The short version
- Crypto hacks cost about $129 million in October through the 25th, per DefiLlama, down 83% from September’s $743 million; the $718 million “record” going around is from October 2022.
- One theft made up almost three quarters of it: an estimated $93 million drained from Ledger wallets with a hidden implant, sold by reseller CryptoBilis, while DeFi protocols lost only $12.3 million.
- The crew is watching whether more tampered devices turn up outside Southeast Asia, and whether Ledger confirms the loss figure.
Crypto hacks cost about $129 million in October so far, according to DefiLlama’s hack tracker. That is 83% less than September’s $743 million. Almost three quarters of it came from one place, and DeFi apps had little to do with it.
It was tampered Ledger hardware wallets. An estimated $93 million drained from people who bought their devices from a reseller in Southeast Asia. So if October wasn’t the record month some posts claim this weekend, where did the money go?
Ledger’s security team posted the first findings on October 13:
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.
Was October the Worst Month for Crypto Hacks?
No. The “$718 million across 11 hacks, four on October 11, bridges 82%” figure going around since Saturday is from October 2022. Chainalysis posted those numbers mid-month that year, and the month went on to become the biggest single month for crypto hacking on record, with $775.7 million stolen in 32 attacks.
DeFi hacks this October look nothing like that. DefiLlama lists 23 incidents through October 25, and only four of them passed $4 million.
Bridges, the target in 2022, lost about $3.9 million this month. That is 3% of the total, not 82%.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
What Was the Biggest Crypto Hack in October?
The Ledger supply chain attack, at an estimated $93 million. Users started reporting empty wallets on October 9, and Ledger confirmed on October 10 that one affected device had an unauthorized implant inside its case.
The devices came from CryptoBilis, a Ledger reseller in Southeast Asia. Ledger’s Donjon team found that the implant read the 24-word recovery phrase off the screen during setup and sent it out over a mobile network through a built-in eSIM. With the seed phrase, the attacker could rebuild every key on the device. They didn’t need to break the chip.
Ledger says its own systems and its direct sales were not breached, and it hasn’t confirmed the loss figure. The $93 million comes from on-chain analysis, as security firm Halborn noted, and other researchers put it between $86 million and just over $100 million. Halborn also counts about $10 million in USDT that Tether froze on October 12.
It may not stop at one reseller. Former Mt. Gox CEO Mark Karpelès said a Ledger Flex he bought at Singapore’s Changi Airport had a spy module, and a researcher reported similar changes in devices bought in Europe. Ledger hasn’t linked those cases to the CryptoBilis thefts.
Why Did DeFi Get Off So Lightly?
DeFi protocols lost $12.3 million in October, their lowest month of 2026 in DefiLlama’s data. The rest of the month’s losses hit a wallet maker, an exchange and a gambling site.
The biggest DeFi loss was NEAR Intents, which halted deposits and withdrawals on October 1 after a bug in its cross-chain deposit layer let about $3.8 million out of a hot wallet on BNB Chain. The team said it would pay users back in full.
After that the list gets small fast. Initia lost $2.6 million to an infinite mint on October 23, Papertrade lost $1.28 million to price manipulation on Hyperliquid, and a MakerDAO liquidation bot lost $538,000. Twelve of the other 16 incidents were under $200,000.
Outside DeFi, Indian exchange CoinDCX lost about $16 million from a hot wallet on Tron on October 21, and the casino Gamdom about $4.2 million through a leaked key. Both came down to keys kept on internet-connected servers, the same weak spot behind Bitget’s loss in September.
DISCOVER: DeFi Basics: Swaps, Liquidity Pools and Impermanent Loss
Where Do Crypto Hacks Stand in 2026?
At about $2.37 billion across 312 incidents, with October still open. Two months did most of the damage.
April lost $648 million, most of it the $285 million Drift exploit on Solana. September lost $743 million: a hot wallet breach at Bitget, which the exchange put at $351.6 million, and a $320 million drain of Blockstream’s Liquid Network through Bitcoin minted from nothing, though the attacker sent about 85% of it back a day later.
Bridges account for about $753 million of this year’s total, or 32%. That share was 64% in 2022, so attackers have moved on to keys, servers and now hardware.
What Should Ledger Owners Do Now?
Check where you bought the device. Ledger’s advice is plain: don’t set up an unused CryptoBilis device, and if you already did, move the coins to a new device with a new recovery phrase. If you lost funds, contact the police before you open the device, so it can be examined.
For everyone else, October’s lesson is about where the box has been. Buy a hardware wallet from the maker or an official store, never from a marketplace seller. Never use a device that arrives with a recovery phrase already written down or a seal that looks wrong.
Crypto hacks fell sharply in October. The biggest one of the month needed no code bug at all, only time alone with the device before it was sold.
EXPLORE: Your First Crypto Wallet, Set Up Safely: Hot vs Cold and the Seed Phrase
In crypto since 2016. Covers altcoins and the daily market. When not trading, out climbing and traveling.
More from Teddy →
