Crypto security failures have cost an estimated $8.782 billion across 342 recorded incidents in 2026, according to DefiLlama’s November 12 snapshot. Yet almost three-quarters of that total came from one breach. The October 29 Binance theft, valued at $6.36 billion in DefiLlama’s database, accounts for 72.4% of the year’s losses. That concentration raises a question obscured by the record headline: what does the remaining $2.422 billion reveal about weaknesses beyond a single major exchange?
BlockBriefing reviewed DefiLlama’s incident records, forensic findings from Chainalysis and Elliptic, and published estimates of blockchain industry revenue. The records show how compromised signing authority, flawed accounting logic, vulnerable infrastructure and malicious websites can produce different kinds of losses. The figures are estimates of assets stolen, not necessarily customers’ final unrecovered losses.
One Binance Breach Dominates The Year’s Losses
As of November 12, DefiLlama’s tracked incident database reported approximately $8.782 billion lost in 342 incidents. Its entry for Binance’s October attack is $6.36 billion. Subtracting that entry yields approximately $2.422 billion in recorded losses associated with the other 341 incidents.
The distinction matters because a single exceptional event can distort year-over-year comparisons and sweeping claims about the security of every network or protocol. A lower total after excluding Binance would not demonstrate that smaller protocols are safe. Nor does the $8.782 billion figure establish that individual users collectively suffered that amount in final losses after freezes, reimbursements or recovery.
Even the largest-incident estimates differ slightly by source. Elliptic calculated $6.43 billion across 11 blockchains; Chainalysis described approximately $6.4 billion in unauthorized transfers. Both estimates are consistent with the scale of DefiLlama’s $6.36 billion database entry, rather than separate additional thefts.
What Investigators Found Inside The Binance Attack
Chainalysis places the beginning of the unauthorized Binance withdrawals at about 4:20 p.m. Eastern Time on October 29. Elliptic’s analysis identifies transfers from wallets on Ethereum, Bitcoin, Solana, XRP Ledger, Tron and other chains.
On Ethereum, Elliptic’s forensic analysis says the attacker exploited EIP-7702 delegation. It describes a transaction carrying 50 valid authorizations associated with the Binance 14 hot wallet, covering different transaction nonces. Once delegation took effect, a malicious sweeper contract could execute transfers with that wallet’s authority. Elliptic also reported that the delegated access remained active long enough to sweep later deposits.
This does not mean Ethereum’s signature cryptography was broken. Rather, the evidence suggests that a hostile actor obtained effective authorization through the exchange’s operational signing environment. Binance initially raised a compromised DevOps engineer’s laptop as one possible point of entry; Elliptic reports that the exchange subsequently said it found additional breaches. The entire internal attack path has not been made public.
It is the central weakness illustrated by the incident: a blockchain can accept technically valid transactions that the legitimate custodian never intended to authorize. Security reviews limited to smart-contract code cannot resolve vulnerabilities in privileged access, staff devices, operational approvals and transaction-signing workflows. BlockBriefing’s guide to crypto custody and control of private keys explains why authorization arrangements matter for both users and institutions.
Frozen Assets Do Not Automatically Mean Recovery
Chainalysis reported that approximately $2.8 billion tied to the Binance theft was frozen as of November 3. Elliptic’s November 1 update independently verified approximately $2.85 billion in frozen or seized funds. The timestamps and methodologies differ, so these figures should not be added together.
Chainalysis also found that the attacker swapped $325 million in stablecoins for approximately $285 million in Ether during a roughly 20-minute window. The blockchain intelligence firm’s tracing showed repeated wallet-funding patterns and automated transfers. Both Chainalysis and Elliptic linked the activity to North Korea’s TraderTraitor group; Elliptic reported the FBI’s October 31 attribution.
Binance said it would cover the losses with its company resources and SAFU fund, according to Elliptic. But the precise amount ultimately returned to affected parties, the amount irretrievably lost and the long-term effectiveness of repairs are separate questions. Frozen funds are not synonymous with completed reimbursement.
Fresh Incidents Reveal Different Infrastructure Failures
DefiLlama’s November 10 entry for Arcus Perps describes an accounting flaw that allowed transfers between subaccounts to inflate a recorded balance. The attacker withdrew roughly $2.23 million in USDG; an additional $3 million in requested withdrawals was reportedly stopped by a bridge rate limit and subsequently reversed. The database says Arcus patched the weakness and covered the shortfall from its treasury.
On the same date, Across Protocol’s domain was reportedly compromised through social engineering against registrar Namecheap, redirecting visitors toward a malicious wallet interface. DefiLlama lists the total stolen amount as undisclosed. This was an attack on the frontend and domain-administration layer, not proof that the underlying bridging contracts were broken. For broader context on risks outside smart contracts, see BlockBriefing’s crypto custody security guide.
Its records also identify approximately $615,000 lost in an Initia infrastructure-key compromise and $200,000 in a Rujira liquidity-strategy exploit. The Rujira description places the underlying exploitation on November 10 and its database entry on November 11. Together these incidents cover privileged keys, accounting, website administration and swap logic, distinct points of failure requiring different controls.
Why The Revenue Comparison Needs More Context
A November 12 industry debate highlighted estimates attributed to ARK Invest researcher Lorenzo Valente: approximately $26.9 billion in cumulative thefts since 2017 against around $47 billion in estimated cumulative on-chain revenue. This implies about $0.57 in recorded theft for every $1 of estimated revenue. Contemporary accounts also describe an estimated $5.6 billion of 2026 on-chain revenue, compared with this year’s $8.782 billion in recorded hack losses. The published revenue comparison is based on a different measurement framework from DefiLlama’s incident ledger.
These figures should not be read as literal theft from every dollar earned. The stolen assets may belong to customers and custodians that are different from the protocols generating on-chain revenue. The distinction between asset ownership, custody and balance-sheet exposure also matters when assessing crypto treasury companies and their balance-sheet risks. Revenue is not net profit, and losses are often measured at the time of the exploit rather than after asset recovery. In particular, the Binance event alone exceeds the estimated $5.6 billion annual revenue figure, making a broad ratio unusually sensitive to one event.
Excluding Binance would leave approximately $2.42 billion in other reported hack losses. This remains serious, but far below the cited revenue estimate. That does not make any individual incident less consequential. It shows why concentration and measurement definitions must accompany dramatic industry-wide numbers.
The Unanswered Questions For Exchanges And Customers
Public evidence has not established precisely how Binance’s internal approval boundaries were crossed, which defensive controls failed first, or the final distribution of losses. BlockBriefing has not independently reconstructed the complete wallet transaction graph or obtained a private Binance forensic report. The conclusions here are a documented synthesis of published investigators’ assessments and database figures, not an assertion of unpublished inside information.
The question for custodians is how quickly a compromised authorized environment can be detected and isolated. Multi-party transaction review, withdrawal velocity restrictions, independent signing controls and immediate suspension mechanisms may limit exposure, but none should be treated as a substitute for evidence that controls actually work during an active breach.
The headline is striking: nearly $8.8 billion recorded as stolen this year. The deeper finding is more precise. One catastrophic exchange compromise accounts for 72.4% of the total, while hundreds of other incidents show that security failures span separate layers of the crypto system. Whether the industry can demonstrate stronger operational safeguards and transparent accounting of eventual recoveries remains unresolved.
Sources And Investigation Methodology
- DefiLlama: Hacks & Exploits Database: November 12, 2026 figures, incident descriptions and project-level loss estimates.
- Chainalysis: The $6.4 Billion Binance Hack: on-chain timeline, attribution, freezing and laundering observations.
- Elliptic: The Largest Theft in History: transaction mechanics, wallet authority, public Binance statements and frozen asset findings, updated November 1.
- BeInCrypto: Crypto Hack Losses Head Past On-Chain Revenue: November 12 reporting on ARK Invest’s estimates and their underlying comparison.
Methodology: BlockBriefing calculated Binance’s share as $6.36 billion divided by $8.782 billion and the non-Binance remainder by subtraction. Figures were sourced from publicly available research and a November 12 DefiLlama snapshot. They are subject to revisions as incident estimates, freezes and recoveries change. No private interviews or proprietary forensic tracing are claimed.
