October 2026: The Worst Month on Record
Crypto lost $6.50B across 35 incidents in October 2026, nearly nine times September's $742.0M and the worst month for hacks on record. Almost all of it came from a single event. On Oct 29, attackers drained an estimated $6.3B from Binance's hot wallets in about 20 minutes, the largest crypto theft ever recorded, and the FBI attributed it on Oct 31 to North Korea's TraderTraitor group.
This month, attackers went after the people and devices with access to the systems that move funds, and back to the moment a key or permission was first set up: an engineer's laptop at Binance, hardware wallets that were tampered with before their owners ever opened them, and token approvals that were unsafe from the day they were given.
Here's the month in security 馃憞
October 2026 losses by category
| Category | Loss | Incidents |
| Frontend and infrastructure (leaked keys, supply chain) | ~$6.46B | 7 |
| Private key / hot-wallet compromise | ~$17.30M | 4 |
| Token and share accounting | ~$5.06M | 10 |
| Governance (flash-loan takeover, malicious proposals) | ~$4.77M | 3 |
| Bridge and cross-chain (bridge logic, message spoofing) | ~$4.60M | 3 |
| Access control | ~$1.51M | 3 |
| Oracle / price manipulation | ~$1.28M | 1 |
| Input validation | ~$0.09M | 1 |
| Unclassified | ~$0.02M | 1 |
| Protocol logic (withdrawals) | ~$0.01M | 2 |
| Total (Oct 1 to 31) | $6.50B | 35 |
Source: DefiLlama
Hacks of the month
Binance, ~$6.3B (Oct 29). Attackers emptied Binance's hot wallets, the online wallets an exchange uses to process everyday withdrawals, across several blockchains in roughly 20 minutes, taking mostly BTC, ETH, USDT and USDC. Binance said the attacker got in through a compromised laptop belonging to one of its DevOps engineers, used it to reach internal systems and pushed through withdrawals nobody had authorized, and that it has seen no sign that the wallets' private keys were stolen. Onchain records show that one hot wallet was handed over to a contract the attacker controlled, using an Ethereum feature called EIP-7702 that lets a wallet delegate control to code, and that it was emptied about four minutes later in a single transaction. Binance says about $3B has since been frozen, including more than $2.4B in USDT and USDC frozen by Tether and Circle. It set aside more than $6.34B to make every customer whole and began reopening withdrawals in stages on Nov 1. The FBI attributed the theft to North Korea's TraderTraitor group on Oct 31.
Source | CoinDesk 路 CoinDesk 路 CryptoTicker 路 CBS News
Ledger devices sold through CryptoBilis, ~$86M to ~$95M (Oct 7 to 9). People who bought Ledger hardware wallets from the reseller CryptoBilis and set them up had their wallets drained, and the main sweep on Oct 9 took about $80.6M in 51 minutes across Tron, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. Ledger later confirmed that an affected device had an unauthorized chip hidden inside its case. The chip read the 24-word recovery phrase off the screen while the owner was setting the device up, then sent it to the attacker over a cellular connection through a built-in eSIM. Because the implant left Ledger's own secure chip and firmware untouched, Genuine Check, the tool Ledger uses to confirm a device is authentic, cannot detect it. Tether froze about $10M in USDT within hours of the drain, and Ledger has not confirmed a total loss or the number of affected users.
Source | The Hacker News 路 crypto.news 路 Shattered
79th Vault, ~$12.5M (Oct 7). An attacker took control of the operator key, an admin key with special powers over the 79AU token. That key could move 79AU out of the token's main trading pool on PancakeSwap to any address and then reset the pool's balances, so the attacker pulled the tokens out and sold them straight back into the same pool for 16,249 BNB. 79th Vault said the attacker got the key through a flaw in how account permissions were managed and offered a white-hat settlement, a reward for giving the funds back, and by Oct 9 the attacker had returned 15,000 BNB, about $11M.
Source | PANews 路 TokenPost 路 PANews
Avalanche Safe, ~$7.45M (Oct 26). A Safe multisig wallet on Avalanche, which needed 2 of its 7 signers to approve a transaction, had given one address unlimited permission to move its tokens back in March. That address held the operator's pool contract on Ethereum, Base and Arbitrum, but the contract had never been deployed on Avalanche, so on Avalanche the address was empty. Because the address came from Safe's public CreateCall deployer, anyone could create a contract at that same address on Avalanche by repeating the deployment steps. The attacker did this, running 12 throwaway deployments to reach the right sequence number and placing a contract that swept the Safe on the 13th. A front-running bot copied the attacker's transaction and got it confirmed first, then offered to return the funds for a bounty, and on Oct 27 a Safe owner agreed on-chain that it could keep 42,500 WAVAX, about $371K. No signer key was stolen.
Source | Panda Security
Offchain: the secrets were weak or exposed before anyone attacked them.
Railway, the cloud hosting platform, disclosed on Oct 22 that an unauthorized party may have accessed the encrypted settings its customers store for their apps, known as environment variables, and read the decrypted contents of some of them. Security researcher Taylor Monahan linked about $371K drained from more than 200 wallets on at least 19 EVM chains to private keys that had been stored in those settings, though Railway has not confirmed the link.
Source | BleepingComputer 路 crypto.news
eMudhra, a certificate authority that issues the certificates browsers rely on to trust websites, had eight of its intermediate signing keys created with so little randomness that anyone could work them out from the public certificates. One of the private keys was simply the number 4. eMudhra traced the problem to a flaw in the April 2025 ceremony where those keys were generated. Chrome, Firefox, Apple and Microsoft stopped trusting the affected certificates between Oct 17 and Oct 20, and Go, Node.js, Ubuntu, Debian and certifi shipped fixes. eMudhra says only one of the eight keys was in use and none had issued certificates to websites or end users, and it is unknown whether anyone exploited the flaw.
Source | The Hacker News 路 The Register
Qubic's wallet created its secret seeds with Math.random(), a basic random number function that was never meant for security, and it also exposed other numbers from the same random sequence in unencrypted network traffic. SlowMist showed that seeing just six of those numbers was enough to rebuild a wallet's seed, and Qubic reported that about 2.94 trillion QU was taken from 1,404 wallets.
Source | SlowMist
The pattern across the month.
In June and July, most of the big losses came from attackers breaking into systems and stealing the keys stored there.
In October, the biggest loss came through an engineer's laptop that had access to Binance's withdrawal systems, and many of the other failures came from keys and permissions that were unsafe from the moment they were created: a recovery phrase captured while a device was being set up, certificate keys that could be guessed, wallet seeds made with a weak random number function, and a Safe approval given in March to an address on Avalanche that anyone could still claim. A few things worth adding to the review list:
Know where every key came from and who can reach it. Buy hardware wallets only from the manufacturer or an authorized reseller, and if you generate keys yourself, check that the randomness behind them is truly secure instead of assuming the library got it right. Private keys that sit in a hosting platform's environment variables are only as safe as that platform, as Railway's disclosure showed this month. At Binance, the attacker got in through an engineer's laptop and the internal systems it could reach, not through a stolen wallet key, so who and what can reach your signing and withdrawal systems deserves the same scrutiny as the keys themselves.
Approvals outlive the reason they were granted. The Avalanche Safe gave spending permission to an address that only existed on other chains, and that permission sat open for seven months. Check the token approvals your treasury and multisig wallets have given out on every chain they use, and revoke any that are no longer needed.
Put time between a permission change and money moving. One of Binance's hot wallets was handed to an attacker's contract and emptied about four minutes later. Built-in waiting periods, such as timelocks and minimum holding times on approval and governance changes, give your monitoring a chance to catch a bad change before funds leave.
Disclaimer
This report aggregates publicly reported information as of the publication date and may be revised as investigations evolve and post-mortems are released. Recommendations are general guidance. Verify against primary sources before acting on any specific claim.
About This Series
Quantstamp publishes the Security Beat monthly. We've conducted 1,300+ audits and secured $500B+ in digital assets across 250+ clients, including Ethereum Foundation, Aave, Polymarket, Ethena, Visa, OpenSea, Maker, Curve, Compound, and Lido. If you'd like to chat about anything security-related or request an audit, reach out.
