October Losses of US$6.5 Billion Push Full-Year Total to Record US$9.2 Billion
Blockchain security firm CertiK released statistics on the evening of October 31 Taiwan time, showing the crypto industry lost about US$6.5 billion to exploit attacks and phishing in October 2026, pushing year-to-date cumulative losses to about US$9.2 billion, a new all-time high. Statistics published by CertiK's security alert account CertiK Alert put confirmed October losses at about US$6.5 billion and the year-to-date total of about US$9.2 billion as a record high, with the figures cited by The Defiant, Phemex News, South Korean media TokenPost and Chaincatcher, with October losses led by the Binance incident.
Phemex News noted the US$6.5 billion figure is gross losses before deducting recovered amounts; CertiK's real-time dashboard shows US$3.03 billion was frozen or returned to victims in October, bringing adjusted losses down to US$3.47 billion. By this calculation, October's total losses account for about 70% of the year's cumulative total, with January-September totaling about US$2.7 billion, showing a single major incident can rewrite full-year security loss statistics. However, none of the above reports provided a breakdown by attack type or blockchain, nor did they publish year-on-year comparison figures, with the statistics covering losses from exploit attacks and phishing.
Binance Hack Accounts for Bulk, Official Pledge to Cover Losses
Binance's hot wallet was hacked on October 29 US Eastern Time, with estimated losses of about US$6.3 billion, the main reason for the surge in October losses. According to data from blockchain analytics firm Elliptic cited by 247 Wall St. via Yahoo Finance, hackers linked to North Korea took about 18,270 Bitcoin, worth about US$1.42 billion, about 519,000 Ether, worth about US$1.17 billion, and about 233 million XRP, worth about US$292 million.
Binance CEO Teng Yan said 90% of the stolen assets have been replenished, with the remaining 10% to be covered by company funds, and withdrawals expected to resume on November 1, with users to bear no financial losses from the incident; co-founder He Yi said US$6.34 billion has been allocated from company funds to establish a user fund, with proof-of-reserves results expected before November 2.
Smaller Incidents Continue, Focus Turns to Recoveries
Apart from Binance, smaller security incidents have occurred in succession. The Block reported that 12 DeFi websites registered with domain registrar Name.com were hijacked, with about US$138,000 stolen. Bitcoin staking protocol b14g said about 97 million CORE tokens were withdrawn without authorization, estimated by The Defiant at about US$1.36 million based on midday prices that day; the protocol has suspended the affected contracts, with staked Bitcoin unaffected, and Phemex News cited b14g as saying exchanges have frozen about 9 million CORE linked to the attacker.
In addition, blockchain analytics firm Chainalysis disclosed it was breached through AI agent technology, with some clients' names and emails leaked; prediction market Polymarket saw user accounts stolen after a third-party service was hacked. Threshold, issuer of Bitcoin cross-chain token tBTC, suspended minting and redemptions for security maintenance but said no funds were lost. With cumulative losses already at a record, the market will next watch whether frozen funds can ultimately be returned to victims, as well as Binance's proof of reserves and resumption of withdrawals, and full-year losses could still be revised upward if another major incident occurs before year-end.