Crypto hacks have already more than doubled last year's total, with 322 incidents recorded in 2026 and about $8.73 billion stolen, according to DefiLlama's data.
The tracker lists the October 29 Binance attack at $6.36 billion. That represents roughly 73% of this year's recorded losses, making the exchange breach the biggest contributor by far. The incident count tells a separate story: attacks were piling up well before those wallets were drained.
More attacks, even before the biggest theft
In an October 30 post, the analytics platform said:
With 2 months left, that's already more than twice the total number of hacks last year.
Its database contains 148 incidents for the whole of 2025. Comparing that full-year figure with this year's count through October 30 gives an increase of about 118%. This is not a comparison of matching ten-month periods.
The current count also exceeds the previous annual high of 217 in 2024. The series stretches back to 2011, although the number of recorded incidents should not be treated as a count of every theft suffered by every crypto user.
The entries cover several parts of the industry, including centralized exchanges, wallets, bridges and decentralized finance applications. They also describe different ways money can be lost, from compromised infrastructure to flaws in contract permissions and accounting.
That scope matters. Calling the whole figure “DeFi losses” would incorrectly fold exchange and wallet incidents into one category. It would also hide the difference between someone gaining access to a company's withdrawal systems and someone exploiting code that holds users' deposits.
One breach changes the dollar picture
Removing the Binance entry leaves about $2.37 billion across the other 321 incidents. Those losses are below last year's roughly $2.72 billion total, even as the number of attacks has climbed sharply.
The comparison shows why a rising incident count and rising dollar losses need separate explanations. More incidents do not automatically mean each attack is getting larger. One unusually large theft can overwhelm the annual total.
TRM Labs independently estimated the Binance theft at approximately $6.36 billion, valuing transfers at asset prices when they occurred. It traced the outflows across ten blockchains and attributed the attack to North Korea's TraderTraitor group. That attribution is the firm's assessment; it is not a public finding by Binance or a government agency.
The valuation method also explains why loss figures can differ as a story develops. Token prices move, investigators identify more addresses, and frozen assets may remain unrecovered. A gross theft estimate is different from the amount customers ultimately lose.
The recovery effort is still changing
Apex had earlier reported the exchange's estimate of roughly $6.3 billion in impact. In a fresh October 30 investigation update, the company said it had uncovered additional breach points after initially identifying a potentially compromised laptop.
That leaves the technical explanation open. TRM's analysis points to possible access to signing infrastructure, while the company's earlier statement said it had found no evidence of a wallet private-key leak. Those accounts should not be reduced to a final claim that stolen keys explain the entire attack.
That update said around $3 billion had been frozen with partners. Freezing limits what an attacker can move; it does not mean the funds have already been returned. The company also said outflows stopped when it paused withdrawals and that deposits remained unaffected.
It repeated its commitment:
Binance will cover all losses from the SAFU fund and the company’s funds.
A later announcement said more than $6.34 billion of company funds had been reserved, with $5 billion already held in the affected tokens. Purchases were underway for the remainder through markets and OTC channels. The company said that allocation excluded frozen or protected assets; it has not yet announced that the purchases are complete.
Withdrawals remained the immediate issue for customers. The exchange said it was still working toward its previously announced restart schedule, with a further 45 hours expected from that update. That was a target, rather than confirmation that customers could withdraw again.