Liquid

X100

Treat

insurance

<h2 id="span-style-font-size-16px-color-inherit-font-weight-bolder-crypto-hacks-in-2-span-span-style-font-size-16px-color-inherit-font-weight-bolder-span-span-style-font-size-16px-color-inherit-font-weight-bolder-span-span-style-font-size-16px-color-inherit-font-weight-bolder-026-is-the-industry-under-attack-span">Crypto Hacks in 2026: Is the Industry Under Attack?</h2>
<a href="https://www.coingabbar.com/en/biggest-crypto-hacks-in-history" rel="noopener noreferrer nofollow">Crypto hacks</a> are back in the headlines, and the figures are large. DefiLlama's public hack tracker listed more than $8.7 billion in reported incident losses across 328 entries as of 3 November 2026. For all of 2025 it listed about $2.7 billion.
That total is not necessarily the amount still missing. Some incidents involved recoveries, frozen funds or unconfirmed estimates. Read it alongside the tracker's inclusion and recovery methodology.
<h2 id="span-span-style-font-size-16px-how-bad-are-crypto-hacks-this-year-really-span-span">How Bad Are Crypto Hacks This Year, Really?</h2>
The 328 entries are already more than double the tracker's full-year 2025 count. But an entry is a tracker line, not an audited net loss.
Public data suggests the dollar total is gross. We found no published rules on valuation date, duplicates or suspected incidents. Treat the totals as indicative.
Binance's entry is $6.36 billion, about 72% of the $8.776 billion total. Without it, the other entries add up to roughly $2.4 billion. In the table, "not established" means we found no figure from the company or tracker.
<div>
 <table>
 <colgroup>
 <col width="102">
 <col width="143">
 <col width="142">
 <col width="121">
 <col width="117">
 </colgroup>
 <tbody>
 <tr>
 <td>Incident</td>
 <td>Gross reported</td>
 <td>Recovered or frozen</td>
 <td>Net loss</td>
 <td>Evidence status</td>
 </tr>
 <tr>
 <td>Binance</td>
 <td>~$6.36B</td>
 <td>~$3B frozen (Binance)</td>
 <td>Not reconciled</td>
 <td>Estimated</td>
 </tr>
 <tr>
 <td>Bitget</td>
 <td>~$387.5M</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Company figure, revised</td>
 </tr>
 <tr>
 <td>Liquid Network</td>
 <td>~$320M</td>
 <td>Over $270M returned</td>
 <td>Not confirmed</td>
 <td>Partly recovered</td>
 </tr>
 <tr>
 <td>Ledger reseller</td>
 <td>~$93M</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Outside estimate</td>
 </tr>
 <tr>
 <td>CoinDCX</td>
 <td>~$16M</td>
 <td>Not established</td>
 <td>Absorbed by exchange</td>
 <td>Company-confirmed</td>
 </tr>
 <tr>
 <td>79th Vault</td>
 <td>~$12.5M</td>
 <td>~15,000 BNB reportedly returned</td>
 <td>Not reconciled</td>
 <td>Partly recovered</td>
 </tr>
 <tr>
 <td>Avalanche Safe</td>
 <td>~$7.45M</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Reported</td>
 </tr>
 <tr>
 <td>X100</td>
 <td>~$4.75M</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Tracker entry</td>
 </tr>
 <tr>
 <td>Gamdom</td>
 <td>$4.21M (company: just over $3M)</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Estimates differ</td>
 </tr>
 <tr>
 <td>NEAR Intents</td>
 <td>~$3.8M</td>
 <td>Full return, per project</td>
 <td>Project reports none</td>
 <td>Recovered</td>
 </tr>
 <tr>
 <td>NGRAVE LIQUID</td>
 <td>~$2.56M</td>
 <td>Not established</td>
 <td>Not established</td>
 <td>Reported</td>
 </tr>
 <tr>
 <td>Mercado Bitcoin</td>
 <td>$40M+ flagged</td>
 <td>Not established</td>
 <td>Unconfirmed</td>
 <td>Outside security firm</td>
 </tr>
 </tbody>
 </table>
</div>
<h3 id="span-span-style-font-size-16px-what-we-know-about-the-binance-breach-span-span">What We Know About the Binance Breach</h3>
<a href="https://www.coingabbar.com/en/binance-hack-shock-xrp-moves-4-91b-outflows" rel="noopener noreferrer nofollow">Binance's reported impact</a>, the amount frozen and the final unrecovered loss are separate figures.
<ul>
 <li>Reported impact: The tracker records about $6.36 billion. Analyst estimates run from $6.3 billion to $6.43 billion.</li>
 <li>Attribution:On 31 October and 1 November, the FBI and U.S. Secret Service blamed <a href="https://www.coingabbar.com/en/lazarus-group-north-korea-crypto-hackers-explained" rel="noopener noreferrer nofollow">Lazarus group</a>, a North Korea-linked group. North Korea denies involvement. Attribution does not establish every technical detail.</li>
 <li>Binance's account:On 29 October it cited a compromised engineer laptop. On 30 October it reported additional points of breach and no evidence of a wallet private key leak. On 31 October its co-CEO said a self-destruct mechanism wiped traces.</li>
 <li>Frozen funds:Binance reported about $3 billion frozen. Frozen means restricted, not returned.</li>
 <li>Coverage: Binance committed to cover losses from its reserve, an insurance fund and company money, and said on 31 October it had replaced 90% of stolen assets.</li>
</ul>
Open: the final net loss, the full attack path and the amount ultimately recovered.
<h2 id="span-span-style-font-size-16px-how-do-crypto-hacks-actually-happen-span-span">How Do Crypto Hacks Actually Happen?</h2>
Code bugs get the headlines, yet many crypto hacks started with something simpler. A private key is the secret that signs transactions.
<ul>
 <li>Retired wallets:<a href="https://www.coingabbar.com/en/coindcx-hack-update-exchange-absorbed-the-16m-loss" rel="noopener noreferrer nofollow">CoinDCX lost funds</a> from old deposit addresses after, it says, an automated sweep stopped working.</li>
 <li>Phishing:NGRAVE LIQUID's notification provider was compromised. Fake alerts then pushed users to hand over recovery phrases.</li>
 <li>Supply chain:Ledger devices from one reseller held a hidden implant that captured recovery phrases.</li>
 <li>Permissions: An Avalanche multisig had unlimited allowances pointing to an address where no contract existed. The attacker deployed their own.</li>
 <li>Governance: X100's attacker used a flash loan, borrowed money repaid within one transaction, to win two of three Senate seats and pass a treasury proposal.</li>
 <li>Code flaws: Liquid Network's verification error let unbacked tokens be minted. NEAR Intents blamed a deposit and withdrawal bug.</li>
</ul>
Most of these crypto hacks targeted people, processes and permissions, not the blockchain itself.
<h2 id="span-span-style-font-size-16px-why-do-stolen-funds-move-so-fast-after-crypto-hacks-span-span">Why Do Stolen Funds Move So Fast After Crypto Hacks?</h2>
After the <a href="https://www.coingabbar.com/en/binance-hack-6-3-billion-trump-cftc-react-crypto-regulation" rel="noopener noreferrer nofollow">Binance breach</a>, researchers reported tracing funds through about 12,000 wallet addresses across 11 blockchains. More than 40,000 transactions were observed in under four days.
Repeated patterns suggest software played a role. Automation does not prove an autonomous AI agent was in control. One researcher called automation with human oversight the likelier explanation.
Speed can complicate tracing. But an address count alone does not show how many addresses were new or who controlled them.
<h2 id="span-span-style-font-size-16px-are-ai-assisted-attacks-changing-crypto-security-span-span">Are AI-Assisted Attacks Changing Crypto Security?</h2>
AI-assisted cyberattacks are documented. Public evidence that AI directly drove a major 2026 crypto theft remains limited.
<h3 id="span-span-style-font-size-16px-what-the-google-and-anthropic-reports-show-span-span">What the Google and Anthropic Reports Show</h3>
<ul>
 <li>Google Threat Intelligence Group, "<a href="https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai/" rel="noopener noreferrer nofollow">GTIG AI Threat Tracker</a>: From Prompting to Autonomy," 8 September 2026. A suspected financially motivated actor used an AI coding chatbot and agent instructions to run a credential-harvesting campaign in under six hours. Google says thousands of third-party credentials were compromised, without an exact count.</li>
 <li>Anthropic, "Detecting and countering misuse of AI: September 2026," 10 September 2026. It reports breaches completed in two to three hours, and one case where a stolen developer token led to full cloud control in about three hours. <a href="https://www.anthropic.com/threat-intelligence-report-september-2026" rel="noopener noreferrer nofollow">Humans still chose targets</a>.</li>
</ul>
A coding chatbot is not the same as an autonomous agent. Neither report covers a crypto exchange.
<h3 id="span-span-style-font-size-16px-what-this-means-for-crypto-platforms-span-span">What This Means for Crypto Platforms</h3>
The link to crypto hacks is indirect but real. Stolen credentials and exposed keys can open systems that control digital assets, and AI may cut preparation time. That does not show AI caused the Binance breach. It shows why platforms should monitor access, protect signing systems and react fast. That is our reading, not a report finding.
<h2 id="span-span-style-font-size-16px-how-can-you-reduce-your-exposure-to-crypto-hacks-span-span">How Can You Reduce Your Exposure to Crypto Hacks?</h2>
You cannot prevent a breach. You can reduce what is exposed.
<ul>
 <li>Keep only trading funds on exchanges. Self-custody moves key security onto you, so it is not automatically safer.</li>
 <li>Buy hardware wallets from authorised sources and verify setup. Buying direct lowers reseller risk but does not make a device immune.</li>
 <li>Never enter your recovery phrase into a website.</li>
 <li>Revoke unused token approvals and use hardware security keys or strong two-factor authentication.</li>
 <li>Treat unsolicited compensation messages after crypto hacks as possible phishing.</li>
 <li>Read custody and reimbursement terms. <a href="https://www.coingabbar.com/en/how-to-verify-binance-proof-of-reserves" rel="noopener noreferrer nofollow">Proof of reserves</a>, an insurance fund and a promise to cover losses are different things.</li>
</ul>
<h2 id="span-span-style-font-size-16px-crypto-hacks-in-2026-the-bottom-line-span-span">Crypto Hacks in 2026: The Bottom Line</h2>
Reported losses from crypto hacks are large, and one incident dominates. But tracker totals, company statements and outside estimates measure different things.
Entry points were ordinary: keys, permissions, phishing and supply chains. Still open: final net losses, the Binance attack path, <a href="https://www.coingabbar.com/en/mercado-bitcoin-hack-38m-incident-11m-blocked" rel="noopener noreferrer nofollow">Mercado Bitcoin's total</a> and any AI role.
Disclaimer:This article is for information only and is not financial, investment or legal advice. Crypto assets are high risk, and figures here come from public reports that may change. Do your own research.

Crypto Hacks 2026: Why Reported Losses Exceeded $8.7B

Table of Contents

Coingabbar

Other articles published on Nov 3, 2026

Join our free newsletter for daily crypto updates!