Major Incidents · 2022–2026

Crypto Security Under Siege

Two landmark security incidents that reshaped how the industry thinks about protocol-level exploits and centralized exchange custody. Explore the full investigations below.

$6.3B
Binance Total Loss
$320M
Liquid Total Loss
2
Landmark Incidents
Protocol Exploit · White Hat

Liquid Network $320M Incident

September 6, 2026

Approximately 4,000 BTC (~$320M) was withdrawn from the Liquid Federation reserve after an attacker exploited a rangeproof cache collision in the Elements software, minting unbacked L-BTC and redeeming it for real BTC.

The attacker self-identified as a "white hat" and returned ~85% of funds after the vulnerability was patched — but ~598.5 BTC (~$47M) remains unreturned.

$320M Initial Outflow
85% Returned
$47M Outstanding
Hot Wallet · Nation-State Actor

Binance $6.3B Security Incident

October 30, 2026

Binance's hot wallet suffered unauthorized withdrawals totaling ~$6.3 billion — the largest digital asset theft on record. The FBI attributed the attack to North Korea's TraderTraitor group.

Binance covered all losses via its SAFU fund and company capital. Roughly $3B was frozen on-chain, and withdrawals resumed in phases on November 1.

$6.3B Total Loss
$3B Frozen On-Chain
95% Assets Replenished
Incident Comparison
Attribute Liquid Network Binance
Date September 6, 2026 October 30, 2026
Loss ~$320M (4,000 BTC) ~$6.3B
Attack Surface Protocol / Sidechain bridge Centralized exchange hot wallet
Root Cause Elements rangeproof cache collision Compromised DevOps laptop + EIP-7702 delegation
Attribution Self-claimed "White Hat" North Korea · TraderTraitor
Recovery ~85% returned ~$3B frozen; user losses fully covered
Status Ongoing Investigation Withdrawals Resumed
Swipe to see full comparison

Security Takeaway

These incidents highlight two distinct threat models: protocol-level logic flaws in decentralized infrastructure, and operational compromises at centralized custodians. Both underscore the importance of hardware wallet custody, layered security controls, and continuous protocol auditing.