$8.78 Billion Lost to 328 Hacks: Crypto's Record 2026

Crypto lost $8.78 billion to 328 hacks in 2026 as of early November, the most for any year in DefiLlama's records. A single incident, the October 29 attack on Binance's operational infrastructure, accounts for roughly $6.3 billion of that, and the top five hacks together make up more than 85% of the year's losses.

The shape of the year is what matters if you hold tokens. The count of hacks rose about 2.7 times from 2025 while the median loss fell from $1.07 million to $0.51 million. More attacks got through, most of them small, and a handful carried nearly all the money.

Key Facts

• 2026 losses: $8.78 billion across 328 hacks as of early November, a record for DefiLlama's list (DefiLlama, via Immunefi's research).
• Largest single loss: about $6.3 billion from Binance on October 29, with the list also stating $6.36 billion for the same event.
• Lending and CDP protocols: at least 33 hacked in 2026 for a combined $192 million, median loss $756,000, as of November 2 (Immunefi).
• Most common cause among those 33: oracle manipulation, in 14 incidents.
• Recovery data: DefiLlama's list carries a returnedFunds field that is null for almost every 2026 entry, so how much money came back is mostly not recorded there.

The 2026 Losses the List Records

The table below collects the largest incidents DefiLlama's list ties to a figure, with the date the list gives for each. Every number is from DefiLlama's hack list as of early November 2026; the lending breakdown is from Immunefi's review of the same records.

Three incidents on the list carry no usable number. Ankr's Ethereum bridge was exploited on November 9 by five forged withdrawal receipts referencing a single Optimism deposit that had already been redeemed, with no amount recorded. Harmony suffered an infinite mint exploit on August 11 per a CertiK alert, and the loss was not disclosed. The Coreum figure of about $200,000 has no dedicated post-mortem behind it.

Bridges: Forged Messages and One Leaked Key

The largest bridge loss came through social engineering rather than a code bug. On April 18, Kelp DAO's rsETH bridge was exploited for $293 million when attackers compromised LayerZero's RPC nodes and injected fraudulent cross-chain messages. Kelp's 1-of-1 verifier configuration created a single point of failure, and the forged messages affected validation across 20 chains. The attack was attributed to Lazarus Group.

The same failure mode repeats at smaller size. On June 10, the Axelar-Secret Network ICS-20 bridge was exploited when an attacker created a custom IBC channel and forged deposit packets, minting $4.67 million in unbacked tokens without validating the packet source channel. On June 21, an SGX signing key leaked on GitHub let an attacker forge invalid proofs and drain about $1.7 million from Taiko's ERC20 Vault on Ethereum. Ankr's November 9 breach used five withdrawal receipts pointing at one Optimism deposit that had already been redeemed.

The July 17 attack on the Risk Labs relayer shows the other side of the ledger. Between 05:07 and 06:14 UTC, an attacker submitted 1,627 forged Solana deposits with about $41.7 million in face value from single-use wallets across 18 destination chains. The relayer filled 581 of them and paid out roughly $4.5 million. The loss was a fraction of what the forged deposits asked for, because most of them were not filled.

Lending Pools Took the Most Hits, Not the Most Money

Lending and CDP protocols drew the most incidents. Immunefi counts at least 33 hacked in 2026, for a combined $192 million, with a median loss of $756,000 as of November 2. One incident accounts for about two-thirds of that total, and of the other 32, 22 lost less than $1 million.

Oracle manipulation led the causes, appearing in 14 of the 33 incidents. That is the failure a holder should care about most: a lending market that prices collateral from an outside feed can be pushed to lend against a bad price, and the pool, not the attacker, eats the shortfall.

Protocol age was no protection. Of the 31 hacks where DefiLlama records a listing date, 22 of the protocols had been listed for a year or more when they were hit. The median loss also fell for the year as a whole, from $1.07 million in 2025 to $0.51 million, which fits the picture of many small, cheap attacks against established names.

Exchange Keys and a Ledger App

Grinex lost roughly $13.74 million in April after hot wallet keys were compromised. Attackers immediately swapped USDT into TRX and ETH to defeat stablecoin freezes, then the exchange suspended operations. That sequence, swapping into assets nobody can freeze, is the standard move once keys are gone.

Binance's October 29 breach is the outlier of the year by an order of magnitude. DefiLlama's list puts it at approximately $6.3 billion in unauthorised withdrawals across multiple blockchains, executed by exploiting the exchange's operational infrastructure. Binance has said the breach began with fake job interviews used to get at its systems.

Zilliqa shows how far one leak can stretch. Attackers recovered private keys from about 5 on-chain signatures using lattice reduction and stole approximately 683.13 million ZIL, with exploitation first spotted on July 19. The vector was a Ledger app, which puts the failure inside the signing path rather than in a contract.

What the List Does Not Tell You

Recovery is the biggest hole. DefiLlama's list has a returnedFunds field for recovered money, and it is null for almost every 2026 entry, so the list mostly does not say what came back. The FOOM Cash entry is one place a recovery is written down: after attackers withdrew $2.26 million on March 2 through forged zero-knowledge proofs against a misconfigured Groth16 verifier, a white-hat recovered $1.84 million, or 81% of the stolen funds.

The list also gives no 2026 dollar totals split out by category, so there is no separate bridge, lending or exchange subtotal to compare against earlier years. Earlier-year comparison stops at Immunefi's medians, because no independent total for 2025 losses was read.

The Binance figure deserves its own caution. It appears in the same data two ways, as an amount field of 6,360,000,000 and a description saying approximately $6.3 billion, and no statement from Binance or a regulator was read to confirm either. The Harmony and Coreum incidents have never had an amount disclosed. Treat the year total as DefiLlama's running tally rather than a settled figure.

Timeline

• March 2: FOOM Cash drained of $2.26 million via forged zero-knowledge proofs.
• April 18: Kelp DAO's rsETH bridge exploited for $293 million.
• April: Grinex loses $13.74 million after hot wallet keys are compromised.
• June 10: Axelar-Secret Network ICS-20 bridge exploited for $4.67 million.
• June 21: Taiko's ERC20 Vault drained of about $1.7 million via a leaked SGX key.
• July 17: 1,627 forged Solana deposits submitted to Risk Labs' relayer; 581 filled for about $4.5 million.
• July 19: Exploitation of the Zilliqa Ledger flaw first spotted; 683.13 million ZIL stolen.
• August 9: Coreum bridge exploited for about $200,000.
• August 11: Harmony hit by an infinite mint exploit, amount undisclosed.
• October 29: Binance loses approximately $6.3 billion.
• November 9: Ankr's Ethereum bridge exploited, amount not recorded.

What Would Change This Answer

A confirmed figure for the Binance breach would move the year's total more than anything else, in either direction. If Binance, a regulator or an auditor puts a number on the October 29 withdrawals, the $8.78 billion headline changes with it. If DefiLlama fills in its recovery field for 2026, the picture shifts from gross losses to what was actually gone, and the FOOM Cash case suggests recovery can matter.

Disclosed amounts for Harmony and Coreum would add to the total, though by little at these sizes. The larger question is timing: DefiLlama's list is a running record, so the 2026 figure will keep moving until the year closes. The number above is a snapshot as of early November, not a final one.