October 2026: Crypto's Worst Month for Hacks, $6.48B in 56 Attacks

At 04:50 UTC on Sunday 1 November 2026, PeckShield, a blockchain security firm that keeps a running count of crypto thefts, posted its tally for October. It counted 56 major hacks and $6.48 billion lost. September, until then the worst month of the year, had cost $766.49 million. October was about 745% higher.

No month in the record comes close. The previous worst was February 2025, when about $1.5 billion went, almost all of it from the exchange Bybit. October 2026 cost more than four times that. Most of the money left in a few hours on one evening: on 29 October, thieves emptied the hot wallets of Binance, the world's largest crypto exchange, and Binance put the damage at about $6.3 billion.

That single theft is about 97% of October's total. Take it out, and the other 55 hacks add up to roughly $180 million, an average of about $3.3 million each. That is close to an ordinary month in 2026: PeckShield counted $136.3 million in August.

The other counters

©CMZ chart. Data: PeckShield

Security firms count crypto losses the way analysts count earnings: each one has its own definitions, and the totals rarely match to the dollar. CertiK, an auditing firm, posted on 31 October, before the month had ended, that it had confirmed about $6.5 billion lost in October "to exploits and phishing", which means it also counts people tricked into signing away their own coins, not only systems broken into. CertiK's live dashboard also showed about $3.03 billion frozen or returned in October, which leaves about $3.47 billion lost once that money is taken off. It put 2026 as a whole at about $9.2 billion, the highest on record.

DefiLlama, a public data site that keeps a database of hacks, listed 35 October incidents worth about $6.50 billion on 2 November, with Binance at about $6.36 billion. Chainalysis, the tracing firm that police forces and exchanges use, estimated the Binance theft at $5.912 billion. The firms agree on the shape of the month. They disagree on how many incidents count as "major" and on whether frozen money should lower the total. PeckShield's $6.48 billion is the gross figure, before any of the frozen or returned money is counted.

What happened in October

The month did not start as a record. On 1 October, NEAR Intents, a service that swaps coins between blockchains, lost about $3.87 million, and the attacker handed it back after a 48-hour ultimatum. On 7 October, the operator key of 79thVault, a small finance project on BNB Chain, was used to drain about $12.5 million from its own trading pool; about 92% came back two days later.

The first large loss came on 9 October. Ledger, the Paris company that makes the best-selling hardware wallets (small devices that keep the keys to someone's coins offline, like a safe deposit box), told buyers who had bought from CryptoBilis, a reseller in Southeast Asia, not to use their devices. Tampered wallets had been emptied. Estimates ranged from about $72 million to $102 million; PeckShield put it at $93 million, the seventh largest hack of the year on its list.

On 21 October, about $16 million in USDT, a digital dollar, left wallets linked to CoinDCX, one of India's largest exchanges. Its chief executive, Sumit Gupta, first called the reports rumours; three hours and 37 minutes later the exchange admitted "operational losses". On 13 October, Gamdom, an online casino that takes bets in crypto, lost more than $3 million from its hot wallets, three weeks after a rival, Duelbits, lost about $7 million. On 26 October, a shared wallet on the Avalanche blockchain lost $7.45 million through a permission granted in March and never withdrawn, and a trading bot that copied the thief's transaction returned all but $371,000.

Then came 29 October. That afternoon, a hacked monitoring script on Polymarket's real website drained about $2.65 million from hundreds of people betting on its prediction markets. That evening, from about 20:05 UTC, Binance's hot wallets were emptied across 10 blockchains. A hot wallet is the part of an exchange's money kept online to pay out withdrawals, like the cash in a shop's till, while most coins stay in cold storage, like cash in a vault. Binance said its first findings pointed to an engineer's hacked laptop, and later spoke of "additional points of breach". It said about $3 billion had been frozen and that it would cover all losses from its own funds. On 31 October, the FBI said North Korea was responsible for the theft of more than $6 billion from Binance. Binance began reopening withdrawals on 1 November and says it has covered about 95% of the stolen value.

The last two days kept going. On 30 October, Chainalysis disclosed that an attacker using AI agents had reached customers' names, email addresses and role labels inside its own systems; no money was reported stolen. On 31 October, the web addresses of Kintsu, Flap and 10 other crypto sites were hijacked and pointed at a wallet-draining kit, and one transaction took about 97 million CORE tokens, worth about $1.47 million, from b14g, a staking app on the Core blockchain.

How one theft dwarfs a year

PeckShield's list of the ten largest hacks of 2026, as of 31 October: Binance $6.3 billion ($3 billion frozen); Bitget $387 million; Liquid Network $320 million ($285 million returned); Drift $292 million; KelpDAO and LayerZero $285 million; Coldcard wallets $130 million; the CryptoBilis Ledger drainer $93 million; Tectonic Finance $74 million; Humanity Protocol $31 million; Step Finance $28.9 million.

Those ten add up to 92.3% of the year's $8.6 billion, PeckShield says, before frozen and returned money is counted. Binance alone is about 73% of the year. DefiLlama's database tells the same story: on 2 November it listed about $8.74 billion for 2026, of which Binance was about $6.36 billion. Without Binance, 2026 would stand at roughly $2.38 billion on DefiLlama's count, short of the $2.72 billion it recorded for all of 2025.

This is how crypto losses usually look. Most hacks are small: a bug in one app, one phished wallet, a few million dollars. A handful are huge, and they come from the places where money piles up. An exchange's hot wallet holds coins for millions of customers at once, the way a clearing house holds money for a whole market. Whoever gets the keys gets all of it in one go. Bybit in February 2025 and Binance in October 2026 were both exchanges, and the FBI has blamed both thefts on North Korea.

That makes monthly totals a poor guide to risk. A quiet month can be one break-in away from a record, and a record month can hide 55 attacks that look like any other month's.

How the CMZ count differs

Crypto Media Zone keeps its own count on its crypto hack statistics page. It only includes incidents CMZ has investigated and written up, and it counts the amount that was taken, whether or not it later came back. Its figures will not match PeckShield's, CertiK's or DefiLlama's, and are not meant to. Several entries on PeckShield's top ten carry slightly different figures in CMZ's own reports, because the reports use the numbers given by the companies or investigators at the time: Drift at $295.4 million, Kelp DAO at $292 million, Coldcard at about $116 million by TRM Labs' count and Humanity Protocol at $36 million. CMZ's Liquid Network report has $319 million taken and about $272 million returned, against PeckShield's $320 million and $285 million.