Can Bitcoin Be Hacked?

At 20:20 UTC on October 29, 2026, a single Bitcoin transaction moved 18,270 bitcoin out of a wallet belonging to Binance, one of the largest exchanges in the world, and into an address controlled by thieves. It was one part of a wider raid on Binance's online wallets across ten different blockchains, most of it over about twenty minutes, and the blockchain analysis firm TRM Labs called it the largest crypto theft on record.¹

The headlines said Binance had been hacked. A lot of readers heard something else: that Bitcoin had been hacked. Those are two very different claims, and the difference between them is most of the answer to the question.

The Company, Not the Code

An exchange holds bitcoin for its customers, and it keeps most of those coins offline, where no one can reach them over the internet. But withdrawals have to go out quickly, so a smaller amount sits in what is called a hot wallet, whose keys stay on computers that are connected and ready to sign. That convenience is also the weak point. In an update the day after the theft, Binance said its first findings pointed to a compromised engineer's laptop, and that it had found no evidence that any wallet's private keys had leaked.² From that foothold, the thieves appear to have gotten Binance's own systems to sign the withdrawals. The FBI said North Korea was responsible.³

Then Bitcoin did what it always does. A transaction signed with the right key is valid, and the network has no way to tell a thief from an owner, because a coin in Bitcoin is nothing more than a chain of signatures.⁴ So the coins moved. Nobody picked the lock. The thieves got the company's own machinery to turn the key.

Some of what was stolen was not bitcoin but digital dollars, tokens issued by companies that can freeze them, and those companies froze a large share within days. Nobody could freeze the stolen bitcoin, because there is no issuer behind it to call.⁵ That cuts both ways. No one can undo a theft of bitcoin. And no one can freeze bitcoin whose keys you hold yourself.

Binance paused withdrawals for about three days, reopening them with the Bitcoin network first, and said it would absorb the loss rather than pass it to its customers.³ That was Binance's decision, made with Binance's money. As the history shows, not every company has decided the same way.

Fifteen Years of the Same Story

Exchanges have been losing bitcoin to thieves for almost as long as there have been exchanges. The details change. The shape does not.

Mt. Gox was once the biggest Bitcoin exchange in the world. Starting in 2011, thieves inside its servers drained its wallets for years; the US Justice Department later put the stolen total at about 647,000 bitcoin.⁶ The exchange went bankrupt in 2014, and its customers waited ten years for repayments to begin in July 2024. As of October 2026 some of them are still waiting, after the trustee pushed the deadline back to October 2027.⁷

Bitfinex lost about 120,000 bitcoin in August 2016 and made every customer share the loss, cutting all balances by roughly 36% and handing out IOU tokens for the difference, which it paid off within eight months.⁸ In 2022 US agents seized about 94,000 of the stolen coins, and the man behind the hack later pleaded guilty.⁹ Binance's first loss, 7,000 bitcoin in May 2019, came from customers' logins and security codes harvested with fake messages and viruses, and Binance covered it from an emergency fund.¹⁰ When the Japanese exchange DMM Bitcoin lost about 4,500 bitcoin in May 2024, the FBI traced the break-in to North Korean hackers who had posed as a recruiter on LinkedIn and sent a fake pre-employment test to a worker at the company that ran DMM's wallet software.¹¹ DMM promised to make its customers whole, and within a year it had shut down and moved its accounts to another exchange.¹²

Every time, the way in was a company's computers or one of its people. Every time, the Bitcoin network kept producing blocks as if nothing had happened, because for the network, nothing had. And every time, what the customers got back was up to the company: paid in full within days, a third held back for months, or a decade-long wait.

Could Someone Crack the Lock?

A thief who could skip the company and work out a person's key directly would not need a laptop to compromise. So how hard is that? A Bitcoin private key is a number picked at random from a range about 78 digits long. For comparison, a trillion has 13 digits.

The math that protects it runs one way. Going from a key to its address takes a computer a split second. Going back from an address, or even from the public key a transaction reveals, to the private key has no known practical method. The best known approach for an ordinary computer takes about 2¹²⁸ steps.¹³ Even if each of those steps were as quick as one of the simple guesses Bitcoin's miners make, and every miner on Earth turned their machines to the job at November 2026's pace of about a thousand quintillion guesses a second, the work would take around ten billion years.¹⁴ No one is known to have worked out a well-made key this way. Whether a large enough quantum computer could one day do it is a real question, but no such machine exists today.

Notice the words "well-made." They come back later.

When the Software Slipped

That does not mean Bitcoin's software has been perfect. On August 15, 2010, someone found a hole in it. A transaction in block 74,638 created more than 184 billion bitcoin out of nothing. The software checked that a transaction did not pay out more than it took in, but it added the amounts in a way that could not hold numbers that large. The total overflowed, rolling past its limit like an old car's odometer, and came out looking small enough to pass.¹⁵

A developer spotted the strange block within hours, and the same day Satoshi Nakamoto announced a fixed version of the software.¹⁶ Nodes and miners upgraded, and by the next day the chain without the bad block had grown longer and every node had switched to it.¹⁵ The 184 billion coins never existed on the chain Bitcoin runs on today.

In September 2018 a different bug came to light, one that could have let a miner create extra bitcoin. It had been in the software for about a year. It was reported privately, a fixed version was out the next day, and the developers said they knew of no attempt to exploit it.¹⁷ Both fixes spread for the same reason: the people running Bitcoin chose to install them. Nobody can push an update onto a node.

When the Randomness Failed

That was Bitcoin's own software. The software that makes your keys matters just as much, because a key is only as strong as the randomness behind it.

In July 2026 that went wrong in a hardware wallet called Coldcard. Its seeds were supposed to come from a random number generator built into its chip. According to the maker, Coinkite, a change to the code in 2021 left the devices using a simple software routine instead, and a safeguard meant to stop the build if the hardware generator was not in use only checked that a setting existed, not that it was switched on.¹⁸ On older models that left about 40 bits of real randomness, roughly a trillion possible seeds, few enough for a computer to try them all. Newer models mixed in randomness from other chips and were far harder to guess, but still well short of the security they were designed to have.¹⁹

Starting at the end of July, thieves rebuilt the weak keys on their own computers. On-chain trackers counted well over a thousand bitcoin swept from thousands of addresses.²⁰ Coinkite stressed that the devices themselves were not hacked or taken over.¹⁸ Bitcoin's math was not broken either. The randomness was. Fixed firmware came out that week, but a seed made before the fix stays weak, so the cure was a new seed and moving the coins to it.

It was not the first time. In 2013 a flaw in Android's random number generator made some phone wallets' keys possible to work out, and thieves used it before it was patched.²¹ And "brain wallets," keys made from a memorable phrase, have been drained by people running enormous lists of phrases: one study found 884 of them in use between 2011 and 2015, and all but 21 were emptied, often within minutes.²²

Where Coins Really Get Taken

So where do people actually lose bitcoin to thieves? At the edges. The first edge is companies that hold keys for their customers, the story of Mt. Gox, Bitfinex and Binance. The second is keys that were not made well. The third, and the most common for ordinary people, is being tricked.

In August 2024, two men posing as Google and as support staff for a crypto exchange talked a man in Washington, D.C. into giving them access to his accounts and his security codes. They took more than 4,100 bitcoin.²³ Smaller versions of the same trick happen every day: a fake wallet app, a friendly message from "support," a website asking you to confirm your wallet by typing in its backup words. Those words, usually twelve or twenty-four, rebuild every key in the wallet. Whoever has them has the bitcoin, and no real company or check will ever ask you to type them in.

The Prudent See Danger

"The prudent sees danger and hides himself, but the simple go on and suffer for it."

Proverbs 22:3

Prudence starts with knowing where the danger actually is. Bitcoin's software has had serious bugs, and they were found and fixed in the open. No one has broken the math that protects a well-made key. What fails is what surrounds it: the companies that hold keys, the way keys get made, and the people who get tricked into giving them away. Coins left with a company are as safe as that company's computers and people. Coins whose keys you hold are as safe as your backup words, and as safe as you are from someone asking for them.

Lesson 6 of the course is about exactly that: why an exchange is an on-ramp rather than a vault, and how most of what goes wrong with bitcoin turns out to be human. For what happened to the customers of one failed company, see how to hold your own bitcoin keys. Why it matters who holds your money at all is where the free first lesson begins.