The 7 best crypto futures exchanges, tested at every trade size that matters.

🔴 Bybit. Lazarus cold-wallet drain

The largest crypto theft on record. Lazarus Group (DPRK-attributed by Chainalysis) compromised the Safe{Wallet} UI used for Bybit’s signing flow, then drained 401,347 ETH from an ETH cold wallet over a single transaction window. The exchange continued operating with no withdrawal pause. Replenishing the missing assets within 72 hours through emergency loans from Binance, Bitget, and Galaxy Digital. Every user balance was made whole. A $140M bounty was offered for recovery; partial leads have surfaced but most funds remain in the attacker’s custody.

Why Bybit is still ranked #2: Operational response set the new standard for how an exchange handles a catastrophe. No customer lost a dollar. Bybit’s books are deeper than any centralized venue except Binance, and the platform is fundamentally functional. But the OPSEC failure is permanently on record.

🔴 Drift Protocol. Privileged-access drain

Over half of Drift’s TVL was drained through a privileged-access pathway later linked to DPRK-affiliated actors. Withdrawals were paused while the team and Chainalysis traced the flow. Partial reimbursement from the insurance fund and DRIFT treasury covered active positions; passive depositors recovered roughly 60-70 cents on the dollar at the time of publication. Open interest is still rebuilding two months later.

Why Drift isn’t in our ranking: A $285M drain in April 2026 (over half its TVL) is disqualifying for a best-of list, so Drift sits outside the ranked seven. We still cover it because the on-chain perp market for Solana memecoins runs through it. Phantom mobile and Jupiter both route here, and there’s no real alternative for that flow. If you must trade Solana memecoin perps, treat Drift as high-risk: don’t park collateral, and size only what you can afford to lose.

🟡 GMX V1. Reentrancy on legacy pools

An attacker exploited a reentrancy bug in GMX V1’s GLP pricing logic on Arbitrum. The V1 contract had been live since 2021 and was scheduled for sunset in favor of V2. After negotiation, the attacker returned the bulk of the funds in exchange for a $5M white-hat bounty. GMX V2. A completely separate contract architecture with isolated markets. Was not affected.

Why GMX is still an honorable mention: The hack was on legacy V1 contracts; V2 has a clean record. The GMX real-yield model (27% of fees paid to stakers in ETH/AVAX) remains unique in DeFi. But the V1 incident is a reminder that mature DeFi contracts still carry bug-class risk.

🟡 Hyperliquid. JELLYJELLY validator override

A coordinated short-squeeze on the thinly-traded JELLYJELLY perp pushed losses on the HLP vault toward $12M. Hyperliquid validators voted within about two minutes to force-delist the contract and settle all positions at $0.0095. The attacker withdrew roughly $6.26M before the chain froze withdrawals. HLP was made whole. The protocol functioned exactly as the team designed. But it exposed that a small validator set can override the smart contracts at will.

Why Hyperliquid is still ranked #1: The validator set acted in users’ interest, withdrawals reopened within hours, and HLP depositors took zero loss. But the precedent matters: Hyperliquid’s smart contracts are not the final authority on Hyperliquid. The validator vote is. Worth knowing before you park life-changing capital.

🟢 The other 6. No material incidents in 24 months

Binance Futures, OKX, Bitget, MEXC, dYdX v4 and Kraken Pro Futures have clean records across the 24-month scoring window. DYdX v3 had a $9M YFI insurance-fund hit in November 2023 (pre-v4); v4 itself has been incident-free since launch. Binance’s October 2022 BNB Chain bridge $570M exploit affected a separate cross-chain bridge, not the futures exchange. All six publish audit attestations and run public bug bounties.