck": "2026-09-26", "updatePolicy": "Updated when a centralized exchange confirms a theft from its own wallets, and again when a paused exchange reopens or settles compensation. A scheduled reopening is recorded as scheduled until it has happened.", "methodologyNote": "daysPaused counts calendar days from the hack to the first reopening of any withdrawals. Amounts are USD figures reported at the time; where an estimate was revised, both are given. Fields set to null could not be verified from public sources on the check date.", "summary": { "hacksLogged": 9, "completedPauses": 5, "completedPausesEndedWithin12Days": 4, "longestPauseDays": 463, "linkedToNorthKorea": 6 }, "hacks": [ { "date": "2026-09-24", "exchange": "Bitget", "stolenUsd": 387500000, "firstReportedUsd": 351600000, "attribution": "Suspected North Korea (VPN infrastructure previously used by a North Korean group)", "withdrawals": "paused", "reopenedFirst": null, "reopenSchedule": "BTC from 2026-09-28, fiat and remaining tokens by 2026-10-02 (scheduled, not yet completed on the check date)", "daysPaused": null, "usersMadeWhole": "Bitget says its USD 464 million User Protection Fund covers affected balances", "sources": [ "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html", "https://cryptobriefing.com/bitget-pauses-withdrawals-351-million-hack/", "https://cryptoticker.io/en/bitget-withdrawals-resume-schedule/" ] }, { "date": "2025-11-27", "exchange": "Upbit", "stolenUsd": 36000000, "firstReportedUsd": null, "attribution": "Suspected North Korea (Lazarus Group)", "withdrawals": "paused", "reopenedFirst": "2025-12-01", "reopenSchedule": "Most assets 2025-12-01; Solana network assets from 2025-12-04", "daysPaused": 4, "usersMadeWhole": "Yes, covered from corporate reserves", "sources": [ "https://crypto.news/upbit-sets-december-1-restart-date-following-37m-hack/", "https://en.bloomingbit.io/feed/news/101884" ] }, { "date": "2025-08-14", "exchange": "BtcTurk", "stolenUsd": 48000000, "firstReportedUsd": null, "attribution": null, "withdrawals": "crypto deposits and withdrawals paused, trading continued", "reopenedFirst": null, "reopenSchedule": null, "daysPaused": null, "usersMadeWhole": "The exchange said user assets were not affected", "sources": [ "https://www.coindesk.com/business/2025/08/14/turkish-crypto-exchange-btcturk-witnesses-usd48m-of-suspicious-outflows-amid-hack-fears", "https://www.cnbce.com/kripto/btcturkten-aciklama-kripto-para-yatirma-ve-cekme-islemleri-devre-disi-birakildi-h16150" ] }, { "date": "2025-06-18", "exchange": "Nobitex", "stolenUsd": 90000000, "firstReportedUsd": null, "attribution": "Predatory Sparrow (Gonjeshke Darande); funds sent to addresses no one controls", "withdrawals": "paused", "reopenedFirst": "2025-06-30", "reopenSchedule": "Phased, identity verified users first, spot wallets first", "daysPaused": 12, "usersMadeWhole": null, "sources": [ "https://www.theblock.co/news/business/2025-06-29-iranian-crypto-exchange-nobitex-begins-restoring-service-following-90-million-exploit-360223", "https://www.financemagnates.com/cryptocurrency/iranian-crypto-exchange-nobitex-announces-partial-resumption-of-operations-after-security-breach/" ] }, { "date": "2025-02-21", "exchange": "Bybit", "stolenUsd": 1500000000, "firstReportedUsd": null, "attribution": "North Korea (Lazarus Group), per the FBI", "withdrawals": "never paused", "reopenedFirst": null, "reopenSchedule": "All pending withdrawals processed in under 12 hours", "daysPaused": 0, "usersMadeWhole": "Yes, reserves remained above customer liabilities", "sources": [ "https://www.bybit.com/en/learn/this-week-in-bybit/bybit-security-incident-timeline", "https://en.wikipedia.org/wiki/Bybit" ] }, { "date": "2025-01-23", "exchange": "Phemex", "stolenUsd": 85000000, "firstReportedUsd": 70000000, "attribution": null, "withdrawals": "paused", "reopenedFirst": "2025-01-24", "reopenSchedule": "ETH, USDT and USDC on Ethereum 2025-01-24; BTC 2025-01-25; other chains 2025-01-26; all services by February 2025", "daysPaused": 1, "usersMadeWhole": null, "sources": [ "https://phemex.com/announcements/phemex-hot-wallet-security-incident-update-and-timeline", "https://www.securityweek.com/hackers-drain-over-85-million-from-crypto-exchange-phemex/" ] }, { "date": "2024-07-18", "exchange": "WazirX", "stolenUsd": 234900000, "firstReportedUsd": null, "attribution": "Linked to North Korea (Lazarus Group) by analysts", "withdrawals": "paused", "reopenedFirst": "2025-10-24", "reopenSchedule": "Reopened after a restructuring scheme approved by Singapore's High Court on 2025-10-13", "daysPaused": 463, "usersMadeWhole": "Partly: about 85% of approved claims paid, the remainder as non tradable recovery tokens", "sources": [ "https://decrypt.co/345632/wazirx-to-resume-trading-and-withdrawals-more-than-a-year-after-234m-hack", "https://en.wikipedia.org/wiki/2024_WazirX_hack" ] }, { "date": "2024-05-31", "exchange": "DMM Bitcoin", "stolenUsd": 305000000, "firstReportedUsd": null, "attribution": "North Korea (TraderTraitor), per the FBI and Japan's National Police Agency", "withdrawals": "restricted; yen withdrawals delayed", "reopenedFirst": null, "reopenSchedule": "The exchange wound down; customer accounts and assets moved to SBI VC Trade around March 2025", "daysPaused": null, "usersMadeWhole": "Accounts and assets were transferred in full", "sources": [ "https://www.coindesk.com/business/2024/05/31/japanese-crypto-exchange-dmm-bitcoin-suffers-305m-hack", "https://www.coindesk.com/business/2024/12/02/japanese-crypto-exchange-dmm-bitcoin-to-shut-down-after-305-m-hack", "https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom" ] }, { "date": "2023-09-12", "exchange": "CoinEx", "stolenUsd": 70000000, "firstReportedUsd": null, "attribution": "Suspected North Korea (Lazarus Group)", "withdrawals": "paused", "reopenedFirst": "2023-09-21", "reopenSchedule": null, "daysPaused": 9, "usersMadeWhole": "Yes, the exchange pledged 100% compensation", "sources": [ "https://cointelegraph.com/news/coinex-compromised-private-keys-behind-70-million-hack", "https://en.wikipedia.org/wiki/CoinEx" ] } ], "changelog": [ { "date": "2026-09-26", "change": "Tracker published with nine hacks, 2023 to 2026, including the Bitget hack of 2026-09-24." } ] }