322 hacks and $8.7B gone: crypto's 2026 security ledger

October was the month crypto security broke. On Oct 29, Binance was drained for roughly $6.3B — the biggest crypto hack ever recorded and four times the size of the Bybit breach, according to a month-by-month tally from @crypto_banter. Twenty days earlier, tampered Ledger devices with hidden LTE chips leaked seed phrases and $86M+ walked out the door. And on Sep 24, Bitget's hot wallets took a hit of about $388M.

The year's running scorecard, per the same thread: 322 hacks and $8.7B stolen. That's more than double last year's incident count. November and December haven't happened yet — the total is still climbing.

April delivered a four-act disaster. Drift lost $285M on Apr 1 after a six-month social engineering campaign, then KelpDAO's bridge was fooled into releasing 116,500 rsETH worth $292M on Apr 18. Two days later the attacker used that stolen rsETH as collateral on Aave, $8.45B in deposits fled the platform within 48 hours, and Arbitrum's Security Council froze 30,766 ETH tied to the attacker.

The earlier months set the tone. A five-year-old overflow bug drained Truebit for $26M in January, oracle manipulation cost YieldBlox $10M in February, and a stablecoin minting flaw took $25M from Resolv in March. May added an $11.5M drain on the Verus-Ethereum bridge, and June saw Humanity Protocol lose $31M+ after its multisig keys sat on a single compromised laptop.

Summer and early fall kept piling on. A Coldcard seed flaw let attackers sweep $116M+ in BTC from more than 5,200 addresses on Jul 30. Tectonic got drained for $120M on Aug 30 and Cronos rolled back two hours of its chain to undo it. On Sep 6, Liquid Network lost 4,000 BTC worth $320M — with the "white hats" keeping $47M as a bounty.

Binance, Bitget and Aave headline a list that spans bridges, hardware wallets and multisigs alike — no layer of the stack came out clean. With two months left on the calendar, the only open question is how much higher the number goes.