Crypto Hack News: Every Attack Since the Binance Hack and How to Stay Safe

Since the Binance hack of 29 October 2026, hardly a day has passed without a new crypto hack. Binance lost around $6.3 billion, and attacks then hit Polymarket, Chainalysis, twelve DeFi sites through their domain registrar Name.com, operators of BTCPay Server and, on 2 November, the Brazilian exchange Mercado Bitcoin. On the same day, attacks on a critical flaw in a WordPress plugin for crypto payments came to light, and police in Singapore warned of hijacked WhatsApp accounts that send malware. According to DefiLlama's hacks database, there were already 325 crypto hacks with $8.7 billion in losses from January to October 2026, 2.7 times as many cases as in the same period of 2025. Below is every current case with its status and the next step that keeps you safe. This overview is updated with every new case.

Key points at a glance

• Binance, 29 October: around $6.3 billion stolen; the exchange says it has replaced about 98 percent from its own funds, and since 2 November users can verify the proof of reserves for ten tokens themselves.
• Attackers: the FBI names the North Korean group TraderTraitor; North Korea has denied it since 2 November.
• Mercado Bitcoin, 2 November: $40 million to more than $46 million drained, deposits and withdrawals suspended.
• BTCPay Server, 1 November: hot wallets of older installations emptied, update to version 2.4.7 required.
• WordPress, 2 November: attacks on the CryptoPayment Gateway plugin, severity 10 out of 10, no patch yet.
• DefiLlama: 325 crypto hacks from January to October 2026, 48 in August alone, more than one a day.

Crypto hack news: every case since 29 October at a glance

The table lists every major attack since the Binance hack, sorted by date. The amounts come from the victims themselves or from blockchain analysts; where figures differ, the range is shown.

Why there is a new crypto hack almost every day

The number of crypto hacks has multiplied in 2026. DefiLlama's hacks database counts 325 cases from January to October, against 120 in the same period of 2025. Losses rose from $2.5 billion to $8.7 billion, of which $6.5 billion fell in October alone, almost all of it Binance. Since April the monthly count has stayed above 30, and in August it reached 48.

What stands out is where the attackers strike. Of the 15 cases DefiLlama recorded between 25 October and 2 November, the database puts six in the category frontend and infrastructure, including Binance, Polymarket and BTCPay Server. The flaw there was not in a blockchain's code but in a laptop, a script embedded from a service provider or a server. Our view: the blockchains themselves are holding up; the weak spots are the people, tools and providers around them. That is also where you can protect yourself best, more on that at the end of this overview.

Binance hack: what is known as of 6 November

At around $6.3 billion, the Binance hack is the largest crypto theft in history. According to the exchange's first announcement, the attacker used a DevOps engineer's compromised laptop to reach a service container and submitted unauthorised withdrawals from there. The FBI attributes the attack to the North Korean group TraderTraitor, which was also behind the 2025 Bybit hack. North Korea rejects this: Kim Yo-jong, sister of leader Kim Jong Un, called the accusations a US provocation, according to the BBC. What is known about the attackers is in North Korea behind the Binance hack?

The money has not been recovered. By the count of investigator ZachXBT, issuers and networks had frozen around $2.83 billion by 30 October; the rest sits with the attacker or is being laundered, which is why the swap network THORChain paused swaps for a while, as we report in THORChain halts swaps. Binance is covering its customers' losses: about 98 percent has been replaced, the exchange says, and the remaining 2 percent are less liquid tokens it is still buying. Since “Recovery Update #5” of 2 November, users can check for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC that their balance is backed at least 1:1. The new snapshot of 4 November covers 44 tokens instead of 10, according to “Recovery Update #7”; the proof takes about 50 to 60 hours, after which holders of these tokens can check their backing themselves. How it works is explained in Binance's proof of reserves. Binance is reopening withdrawals in phases: according to “Recovery Update #6” of 3 November, the second phase has been running since 04:00 UTC for more tokens on nine networks, with many coins such as ADA and LTC available for now only as BEP20 tokens on BNB Smart Chain. Since 04:00 UTC on 5 November, Binance has been reopening 69 more token and network pairs step by step, according to “Recovery Update #8”, such as UNI, AAVE and LDO on Ethereum and AVAX and INJ on BNB Smart Chain, plus tokens on Base, Tron, Polygon and Sui. On 6 November, “Recovery Update #9” added 58 more pairs step by step from 04:00 UTC, such as PENDLE and WLFI on BNB Smart Chain, VIRTUAL and MORPHO on Base and ETH on Optimism, plus pairs on Arbitrum and Avalanche. What that means for your own withdrawal is in Binance withdrawals phase 2.

Since 1 November a story has been circulating on X that the engineer in question had an affair with a North Korean spy. There is no evidence for it, and Binance co-founder Yi He called it untrue. Our check of this and other theories is in the Binance hack fact check.

Mercado Bitcoin: the second exchange hack in a week

On 2 November Mercado Bitcoin, Brazil's largest crypto exchange, confirmed an attack on its systems and suspended all deposits and withdrawals. According to Cointelegraph, crypto assets worth more than $46 million flowed out across at least ten blockchains; DefiLlama lists $40 million. The exchange says its customers suffered no loss. Details are in Mercado Bitcoin halts withdrawals.

The case shows one thing above all: even after Binance, every centralised exchange remains a target, and anyone holding a balance there can be locked out for days in an emergency. If you trade on an exchange, choose a regulated one; our comparison of regulated crypto exchanges shows which ones they are.

BTCPay Server, Polymarket and Name.com: attacks through tools and providers

Three cases from the past few days follow the same pattern: the attackers did not break into a blockchain but into a tool that users trust.

• BTCPay Server: late on 1 November the team behind the self-hosted bitcoin payment service warned that hot wallets on older installations were being drained. According to BleepingComputer, instances up to version 2.4.1 are affected and the fix is the update to 2.4.7. What operators need to do now: BTCPay Server hack.
• Polymarket: on 29 October the prediction market halted trading on its international platform. According to The Hacker News, attackers had hijacked an embedded script from the provider DebugBear and drained about $2.7 million from 726 wallets. Polymarket promised refunds to everyone affected, more in Polymarket attack via a third-party provider.
• Name.com: in the night to 31 October, attackers redirected the DNS records of at least twelve DeFi sites registered with the US registrar. Visitors landed on copies with a wallet drainer even though the address in the browser was correct. According to Bitquery, 32 wallets lost about $202,000 in total. If you used one of these sites on 30 or 31 October, revoke the approvals you granted.

Add to this the data leak at Chainalysis on 30 October: names, email addresses and roles of staff who use the software at client firms were exposed. Such data is raw material for convincing phishing emails in the name of supposed investigators.

WordPress plugin for crypto payments: critical flaw under attack

If your WordPress shop accepts crypto payments with the CryptoPayment Gateway plugin, switch it off now. The flaw CVE-2026-81648 in versions 1.2.1 and 1.2.2 carries the highest severity, 10 out of 10: without logging in, anyone can read and overwrite the payment plugin's stored settings and delete files. According to the security firm Defused, those settings also hold wallet credentials in plain text, and since 2 November it has been seeing the first attack attempts. According to Patchstack, there is no official patch yet.

The danger: an attacker can swap the receiving address, and your customers' payments then flow quietly to him. If you have used the plugin, do not just switch it off; also compare the wallet address in the settings with your own records and renew the stored credentials.

WhatsApp hack: hijacked accounts send malware

Police in Singapore warned on 2 November of a wave of hijacked WhatsApp accounts. According to AsiaOne, the attackers use these accounts to send files with names such as “Invoice 2026-09-15.iso”, “Statement of Account_54d3.zip” or “Salary Revision.rar” to friends, colleagues and managers. Anyone who opens them on a computer installs malware that records keystrokes and takes screenshots. No financial losses have been reported so far.

For crypto investors, that is exactly the danger: a program that reads your keystrokes also sees exchange passwords and every seed phrase you type. The scam is not tied to Singapore; it can hit anyone who uses WhatsApp Web or WhatsApp Desktop. Turn on two-step verification and check under “Linked devices” whether unknown sessions are logged in.

Fake crypto app in the App Store: Padre Terminal

Apps from official stores are no guarantee either. According to BleepingComputer, the fake trading app “Padre Terminal” in Apple's App Store has drained 27 Solana wallets of about $23,000 in total since 25 October after users imported their private keys. The real platform is only available in the browser, and the fake has since disappeared from the App Store.

How to protect yourself from the next crypto hack

The good news: a few fixed rules help against most of the current attacks. We recommend these five steps:

1. Coins you do not trade belong in your own wallet. That is the only way a hack on an exchange cannot touch them. Our hardware wallet comparison shows which devices are suitable.
2. Never store your seed phrase or private key digitally. Do not type it out, do not photograph it, and never enter it into an app or a website.
3. Never open files from chats, job offers or emails on the computer that runs your wallet or exchange account. That applies to .iso, .rar and .zip as much as to supposed coding tests.
4. Revoke approvals regularly. After an incident like Name.com, use a tool such as Revoke.cash to check which contracts can still access your tokens.
5. Secure your accounts. Two-factor login with an app or security key instead of SMS, a whitelist for withdrawal addresses on the exchange and a separate email address only for crypto accounts.

The guide How to store crypto safely explains this step by step. How the Binance hack compares with earlier cases is shown in our list of the biggest crypto hacks. All individual reports are collected in our crypto hacks section.