Bitcoin has never been hacked.
People have. Constantly.
Seventeen years, billions stolen, zero broken blocks.
Every hack, plotted against the price
Hover any dot: that is a headline that said Bitcoin was finished.
- Exchange failure
- Custody / vendor bug
- Human error
- Protocol failure
- Dot size = dollars lost
| Date | Incident | BTC price at the time | Reported loss |
|---|---|---|---|
| June 2011 | Mt. Gox — first breach | $17 | $9M |
| March 2012 | Linode host compromise | $5 | $228K |
| September 2012 | Bitfloor | $12 | $250K |
| February 2014 | Mt. Gox — collapse | $550 | $450M |
| January 2015 | Bitstamp | $270 | $5M |
| August 2016 | Bitfinex | $600 | $72M |
| December 2017 | NiceHash | $13,500 | $64M |
| January–September 2018 | The 2018 exchange pile-up | $8,000 | $1.0B |
| May 2019 | Binance | $5,800 | $40M |
| September 2020 | KuCoin | $10,700 | $281M |
| March–August 2022 | Ronin, Wormhole & the bridge season | $40,000 | $1.9B |
| November 2022 | FTX (not a hack) | $16,500 | $8.0B |
| May 2024 | DMM Bitcoin | $68,000 | $305M |
| 2025 | No protocol failure. New all-time high. | $107,363 | n/a |
| 30 July – 2 August 2026 | Coldcard seed flaw | $64,000 | $89M |
Each dot is a theft that made the front page. Not one of them bent the line underneath — every headline “Bitcoin hack” was a company, a laptop or a firmware bug.
- Incidents listed
- 14
- Lost by humans
- $12.2B
- Protocol failures
- 0
The scoreboard nobody prints
Two columns. One of them has never lost a point.
Never broken, not once
The protocol
The ledger — No transaction has ever been forged or reversed by an attacker.
SHA-256 & ECDSA — No practical break. No key has been cracked by brute force.
Consensus — No successful 51% attack on Bitcoin. Ever.
Uptime — 99.98%+ since 2009, with no company, board or on-call rota.
The 21M cap — Not raised, not inflated, not voted away.
Breaks approximately annually
Everything humans bolt onto it
Exchanges — Hot wallets, insider access, "we were going to fix that".
Custodians — Someone else holding your keys is still someone else.
Bridges — Billions guarded by a handful of validator signatures.
Vendor firmware — Coldcard 2026: bad randomness ships silently for five years.
Phishing — The most reliable exploit in computing remains a convincing email.
Backups — Seed phrases in cloud notes, screenshots and desk drawers.
Every major "Bitcoin hack", 2011–2026
Tap any incident for what actually broke, the amount lost, the BTC price at the time and the source. Filter by who dropped the ball.
- 2025
No protocol failure. New all-time high.
Nothing. Bitcoin printed a new all-time high while the list above kept growing.
The Coldcard seed flaw, day by day
The newest entry on the list, and the first one aimed squarely at self-custody. It is also, predictably, the first one the press used to recommend buying an ETF instead.
30 July 2026
Wave one
Roughly 594 BTC — about $38M — swept from ~500 addresses in a single 25-minute window. No devices were touched; the keys were regenerated offline.
1–2 August 2026
Waves two and three
The sweep spread across ~4,500 addresses and approached $89M in losses as the attacker worked down to smaller balances.
The cause
Bypassed randomness
Firmware shipping since March 2021 could skip the Coldcard's dedicated true-random-number generator when generating a seed, shrinking the key space enough to be searched offline.
Who is affected
Mk3, firmware 4.0.1+
Coinkite told owners whose seeds were generated on affected firmware to regenerate keys and move funds immediately.
The narrative
"Self-custody is too risky"
Within 48 hours, mainstream coverage had converted a single vendor's bug into a brand-new argument against holding your own keys. That argument is now archived here, permanently, with a date on it.
A vendor shipped bad randomness. Bitcoin still verified every one of those signatures perfectly.
From the directory
Sourced, dated and priced at the moment each one was said. Browse the full archive of people who were sure this was over.
No quotes here yet — check back soon.