The short version
- Crypto hacks 2026 set a monthly record in October: DefiLlama logs $6.50 billion lost in 35 incidents, $6.36 billion of it from the Binance hack.
- That is 1.8 times the old high of $3.56 billion (December 2020, LuBian) and more than four times Bybit’s February 2025, and it takes 2026 to $8.74 billion, more than double any earlier year.
- Next: Binance’s proof of reserves, due Tuesday, and where the attacker moves the ETH and BTC that can’t be frozen. We’ll post both on Base Camp on X as they happen.
A week ago, October looked like the quietest month of the year for crypto hacks. Then Binance lost $6.3 billion in about 20 minutes. DefiLlama’s hack tracker now logs 35 incidents worth $6.50 billion for October 2026, the worst month in its records and more than any full year before it. It also lifts the losses from crypto hacks 2026 has seen so far to $8.74 billion.
Blockchain security firm PeckShield raised the first public alarm at 20:55 UTC on October 29:
It seems unexpected large outflows from @binance hot wallets. @cz_binance
How Big Is October’s Record?
About 1.8 times the old high. Until the Binance hack, the worst month for crypto hacks in DefiLlama’s data was December 2020, at $3.56 billion. Nobody saw that one happen: Chinese mining pool LuBian lost 127,426 BTC that month, and Arkham only found it on-chain in 2025.
The worst month anyone saw as it happened was February 2025, when Bybit lost about $1.5 billion. October 2026 is more than four times that.
Binance alone is $6.36 billion of the total, the figure blockchain analytics firm TRM Labs traced across ten chains. TRM blames TraderTraitor, the North Korean unit the FBI tied to Bybit.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
What Else Was Hacked in October?
About $136 million across the other 34 incidents. Take Binance out and October would sit mid-table for 2026, well below September’s $743 million.
The biggest of the rest was the Ledger supply chain attack, an estimated $93 million drained from tampered hardware wallets sold by a reseller in Southeast Asia. Indian exchange CoinDCX lost about $16 million from a hot wallet on Tron. Then came a cluster between $2 million and $5 million:
- X100: $4.75 million in a flash-loan governance attack
- Gamdom: $4.2 million through a leaked key
- NEAR Intents: $3.8 million from a hot wallet on BNB Chain
- Polymarket International: $2.7 million after a supply chain attack on its site
- Initia: $2.6 million through an infinite mint
DeFi protocols lost only about $15 million in total. Exchanges, wallets and websites took almost all of the damage.
Crypto Hacks 2026: Where Does the Year Stand?
At $8.74 billion after ten months, more than double any earlier year in DefiLlama’s data. The previous high was 2020 at $3.98 billion, and only because of LuBian. Without Binance, 2026 would still be at $2.38 billion, close to all of 2025’s $2.72 billion.
The pattern held all autumn. Binance, Bitget, CoinDCX and the Ledger devices all came down to keys, logins or tampered machines, not smart contract bugs. That is why the money left exchanges and wallets rather than DeFi apps.
SIDE TRAIL: Binance Withdrawals Resume Today in Phases, 95% of Stolen Funds Replaced
What Happens to Binance Users Now?
They should be made whole. Binance says it has replaced about 95% of the stolen funds from its SAFU emergency fund, its futures insurance fund and its own treasury. About $3 billion is frozen on-chain. Withdrawals began reopening in phases on Sunday, November 1, and a full proof of reserves is due by Tuesday.
The attacker still holds the rest, mostly ETH and BTC that no issuer can freeze. For traders, October’s record says the same thing every big hack has: keep on an exchange only what you trade, and the rest in a cold wallet you control.
TRAIL MAP: Your First Crypto Wallet, Set Up Safely: Hot vs Cold and the Seed Phrase
VikingXBT has been trading crypto since 2017. The focus is futures, onchain data and automation. Onchain flows get checked before a chart is trusted, and anything repetitive gets automated. VikingXBT built Base Camp's own onchain scanner, which flags bundlers, snipers, dev holdings and wallet clusters in one view, and backtests strategies before trading them.
More from VikingXBT
