$6.5 billion in October: the infrastructure failed, not the smart contract

In October 2026 the crypto market lost just under $6.5 billion, and almost all of it flowed out through compromised infrastructure: through staff computers, signing systems, build processes and websites. Only a small share of the damage traces back to flaws in smart contracts, the part of the stack the industry has been debating for years and pays audit reports for. For investors that means one thing: a project with a clean audit can still lose your money if access to its servers is open.

cryptoticker.io compiled this analysis itself on October 30, 2026. The basis is DefiLlama's public hack register, which records every reported incident with a date, a loss figure and an attack route. All 32 entries dated between October 1 and October 30, 2026 were counted.

$6.46 billion out of $6.50 billion: seven incidents carry almost the entire loss

The month's 32 incidents add up to $6.495 billion. Of that, $6.461 billion falls on seven entries the register files under frontend and infrastructure. That is 99.5 percent of the total from 22 percent of the cases.

The counter-calculation sharpens the picture. All the categories in which the program logic of a contract actually failed or was exploited come to less than $16 million together: faulty share calculations in ten cases ($5.1 million), governance attacks in three cases ($4.8 million), two bridge incidents ($4.6 million), one price oracle manipulation ($1.3 million), plus one case each of missing input validation and faulty payout logic. Four further incidents run under compromised keys and cost $17.3 million, the largest of them $16 million at the Indian exchange CoinDCX on October 21.

Frontend and infrastructure: what sets this category apart from a smart contract bug

A smart contract bug is a flaw in program code that sits on the blockchain. It is publicly readable, it can be audited, and whoever finds it can exploit it until the contract is replaced.

An infrastructure attack targets everything that stands around that code: a developer's computer, the server that triggers payouts, the software library a website is built from, the system that signs transactions. The code on the blockchain stays unchanged throughout. It merely executes what an attacker instructs it to do from a position the system treats as authorized.

That is the decisive difference when you assess a provider: in the first case an audit report helps. In the second, what counts is how well a company controls its internal access rights, its approval processes and its suppliers, and none of that appears in any public document.

The Binance incident of October 29: $6.3 billion to $6.36 billion through the signing system

The month's largest single item is the attack on Binance on the evening of October 29. The hack register lists $6.36 billion, Binance itself puts the impact at around $6.3 billion, and analytics firm Chainalysis arrives at $5.9 billion according to media reports. The funds left the exchange's wallets within about 20 minutes across ten blockchains.

On the cause, Binance has published a preliminary finding: through the compromised computer of a DevOps employee, an attacker is said to have gained access to a service container and triggered unauthorized payouts from there. No leak of private wallet keys has been demonstrated so far, the company said; the investigation of the full attack path is still running. How the computer was compromised, and how long the access lasted, is open. The exchange has pledged to cover all losses through its reserve fund and its own funds, has temporarily suspended withdrawals and has rebuilt the withdrawal service. On company figures around $3 billion has been frozen, of which $2.54 billion was most recently confirmed as verified. cryptoticker.io has traced the technical reconstruction of the signatures in detail.

Security firm TRM Labs attributes the attack, in its own words with high confidence, to the North Korea-linked group TraderTraitor. That is the assessment of a private analytics house, not an official finding; no state confirmation exists so far.

Supply chain attack: $93 million through a tampered software library

A supply chain attack pushes malicious code into a component that many providers use in common, and so reaches all of their users at the same time. The month's second-largest item falls into this category: on October 9, $93 million flowed out through an attack attributed to wallet maker Ledger. What happened there and which users were affected is what cryptoticker.io wrote up at the time of the incident.

The same pattern shows up three more times further down the month's list: at trading bot Bloom on October 26 with $953,000, at prediction platform Polymarket on October 29 with $2.7 million on the register's figure and $3.0 million to $3.1 million according to media reports, and at Predict Fun on October 27 with $400,000. At gambling platform Gamdom, $4.2 million was lost on October 13 through a key that leaked via the infrastructure.

One point in this is practically important for you: in a frontend attack the website looks exactly as it always does. The address in the browser bar is right, the certificate is right, and the page sits on the correct server. The only thing that has changed is what the page presents to your wallet for signature.

Smart contract audits cover the code, not the build pipeline

An audit checks what a contract does when it runs unchanged on the blockchain. The build pipeline, meaning the path from the source code of a website or app to the version that arrives in your browser, sits outside that scope. Nor does it include an employee's computer, a company's access management or an exchange's signing system.

The October figures therefore do not say that audits are useless. The finding is a different one: the audit badge on a project page tells you nothing about the biggest source of loss that month. Anyone drawing a conclusion from that 99.5 percent for their own custody does not end up with a better contract, but with the question of how much third-party infrastructure they expose their holdings to at all. An overview of devices that keep keys from leaving your own home is in the hardware wallet comparison.

MiCA: what an exchange in Germany owes on custody

Since the European legal framework MiCA took effect, providers that hold customer funds in crypto assets need a licence and must keep customer holdings separate from their own. That prevents no attack. It does determine who is liable in the event of a loss, who has to answer to the supervisor and which reporting duties apply after a security incident.

One important difference from a bank account remains: there is no statutory deposit protection for crypto balances. Reserve funds such as Binance's are voluntary pledges by a company, not a state guarantee. Whether a platform operates under regulation in Germany is something you can check before depositing; which providers work with a European licence is shown by our comparison of regulated crypto exchanges.

Blind signing: the hardware wallet shows what the app withholds

Blind signing means confirming a transaction whose content the device does not display in plain text. This is exactly where a frontend attack takes hold: the tampered interface shows you a harmless operation, while the data presented for signature does something else.

A hardware wallet only helps against this attack if you actually read the device screen and compare it with what the website claims: recipient address, amount and type of operation. If one of those differs, you cancel. The device serves as the second, independent display; its value lies not in owning it but in looking at it.

Token approvals: the lever an attacker keeps longest

A token approval allows a smart contract to move a certain amount of your tokens. Many applications ask for an unlimited approval because it is convenient and saves fees. That permission stays in place until you revoke it, and it still works long after you have stopped using the application.

If somebody takes over the frontend of an application you hold an open approval with, they do not need your key. That is why the list of approvals you have granted is one of the few things you can check and trim yourself without specialist knowledge. It makes sense to limit approvals to the amount an operation genuinely needs, and to revoke old ones regularly.

Market reaction: the price shows the damage only faintly

The largest theft in the industry's history came through to prices comparatively quietly. Bitcoin traded at around $77,800 on the morning of October 30, 2.5 percent below its level 24 hours earlier, and ether at around $2,222, about 3.9 percent lower. Part of the explanation lies in the frozen funds: stablecoin issuers can block balances on request, and billions that are never liquidated create no selling pressure either.

The second half of the explanation is less comfortable. When an incident of this size barely moves the market, platforms lack the immediate financial incentive to secure their internal access routes at expense. There is no proof of that; it is an assessment, not an established fact.

What remains of the October figures in November

The register logs seven infrastructure incidents in a single month, and several of them hit platforms that are advertised in Germany. A repeat is neither announced nor ruled out. What can be decided today, by contrast, is the question of how much of your holdings sits on a platform whose inner workings you cannot inspect.

A rule of thumb from the figures: holdings you intend to trade in the coming weeks belong on a licensed exchange. Holdings you keep for longer belong where no third-party service container can trigger a payout.

Crypto hacks: 99 percent of the damage ran through the infrastructure

1. Split your holdings. Decide what share stays on the exchange and what share moves into your own custody. For the second part, the hardware wallet comparison gives you the choice of devices.
2. Check the platform's licence. Look up whether your provider works with a European licence and keeps customer holdings separate; the comparison of regulated crypto exchanges places the large providers.
3. Trim your approvals. Go through the token approvals your wallet has granted, revoke old ones and limit new ones to the amount required.

The raw data for this count is in DefiLlama's public hack register; the attribution of the Binance attack comes from the analysis by TRM Labs.

(As of October 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Protect yourself: Storing crypto safely, and guarding against hacks like the one at Binance.