Crypto exchanges hacked in 2026: which ones and how the attacks happened

Which crypto exchanges were hacked in 2026?

Binance, Bitget, CoinDCX, Mercado Bitcoin and Grinex are among the exchanges with custody incidents documented in this review. TRM also identified TokenSpot wallets affected in the episode linked to Grinex. The table separates reported amounts, dates and known attack mechanisms.

Research cutoff and access date: November 4, 2026. This is a global selection, including Brazil, based on official statements or identifiable public investigations. It is not an exhaustive list or a final full-year tally. An exchange missing from this review is not thereby proven safe.

Reported incidents and amounts

Amounts retain the units and valuations reported for each incident; they have not been marked to current prices. They are not final customer losses. We do not add them together: scope, prices, freezes and accounting differ. USDT is a stablecoin token, not a US-dollar bank deposit.

Binance: reaching the system that authorizes transactions

The initial Binance report of November 3 describes fake interviews and malicious code within a campaign that reached its internal signing service. On Ethereum, EIP-7702 delegations enabled movements outside the normal withdrawal flow. The company reported approximately US$2.85 billion frozen or intercepted and undertook to cover the losses. Its investigation remained open.

The FBI attributed the attack to North Korea under the TraderTraitor designation on October 31. This specific official attribution does not establish who carried out the other incidents.

Bitget: fraudulent withdrawals using internal access

The Bitget update of October 20 describes a flaw in a third-party security product that exposed privileged credentials. The attacker submitted fraudulent commands to the wallet system. Bitget says cold wallets were unaffected, it covered the loss, and withdrawal restoration was completed on October 2, 2026. The incident affected the exchange; it should not be confused with the separate self-custody product Bitget Wallet.

CoinDCX: an old address kept receiving deposits

CoinDCX explained on October 25 that the address had been deprecated after a 2025 incident. Deposits nevertheless continued; a failure of the service moving them to active infrastructure allowed funds to accumulate. The company said it absorbed the loss and active systems kept operating. Its statement does not fully explain the exploited vulnerability. A previously saved address should not replace the updated deposit address shown in the app.

Mercado Bitcoin: hot wallets affected, entry point under investigation

In its November 2 statement at 9 p.m. Brasília time, MB said daily-operation hot wallets were affected and it took the platform offline for security. It reported about US$11 million blocked and approximately US$38 million not yet blocked, and pledged that customers would not lose assets. These are figures from that statement, not a live recovery balance.

Chainalysis described tracing the transfers and freezing part of the assets. Following outflows does not by itself reveal the initial intrusion. The cited sources do not provide sufficient technical evidence to claim private-key theft, a particular software flaw or a compromised supplier. That gap remains explicit.

Grinex and TokenSpot: observed transfers do not establish attribution

Elliptic reported USDT outflows and conversions into TRX and ETH linked to Grinex. Its April 16 report places the transfers on the previous Wednesday, April 15; other descriptions use the announcement date, April 16. The table therefore shows the April 15–16 window.

TRM identified two TokenSpot wallets linked to the same operation, with less than US$5,000 taken from them in its April 16 analysis. This is the investigator's finding, without equivalent technical confirmation from TokenSpot. TRM did not verify Grinex's claim about foreign intelligence services. The cited sources do not sufficiently explain the initial access vector.

What the evidence shows — and what it cannot establish

• Different failure paths: internal authorization, privileged credentials, legacy infrastructure and wallet compromise. “Hack” describes an outcome, not a complete explanation.
• No probability of the next attack. This review lacks a uniform dataset of all exchanges and does not adjust for operating volume.
• No proof of solvency or completed compensation. Coverage pledges are company statements; frozen assets may still require restitution procedures.
• An exchange is not a blockchain. An exchange custody breach does not mean Bitcoin's protocol was broken.

Individual account scams and attacks on decentralized protocols or bridges fall outside this scope. See the Liquid Network article and the security guide for holders for related risks.

Checklist: verify before acting on a rumor

• Open the official app or type the official address. Check the notice date and which services or networks are suspended before sending funds.
• Use a unique password and phishing-resistant authentication, such as a security key, where available. CISA explains FIDO/WebAuthn protection. Account protection does not guarantee exchange infrastructure.
• Never share passwords, codes or a recovery phrase. MB itself warns against supposed refunds offered through messages or calls.
• Keep receipts, timestamps, support references and transaction identifiers; use official channels to document any complaint.
• Consider custody, counterparty and access risks. Self-custody changes who handles security: Bitcoin.org explains backup and storage precautions. Losing recovery information can also mean losing assets.

Frequently asked questions

Does enabling 2FA prevent an exchange hack?

It cannot guarantee that. Your account and the company's wallets are different security layers. Compromised internal access may enable transfers without your login.

Have frozen funds already been returned?

Not necessarily. Freezing restricts movement; recovery and restitution are separate steps. Check what the statement actually confirms.

Can this list identify an exchange with no risk?

No. Absence from this selection is not a security certificate. Consider liquidity, withdrawal rules, jurisdiction, regulatory risk and counterparty exposure as well.

Sources and update policy

Sources accessed on November 4, 2026: Binance, FBI, Bitget, CoinDCX, Mercado Bitcoin, Chainalysis, Elliptic and TRM reports and statements, linked beside the relevant claims. Company accounts are attributed statements, not Cripto View audits. Revised amounts, causes or coverage require a fresh check; this publication is not a live incident monitor.

Informational and educational content. This is not individual investment advice, an offer or a solicitation to buy or sell assets.