Crypto hacks & exchange failures: a timeline
12 major, well-documented crypto incidents, in chronological order -- each one already researched and sourced in a dedicated Kaavon article. This page doesn't introduce any new figures of its own; it restates each incident's already-disclosed date and loss figure and links to the full article for complete sourcing.
This is not a comprehensive survey of every crypto incident ever recorded -- it covers the specific, well-documented cases Kaavon has researched in depth, selected for the quality of available primary-source reporting, not as a ranking by severity.
Mt. Gox
Reported claims exceeding $9.4 billion owed to roughly 127,000 creditors -- the largest creditor base among Kaavon's four named exchange-failure cases.
Triggered by an undetected, years-long theft of Bitcoin from the exchange's own holdings. Distributions have proceeded in stages over an unusually long timeline relative to later cases; no current, reliable recovery-percentage figure was found at the time of research.
QuadrigaCX
Reported total creditor claims of roughly $303-306 million against total distributions eventually reported around $39.5 million -- a recovery rate commonly cited at roughly 13%.
Followed the death of QuadrigaCX's founder, who reportedly held sole access to the exchange's cold-storage credentials. The court-appointed trustee was unable to locate most of the funds owed to creditors -- the most severe recovery shortfall among Kaavon's four named exchange-failure cases.
Wormhole bridge
Reported losses consistently cited in the $325-326 million range across independent sources.
An attacker exploited a flaw in Wormhole's on-chain signature-verification logic to forge approval from the bridge's validator set without obtaining real signatures -- a smart-contract-level bug, structurally distinct from a compromised-credentials failure.
Ronin bridge
Reported losses ranging from approximately $600 million (contemporaneous reporting) to $625 million (a later, more precise postmortem accounting).
Attackers compromised a sufficient number of the Ronin bridge's validator signing keys to forge withdrawals. The underlying weakness was organizational: a validator set temporarily expanded for load-handling reasons retained elevated access longer than intended.
Celsius
A court filing reported approximately $2.53 billion distributed to roughly 251,000 creditors -- about 84% of the roughly $3 billion owed by one measure; a separate measure reports 93% of value to about two-thirds of creditors by headcount.
Celsius halted customer withdrawals before entering bankruptcy proceedings. Its recovery outcome -- high by value, partial by other measures -- illustrates why "recovery rate" needs to disclose which specific measure it describes.
Nomad bridge
Reported losses of roughly $190 million, falling from $190.3 million in bridge holdings to effectively zero within about two hours.
A routine upgrade accidentally initialized the bridge's "trusted root" to a zero value, which the verification logic then treated as automatically valid for any message -- turning one attacker's exploit into a rapid, decentralized free-for-all once it became visible on-chain.
Mango Markets
Reported at roughly $100 million, though some sources cite figures closer to $110-117M depending on how the loss is calculated.
An attacker pushed the reported price of Mango's own governance token from roughly $0.04 to as high as $0.91 on thinly-traded external markets, then borrowed against the resulting inflated paper profit -- without exploiting any bug in Mango's smart-contract code itself.
FTX
The bankruptcy trustee's own summary projects total recoveries variously cited between approximately 123% and 138% of claimed value for many creditors -- a projection, not a completed distribution. Repayments began in February 2025.
FTX's collapse led to an unusually high projected recovery, explained by crypto-asset price appreciation after collapse plus recovered assets from clawback litigation -- a distinctive combination of circumstances specific to this case, not evidence the collapse was less severe than the other three named exchange failures.
Drift Protocol
Initial media estimates of $280-285 million; the Drift Foundation's later, more precise verified-loss figure used to size its recovery program is $295.4 million.
A months-long social-engineering operation built a false identity as a legitimate trading firm to obtain legitimate-looking multisig approvals from real administrators, then used that access to drain funds directly -- no vulnerability was found in Drift's smart contracts or code.
Bitget
First reported at roughly $351.6 million, then revised to approximately $387.5 million as the investigation continued.
Attackers used a compromised third-party security product, not stolen keys, to move funds from a subset of Bitget's hot wallets -- a developing, revised figure as disclosed by Bitget itself.
Pirate Chain
Roughly 39.8 million ARRR created out of nothing -- an increase of roughly 20% to the entire token supply, not a dollar-denominated theft.
A validation flaw tied to Pirate Chain's Ironwood upgrade let someone mint new supply with no evidence the chain's core privacy cryptography was compromised. The team announced a chain rollback the next day, then abandoned that plan within two days, citing the practical impossibility of coordinating a unilateral rollback on a decentralized network.
Qubic wallet-seed draining
Roughly 2.94 trillion QU drained from 1,404 wallets -- about $1.3 to $1.4 million.
No cryptography was broken; wallets whose seeds were generated by specific browser/device combinations (iPhone/iPad browsers, Safari on Mac before an October 18 fix, and older Qubic iOS app versions) were never genuinely random in the first place.
How this timeline is maintained
Every entry above is sourced entirely from a Kaavon research or security article that already discloses its own primary sources, methodology, and freshness -- see Editorial & Research Standards for how that works. If a linked article is later corrected, this page's summary is updated to match it, not the other way around.