big

This year’s biggest hacker case: $350 million. This time, the hacker didn’t touch the private keys—this is the most frightening part.

Last night, the hot wallet of a leading exchange was compromised and about $351.6 million was stolen, directly becoming the largest crypto theft incident of 2026.

The stolen assets include 9 tokens. The most is XRP: 102.93 million coins, worth roughly $157 million. Then there’s ETH: 31,890 coins, plus 34.75 million USDT and 21.05 million USDC.

What truly chills me is the method. According to the exchange, the private keys were not leaked. Instead, the hacker breached a core backend system that serves the wallet service and forged transfer information. In other words, you assume the “safest key” was untouched—but the system itself sent the funds out.

The hacker’s moves were also very skilled. On EVM-compatible chains, almost all of the stolen proceeds were quickly converted into ETH. Now the hacker holds about 68,000 ETH, worth a little over $180 million. On-chain tracking indicates this batch of funds is connected to the July theft case involving $24 million. Many people suspect it was again carried out by a North Korean hacking organization.

Luckily, cold wallets were unaffected. The platform says its protection fund can cover the losses. But for ordinary users, the lesson boils down to three things:

First, when choosing a platform, check whether it provides proof of reserves—see if there’s a real, tangible user protection fund that exists.

Second, make sure 2FA and the withdrawal whitelist are fully enabled—don’t skip it just because it’s bothersome.

Third, for long-term holdings that you don’t plan to move, keep them in your own hardware/cold wallet. The exchange should only hold the portion you need to trade.

Also watch the market impact: the hacker still has more than 100 million XRP and 68,000 ETH. Those holdings will be washed out sooner or later, so in the short term there’s always uncertainty and selling pressure hanging over these two coins.