Crime & Security2 min readThe Assayer
Binance's $6.36bn loss is the largest on record and 97.9% of October's total
Binance's loss of $6.36 billion on October 29 is the largest of 1,336 recorded crypto hacks and exploits. The next largest is LuBian, at $3.50 billion. It made up 97.9% of October’s $6.50 billion in known losses. The ledger recorded 35 incidents that month, 29 of them with a known loss.
Without Binance, known October losses come to $135.9 million. September recorded $742.8 million across 37 incidents. Known losses so far in 2026 total $8.74 billion across 325 incidents.
Binance
According to DefiLlama's hacks data, attackers exploited Binance's operational infrastructure to make unauthorised withdrawals across multiple blockchains. Binance's preliminary investigation identified a potentially compromised DevOps engineer's laptop that allowed access to a service container. The investigation found no evidence that wallet private keys had leaked.
About $3 billion of the stolen assets was later frozen with help from industry partners. Binance committed to covering all losses from its SAFU fund and company reserves.
The rest of the month
The second-largest October loss was $93.0 million from a supply chain attack on Ledger hardware wallets. Attackers bought genuine devices and fitted concealed components that captured recovery phrases during setup and sent them out over cellular connections. They then redistributed the modified devices through resellers. Ledger confirmed that its Secure Element, operating system and internal infrastructure were not compromised.
CoinDCX lost about $16 million in suspicious outflows from TRON addresses. The exchange attributed the outflows to addresses compromised in its July 2025 breach, which kept receiving deposits after being deprecated. It acknowledged that its deposit-sweeping process failed temporarily and said it absorbed the losses while crediting affected users. Investigators disputed whether the addresses had genuinely been removed from active operations.
At X100, an attacker used flash-loan-funded X tokens to take two of three Senate seats. Within the same transaction, the attacker passed and executed a malicious treasury proposal that cost the protocol $4.8 million. Gamdom lost $4.2 million in a multichain hot-wallet compromise after unauthorised access to an automation server. How the attacker gained control of Gamdom's wallets remains unconfirmed.
| Date | Target | Method | Lost |
|---|---|---|---|
| 2026-10-29 | Binance CEX | Key Leaked via Infrastructure | $6.36 billion |
| 2026-10-09 | Ledger (Supply Chain) | Supply Chain Attack | $93.0 million |
| 2026-10-21 | CoinDCX | Hot Wallet Key Compromised | $16.0 million |
| 2026-10-24 | X100 | Flashloan Governance Attack | $4.8 million |
| 2026-10-13 | Gamdom | Key Leaked via Infrastructure | $4.2 million |
| 2026-10-01 | NEAR Intents | Bridge Logic Flaw | $3.8 million |
| 2026-10-29 | Polymarket International | Supply Chain Attack | $2.7 million |
| 2026-10-23 | Initia | Infinite Mint | $2.6 million |
| 2026-10-17 | Qubic | Weak Key Generation | $1.3 million |
| 2026-10-10 | Papertrade | Spot Price Manipulation | $1.3 million |
From the archive
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
