Village
Log in
Ten long horizontal bands of graphite hatching, one above another, on warm paper. The same narrow slice is cut cleanly out of all ten at the same point, its edges marked in forest green.

Binance’s $6.4 billion loss has already made 2026 the worst year for crypto hacks on record

Attackers took $6.4 billion from Binance on October 29, pushing this year’s reported crypto hack losses past twice any previous full year in DefiLlama’s tracker. Attackers didn’t exploit a bug in Binance’s code; they took over the systems that approve its withdrawals.

by Village Team

Last month we found that hacks exploiting flaws in crypto software had surged since March, weeks after capable AI coding agents arrived, while total losses had barely moved. Then, on October 29, attackers took $6.4 billion from Binance, the world’s largest crypto exchange.

Crypto thieves get in one of two ways: they exploit bugs in smart contracts, the public programs behind decentralized finance, or they take over the keys, accounts and systems that control the money. Our Village monitor tracks every incident in DefiLlama’s hack tracker, a widely used public list of crypto hacks.

2026’s crypto hack losses are already more than twice any previous year’s

Reported losses from crypto hacks in DefiLlama’s tracker from January 1 to October 31 of each year, 2021 to 2026, stacked by type. 2021: $2.2B in total, 75% from flaws in code; largest incident Poly Network, $611M. 2022: $3.1B in total, 65% from flaws in code; largest incident Ronin Bridge, $624M. 2023: $1.2B in total, 34% from flaws in code; largest incident Mixin Network, $200M. 2024: $1.6B in total, 24% from flaws in code; largest incident DMM Bitcoin, $305M. 2025: $2.5B in total, 20% from flaws in code; largest incident Bybit, $1.4B. 2026: $8.7B in total, 17% from flaws in code; largest incident Binance, $6.4B.

  • The previous record was about $4 billion, in 2020. Nearly 90% of that came from one theft, at the LuBian mining pool.
  • Binance accounts for nearly three-quarters of them. Without it, the year’s losses would be 13% above the 2022–2025 average.
  • Losses to code flaws are still up 81% on the 2022–2025 average, but they are now a small slice of the total.

Our first study found that 2026 looked like 2021 and 2022, when bugs in bridges and DeFi protocols drove the losses. One theft has tipped the year back toward 2023 to 2025, when compromised keys and infrastructure at exchanges did. Both are now happening at once: code exploits more frequent than ever, and takeovers that are rarer but can be far larger.

The largest crypto hack ever didn’t need a code flaw

The ten largest crypto hacks in DefiLlama’s tracker by reported loss, colored by how the attacker got in. 8 of the ten came through stolen keys or accounts. Binance, Oct 2026: $6.4B, stolen key or account. LuBian mining pool, Dec 2020: $3.5B, stolen key or account. Bybit, Feb 2025: $1.4B, stolen key or account. Ronin Bridge, Mar 2022: $624M, stolen key or account. Poly Network, Aug 2021: $611M, flaw in code. BNB Chain bridge (Binance), Oct 2022: $570M, flaw in code. Coincheck, Jan 2018: $534M, stolen key or account. Mt. Gox, Feb 2014: $470M, stolen key or account. FTX, Nov 2022: $450M, stolen key or account. Bitget, Sep 2026: $387M, stolen key or account.

  • Binance lost nearly twice the previous record. Attackers withdrew funds across at least ten blockchains in a single day.
  • No smart contract was broken. Binance’s early investigation pointed to an engineer’s compromised laptop that let attackers get the exchange’s own systems to sign withdrawals, and its co-CEO later said the attack went further than one engineer’s permissions.
  • Eight of the ten largest hacks came this way. Only two of them, both in 2021 and 2022, exploited flaws in code.

Stablecoin issuers and other partners froze about $3 billion of the stolen funds, and Binance says it will cover all customer losses. Blockchain analysts at TRM Labs and Chainalysis attributed the theft to North Korean hackers, the same group TRM linked to last year’s $1.4 billion Bybit theft.

Takeovers hit a monthly record while code exploits fell

Monthly counts of crypto hacks in DefiLlama’s tracker from January 2021 to October 2026, stacked by type: flaws in code, stolen keys or accounts, and rug pulls or other. A dashed line marks the 2022–2025 average of 10.9 code exploits a month. Code exploits stayed near that line through February 2026, then rose to between 22 and 43 a month from March through October, peaking at 43 in August 2026; October brought 23. Stolen-key incidents ranged from 0 to 11 a month, peaking at 11 in October 2026. Dotted lines mark the releases of OpenAI’s GPT-5.3-Codex and Anthropic’s Claude Opus 4.6 on February 5, 2026, and of Claude Fable 5 on June 9, 2026.

  • Key and account takeovers set a record. October brought 11, the most of any month in the tracker.
  • Hardware wallets were hit too. Attackers resold Ledger devices fitted with hidden implants that captured recovery phrases, then drained about $93 million from their owners.
  • Code exploits fell but stayed high. October brought the fewest since March, still twice the 2022–2025 monthly average.

How we built this

This update uses the same Village monitor as our first study, built on DefiLlama’s Hacks API. The figures use the November 2 snapshot, with incidents through October 31, and compare the same January 1–October 31 window in every year; full-year totals for earlier years run January through December.

We grouped DefiLlama’s classifications as before: flaws in code, stolen keys or accounts (including phishing and compromised infrastructure, where DefiLlama files the Binance theft), and rug pulls or market abuse. Losses are the tracker’s reported estimates before any recoveries, so Binance counts in full although about half was frozen, and valuations differ from one incident to the next. Incidents can be added late, so October’s counts may still rise.

Next up