<p>Since the Binance hack of 29 October 2026, hardly a day has passed without a new crypto hack. Binance lost around $6.3 billion, and attacks then hit Polymarket, Chainalysis, twelve DeFi sites through their domain registrar Name.com, operators of BTCPay Server and, on 2 November, the Brazilian exchange Mercado Bitcoin. On the same day, attacks on a critical flaw in a WordPress plugin for crypto payments came to light, and police in Singapore warned of hijacked WhatsApp accounts that send malware. According to DefiLlama's hacks database, there were already 325 crypto hacks with $8.7 billion in losses from January to October 2026, 2.7 times as many cases as in the same period of 2025. Below is every current case with its status and the next step that keeps you safe. This overview is updated with every new case.</p>
<p><strong>Key points at a glance</strong></p>
<ul>
 <li><strong>Binance, 29 October:</strong> around $6.3 billion stolen; the exchange says it has replaced about 95 percent from its own funds, and since 2 November users can verify the proof of reserves for ten tokens themselves.</li>
 <li><strong>Attackers:</strong> the FBI names the North Korean group TraderTraitor; North Korea has denied it since 2 November.</li>
 <li><strong>Mercado Bitcoin, 2 November:</strong> $40 million to more than $46 million drained, deposits and withdrawals suspended.</li>
 <li><strong>BTCPay Server, 1 November:</strong> hot wallets of older installations emptied, update to version 2.4.7 required.</li>
 <li><strong>WordPress, 2 November:</strong> attacks on the CryptoPayment Gateway plugin, severity 10 out of 10, no patch yet.</li>
 <li><strong>DefiLlama:</strong> 325 crypto hacks from January to October 2026, 48 in August alone, more than one a day.</li>
</ul>
<h2 id="crypto-hack-news-every-case-since-29-october-at-a-glance">Crypto hack news: every case since 29 October at a glance</h2>
<p>The table lists every major attack since the Binance hack, sorted by date. The amounts come from the victims themselves or from blockchain analysts; where figures differ, the range is shown.</p>
<table>
 <thead>
  <tr>
   <th>Date</th>
   <th>Target</th>
   <th>Loss</th>
   <th>Status</th>
   <th>Your next step</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>25 to 29 Oct</td>
   <td>Fake “Padre Terminal” app (iPhone)</td>
   <td>about $23,000 from 27 Solana wallets</td>
   <td>app removed</td>
   <td>Never enter a private key into an app</td>
  </tr>
  <tr>
   <td>29 Oct</td>
   <td>Binance</td>
   <td>about $6.3bn</td>
   <td>95% replaced, reserves verifiable</td>
   <td>Check your balance in the proof of reserves tool</td>
  </tr>
  <tr>
   <td>29 Oct</td>
   <td>Polymarket</td>
   <td>about $2.7m from 726 wallets</td>
   <td>trading reopened, refunds promised</td>
   <td>Check your account activity</td>
  </tr>
  <tr>
   <td>30 Oct</td>
   <td>Chainalysis</td>
   <td>names and email addresses of client staff</td>
   <td>leak confirmed</td>
   <td>Distrust emails from supposed investigators</td>
  </tr>
  <tr>
   <td>30 and 31 Oct</td>
   <td>Twelve DeFi sites via Name.com</td>
   <td>about $138,000 to $202,000</td>
   <td>domains resolving normally again</td>
   <td>Revoke approvals from 30 and 31 October</td>
  </tr>
  <tr>
   <td>1 Nov</td>
   <td>BTCPay Server</td>
   <td>hot wallets of older installations</td>
   <td>update 2.4.7 available</td>
   <td>Update the server, check the hot wallet</td>
  </tr>
  <tr>
   <td>2 Nov</td>
   <td>Mercado Bitcoin</td>
   <td>$40m to more than $46m</td>
   <td>deposits and withdrawals suspended</td>
   <td>Use only the exchange's official channels</td>
  </tr>
  <tr>
   <td>2 Nov</td>
   <td>WordPress plugin CryptoPayment Gateway</td>
   <td>attack attempts observed</td>
   <td>no patch, severity 10</td>
   <td>Switch off the plugin, check the receiving address</td>
  </tr>
  <tr>
   <td>2 Nov</td>
   <td>WhatsApp accounts (warning from Singapore)</td>
   <td>malware with keylogger</td>
   <td>police warning</td>
   <td>Do not open .iso, .rar or .zip files from chats</td>
  </tr>
 </tbody>
</table>
<h2 id="why-there-is-a-new-crypto-hack-almost-every-day">Why there is a new crypto hack almost every day</h2>
<p>The number of crypto hacks has multiplied in 2026. <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">DefiLlama's hacks database</a> counts 325 cases from January to October, against 120 in the same period of 2025. Losses rose from $2.5 billion to $8.7 billion, of which $6.5 billion fell in October alone, almost all of it Binance. Since April the monthly count has stayed above 30, and in August it reached 48.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/krypto_hacks_je_monat_en_2026_8fc7e0adf0.webp" alt="Bar chart: recorded crypto hacks per month according to DefiLlama, 120 cases from January to October 2025 and 325 in 2026, peaking at 48 cases in August 2026" width="1920" height="1080">
 <figcaption>
  Source: DefiLlama hacks database, as of 3 November 2026
 </figcaption>
</figure>
<p>What stands out is where the attackers strike. Of the 15 cases DefiLlama recorded between 25 October and 2 November, the database puts six in the category frontend and infrastructure, including Binance, Polymarket and BTCPay Server. The flaw there was not in a blockchain's code but in a laptop, a script embedded from a service provider or a server. Our view: the blockchains themselves are holding up; the weak spots are the people, tools and providers around them. That is also where you can protect yourself best, more on that at the end of this overview.</p>
<h2 id="binance-hack-what-is-known-as-of-3-november">Binance hack: what is known as of 3 November</h2>
<p>At around $6.3 billion, the Binance hack is the largest crypto theft in history. According to the exchange's <a href="https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7" rel="noopener noreferrer nofollow">first announcement</a>, the attacker used a DevOps engineer's compromised laptop to reach a service container and submitted unauthorised withdrawals from there. The FBI attributes the attack to the North Korean group TraderTraitor, which was also behind the 2025 Bybit hack. North Korea rejects this: Kim Yo-jong, sister of leader Kim Jong Un, called the accusations a US provocation, according to the <a href="https://www.bbc.com/news/articles/c6rey4v53exgo" rel="noopener noreferrer nofollow">BBC</a>. What is known about the attackers is in <a href="https://cryptoticker.io/en/binance-hack-north-korea-tradertraitor/" rel="noopener noreferrer nofollow">North Korea behind the Binance hack?</a></p>
<p>The money has not been recovered. By the count of investigator ZachXBT, issuers and networks had frozen around $2.83 billion by 30 October; the rest sits with the attacker or is being laundered, which is why the swap network THORChain paused swaps for a while, as we report in <a href="https://cryptoticker.io/en/thorchain-swap-pause-bitcoin-ether-laundering/" rel="noopener noreferrer nofollow">THORChain halts swaps</a>. Binance is covering its customers' losses: about 95 percent has been replaced, the exchange says, and the remaining 5 percent are less liquid tokens it is still buying. Since <a href="https://www.binance.com/en/support/announcement/detail/185bd9a4717f44088b3be70287b8237f" rel="noopener noreferrer nofollow">“Recovery Update #5” of 2 November</a>, users can check for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC that their balance is backed at least 1:1. A new snapshot with more tokens follows on 4 November. How it works is explained in <a href="https://cryptoticker.io/en/binance-proof-of-reserves-monday-6-34-billion/" rel="noopener noreferrer nofollow">Binance's proof of reserves</a>.</p>
<p>Since 1 November a story has been circulating on X that the engineer in question had an affair with a North Korean spy. There is no evidence for it, and Binance co-founder Yi He called it untrue. Our check of this and other theories is in the <a href="https://cryptoticker.io/en/binance-hack-conspiracy-theories-fact-check/" rel="noopener noreferrer nofollow">Binance hack fact check</a>.</p>
<h2 id="mercado-bitcoin-the-second-exchange-hack-in-a-week">Mercado Bitcoin: the second exchange hack in a week</h2>
<p>On 2 November Mercado Bitcoin, Brazil's largest crypto exchange, confirmed an attack on its systems and suspended all deposits and withdrawals. According to Cointelegraph, crypto assets worth more than $46 million flowed out across at least ten blockchains; DefiLlama lists $40 million. The exchange says its customers suffered no loss. Details are in <a href="https://cryptoticker.io/en/mercado-bitcoin-hack-withdrawals-halted/" rel="noopener noreferrer nofollow">Mercado Bitcoin halts withdrawals</a>.</p>
<p>The case shows one thing above all: even after Binance, every centralised exchange remains a target, and anyone holding a balance there can be locked out for days in an emergency. If you trade on an exchange, choose a regulated one; our comparison of <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">regulated crypto exchanges</a> shows which ones they are.</p>
<h2 id="btcpay-server-polymarket-and-name-com-attacks-through-tools-and-providers">BTCPay Server, Polymarket and Name.com: attacks through tools and providers</h2>
<p>Three cases from the past few days follow the same pattern: the attackers did not break into a blockchain but into a tool that users trust.</p>
<ul>
 <li><strong>BTCPay Server:</strong> late on 1 November the team behind the self-hosted bitcoin payment service warned that hot wallets on older installations were being drained. According to <a href="https://www.bleepingcomputer.com/news/security/btcpay-server-warns-of-hot-wallet-thefts-targeting-outdated-instances/" rel="noopener noreferrer nofollow">BleepingComputer</a>, instances up to version 2.4.1 are affected and the fix is the update to 2.4.7. What operators need to do now: <a href="https://cryptoticker.io/en/btcpay-server-hack-bitcoin-hot-wallets-drained/" rel="noopener noreferrer nofollow">BTCPay Server hack</a>.</li>
 <li><strong>Polymarket:</strong> on 29 October the prediction market halted trading on its international platform. According to <a href="https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html" rel="noopener noreferrer nofollow">The Hacker News</a>, attackers had hijacked an embedded script from the provider DebugBear and drained about $2.7 million from 726 wallets. Polymarket promised refunds to everyone affected, more in <a href="https://cryptoticker.io/en/polymarket-third-party-provider-attack-trading-halt/" rel="noopener noreferrer nofollow">Polymarket attack via a third-party provider</a>.</li>
 <li><strong>Name.com:</strong> in the night to 31 October, attackers redirected the DNS records of at least twelve DeFi sites registered with the US registrar. Visitors landed on copies with a wallet drainer even though the address in the browser was correct. According to Bitquery, 32 wallets lost about $202,000 in total. If you used one of these sites on 30 or 31 October, revoke the approvals you granted.</li>
</ul>
<p>Add to this the data leak at Chainalysis on 30 October: names, email addresses and roles of staff who use the software at client firms were exposed. Such data is raw material for convincing phishing emails in the name of supposed investigators.</p>
<h2 id="wordpress-plugin-for-crypto-payments-critical-flaw-under-attack">WordPress plugin for crypto payments: critical flaw under attack</h2>
<p>If your WordPress shop accepts crypto payments with the CryptoPayment Gateway plugin, switch it off now. The flaw CVE-2026-81648 in versions 1.2.1 and 1.2.2 carries the highest severity, 10 out of 10: without logging in, anyone can read and overwrite the payment plugin's stored settings and delete files. According to the security firm <a href="https://x.com/DefusedCyber/status/2117325160608870613" rel="noopener noreferrer nofollow">Defused</a>, those settings also hold wallet credentials in plain text, and since 2 November it has been seeing the first attack attempts. According to <a href="https://patchstack.com/database/wordpress/plugin/cryptopayment-gateway/vulnerability/wordpress-cryptopayment-gateway-plugin-1-2-1-1-2-2-unauthenticated-arbitrary-file-deletion-and-settings-update-vulnerability" rel="noopener noreferrer nofollow">Patchstack</a>, there is no official patch yet.</p>
<p>The danger: an attacker can swap the receiving address, and your customers' payments then flow quietly to him. If you have used the plugin, do not just switch it off; also compare the wallet address in the settings with your own records and renew the stored credentials.</p>
<h2 id="whatsapp-hack-hijacked-accounts-send-malware">WhatsApp hack: hijacked accounts send malware</h2>
<p>Police in Singapore warned on 2 November of a wave of hijacked WhatsApp accounts. According to <a href="https://www.asiaone.com/singapore/whatsapp-malicious-files-infect-computers-malware" rel="noopener noreferrer nofollow">AsiaOne</a>, the attackers use these accounts to send files with names such as “Invoice 2026-09-15.iso”, “Statement of Account_54d3.zip” or “Salary Revision.rar” to friends, colleagues and managers. Anyone who opens them on a computer installs malware that records keystrokes and takes screenshots. No financial losses have been reported so far.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/krypto_hack_aktuell_3_31919438f0.webp" alt="Illustration: a smartphone shows a chat message with an attached file, red warning light reflects on the display" width="1920" height="1080">
 <figcaption>
  Illustration, AI-generated
 </figcaption>
</figure>
<p>For crypto investors, that is exactly the danger: a program that reads your keystrokes also sees exchange passwords and every seed phrase you type. The scam is not tied to Singapore; it can hit anyone who uses WhatsApp Web or WhatsApp Desktop. Turn on two-step verification and check under “Linked devices” whether unknown sessions are logged in.</p>
<h2 id="fake-crypto-app-in-the-app-store-padre-terminal">Fake crypto app in the App Store: Padre Terminal</h2>
<p>Apps from official stores are no guarantee either. According to <a href="https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app-store-linked-to-23k-wallet-theft/" rel="noopener noreferrer nofollow">BleepingComputer</a>, the fake trading app “Padre Terminal” in Apple's App Store has drained 27 Solana wallets of about $23,000 in total since 25 October after users imported their private keys. The real platform is only available in the browser, and the fake has since disappeared from the App Store.</p>
<h2 id="how-to-protect-yourself-from-the-next-crypto-hack">How to protect yourself from the next crypto hack</h2>
<p>The good news: a few fixed rules help against most of the current attacks. We recommend these five steps:</p>
<ol>
 <li><strong>Coins you do not trade belong in your own wallet.</strong> That is the only way a hack on an exchange cannot touch them. Our <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a> shows which devices are suitable.</li>
 <li><strong>Never store your seed phrase or private key digitally.</strong> Do not type it out, do not photograph it, and never enter it into an app or a website.</li>
 <li><strong>Never open files from chats, job offers or emails on the computer that runs your wallet or exchange account.</strong> That applies to .iso, .rar and .zip as much as to supposed coding tests.</li>
 <li><strong>Revoke approvals regularly.</strong> After an incident like Name.com, use a tool such as Revoke.cash to check which contracts can still access your tokens.</li>
 <li><strong>Secure your accounts.</strong> Two-factor login with an app or security key instead of SMS, a whitelist for withdrawal addresses on the exchange and a separate email address only for crypto accounts.</li>
</ol>
<p>The guide <a href="https://cryptoticker.io/en/how-to-store-crypto-safely/" rel="noopener noreferrer nofollow">How to store crypto safely</a> explains this step by step. How the Binance hack compares with earlier cases is shown in our list of the <a href="https://cryptoticker.io/en/biggest-crypto-hacks-in-history-binance/" rel="noopener noreferrer nofollow">biggest crypto hacks</a>. All individual reports are collected in our <a href="https://cryptoticker.io/en/crypto-hacks/" rel="noopener noreferrer nofollow">crypto hacks</a> section.</p>

Crypto Hack News: Every Attack Since the Binance Hack and How to Stay Safe

Table of Contents

CryptoTicker ENG

Other articles published on Nov 3, 2026

Join our free newsletter for daily crypto updates!