Research / Case studies
What actually failed.
Incident by incident.
Each case study reconstructs one major breach from primary sources: the company's own disclosures, law-enforcement statements and independent forensic reports. Same structure every time, so you can compare how they got in, how it escalated, how long it took to notice, and which control would have stopped it.
Binance October 2026 breach: $6.3 B drained via a hijacked wallet-signing service
A fake job interview and a poisoned developer install put malware on Binance engineers' laptops; a stolen deployment token then reached a wallet-signing service that signed whatever it was asked to.
- Loss
- ~$6.3 B impacted ($6.34 B per Binance; $6.36 B TRM Labs; $6.4 B Chainalysis; $6.43 B Elliptic); ~$2.85 B frozen or intercepted
- Initial access
- Engineer-workstation compromise via a tampered Homebrew installer (June 2026) and a fake-recruitment 'coding assignment' containing zero-day malware (September 2026)
- Attributed
- Attributed by the FBI, TRM Labs, Chainalysis and Elliptic to the DPRK unit TraderTraitor; Check Point describes the unit as also known as Lazarus Group; the DPRK has denied involvement
CoinDCX: a $44 M recruitment-lure breach and the $16 M aftershock from unretired wallets
A fake freelance job put malware on one engineer's laptop and emptied a $44 M liquidity wallet; 15 months on, compromised addresses CoinDCX had deprecated but kept using lost 15.99 M USDT.
- Loss
- About $44.2 M (Rs 378.9 crore per police complaint) in USDC/USDT from an operational liquidity wallet in July 2025; a further 15.99 M USDT (~$16 M) from deprecated Tron wallets in October 2026
- Initial access
- Year-long fake freelance engagement led to a malicious file executing on a CoinDCX engineer's company laptop, from which private keys and server access were taken
- Attributed
- No forensic firm has formally attributed either incident. Cyvers told DL News the July 2025 attack bore strong similarities to past exploits attributed to North Korea's Lazarus Group; Bengaluru police said foreign actors were being examined but responsibility was not confirmed
Coinbase 2025: bribed BPO support agents, 69,461 records and a $20 M extortion refusal
Criminals paid TaskUs agents in Indore to photograph Coinbase customer records, then impersonated Coinbase to drain accounts; support tools exposed full PII with no enforced capture control.
- Loss
- $345.2 M of 'platform-related incidents' expense booked for FY2025 and $311.2 M cash paid for the Data Theft Incident (customer reimbursements and legal costs), within the $180–400 M range first estimated
- Initial access
- Cash bribes to TaskUs support agents in Indore, who photographed customer records displayed in Coinbase support tools
- Attributed
- Coinbase attributes the theft to criminals who bribed overseas support contractors; a person claiming involvement told Fortune the group was the loosely organised 'Comm' network, which no agency has confirmed
Bybit, February 2025: a poisoned Safe{Wallet} front-end and $1.46 B signed away
A compromised Safe{Wallet} developer laptop let attackers alter the signing UI, so Bybit's cold-wallet signers blind-signed a malicious contract upgrade that drained roughly $1.46 B in ETH.
- Loss
- Approximately $1.46 B in ETH and ERC-20 tokens (401,347 ETH, 90,375 stETH, 15,000 cmETH, 8,000 mETH); reported as 'approximately $1.5 billion' by the FBI and CNBC
- Initial access
- Social-engineered compromise of a Safe{Wallet} developer's macOS workstation (a malicious Docker 'stock simulator' project), followed by reuse of the developer's hijacked AWS session token
- Attributed
- Attributed by the FBI to North Korean actors it tracks as TraderTraitor; attributed by Elliptic and TRM Labs to North Korea on the basis of laundering patterns and wallet overlaps; attributed by Mandiant (as relayed by Safe and summarised by Sygnia) to the same DPRK cluster, also tracked as UNC4899
WazirX, July 2024: how a 4-of-6 multisig lost $235 million to a mis-signed transaction
Three WazirX signers and Liminal's co-signer approved a payload that replaced the wallet's logic; no control verified what was being signed, and users bore the loss.
- Loss
- More than $230 million per WazirX; about $235 million across 200+ assets per Elliptic
- Initial access
- Disputed: manipulation of the multisig signing flow, which WazirX attributes to Liminal's interface and Liminal attributes to three compromised WazirX signer machines
- Attributed
- Attributed by Elliptic to hackers affiliated with North Korea; attributed by ZachXBT to the Lazarus Group; attributed by the United States and the Republic of Korea to the DPRK on the basis of industry analysis