Crypto hacks in 2026: CertiK’s reported $9.2 billion record is mostly one theft, and the trackers do not agree

Crypto hacks in 2026 have reached a record $9.2 billion, CertiK says, according to a report in The Defiant, after the 29 October theft at Binance. That number does not appear on the CertiK dashboard we opened on Sunday 1 November, which carries no annual or year-to-date total. What the dashboard does show is October alone at $6.50 billion gross and $3.47 billion adjusted. Its monthly adjusted figures for January to October add up to about $5.7 billion. DefiLlama’s hacks database gives $8.74 billion for 2026, of which Binance is $6.36 billion.

So there are three answers to one question, and a single incident sits under all of them. Take Binance out of DefiLlama’s list and 2026 stands at about $2.38 billion, below the $2.72 billion it holds for the whole of 2025. Over the same ten months the gap is smaller but the order does not change: 2025 had $2.51 billion by the end of October.

The Defiant’s text, as far as we could read it, does not say whether the $9.2 billion is before or after frozen funds, or what date it runs to. It calls the figure a record and names no earlier year. We could not open a CertiK document that does either.

Crypto hacks in 2026: what each tracker shows

The trackers below were read on 1 November 2026, at about 05:50 UTC for DefiLlama. The sums for CertiK’s months and DefiLlama’s years are ours, because neither page publishes them.

The two Binance figures differ by $70 million, which is small for an event of this size and in line with what others have reported. Binance itself estimated the impact at about $6.3 billion, while TRM Labs counted $6.36 billion, as we reported in our account of the theft. Elliptic is higher, at $6.43 billion across 11 blockchains.

Gross versus net: how $9.2 billion can turn into $5.7 billion

CertiK’s October figures reconcile cleanly: $6.50 billion less $3.03 billion frozen and returned leaves $3.47 billion. The dashboard does not define “adjusted”, and it gives gross and frozen numbers for October only. For every other month of 2026 it shows only the adjusted line, and for the quarters both.

We can still test what the $9.2 billion is likely to be. CertiK’s first-half report of 6 July put losses above $1.31 billion across 344 incidents. The dashboard now shows $1.28 billion for the third quarter. Add October’s $6.50 billion and you reach about $9.1 billion, close to the reported figure. That is why we read $9.2 billion as a gross total for January to October. It is our inference from CertiK’s own numbers, not something CertiK states on any page we opened, and the small gap may come from later revisions: the third-quarter total was $1.26 billion when Cointelegraph reported CertiK’s figures on 1 October.

If that reading is right, the distance between $9.2 billion and $5.7 billion is about $3.5 billion, and October’s freezes make up most of it. Earlier months supply some of the rest: the same Cointelegraph report had September at about $769 million before about $273 million frozen or returned, leaving $495.3 million adjusted (the dashboard now shows $488.2 million). CertiK does not assign the $3.03 billion to individual incidents. Non-Binance losses in October come to only about $0.21 billion by subtraction, so the bulk of the freezes must relate to Binance. That step is our arithmetic too.

Neither number describes what victims lost. Adjusted losses treat frozen tokens as gone from the attacker’s side, yet frozen is not the same as returned, and Binance has not said what happens to frozen tokens if they come back. Binance put the frozen amount at about $3 billion, while Elliptic had verified $2.85 billion on its page last updated at 23:55 UTC on 31 October. Elliptic also estimates that the attacker holds about $3.21 billion that cannot be frozen, including 18,270 BTC.

Customers are a separate question again. Binance says it will absorb the loss. Late on Saturday it said it had covered 95% of the $6.3 billion taken, up from about 90% earlier that day, Reuters reported, a claim that has not been independently verified. The remaining 5% is less liquid tokens that may take longer to source. Withdrawals were due to restart in phases, with the first opening between 06:00 and 09:00 UTC on Sunday 1 November and no date for later phases. We have not confirmed that any network has reopened: the last check we could find, by Cryptoticker at 04:45 UTC, still showed Bitcoin and Ethereum withdrawals disabled. A tracker that counts the theft at full value and an exchange that makes customers whole can both be correct: one measures what left the wallets, the other who ends up paying.

Without Binance, 2026 is not a record on DefiLlama

DefiLlama lets us compare years on one method, and it does not subtract anything from its headline amounts. Its Bybit entry of February 2025 keeps the full $1.4 billion in the amount field and records the same sum separately as returned funds. Its Binance entry shows no returned funds at all, so DefiLlama’s $8.74 billion is a gross figure with nothing taken off for the freezes.

Read the first and fifth rows together. At the end of September, both trackers had 2026 running behind 2025, on DefiLlama by about 10% and on CertiK’s adjusted line by about a third. On those two series the year turned in a single month. It is also true that 2025 contains its own giant, Bybit, so this is a comparison of one outlier year against another. Remove Bybit as well and the 2025 total on DefiLlama falls to about $1.3 billion for the full year, well below 2026 without Binance.

That makes the fair conclusion narrower than either headline. On our calendar-year sums of DefiLlama’s entries, 2026 is the largest year by a wide margin. The next are 2020 at $3.98 billion, a total that includes the $3.5 billion LuBian entry, and 2022 at $3.63 billion. Binance alone is 72.8% of 2026 there. Without it, the first ten months of 2026 would sit below the full years 2020, 2021, 2022 and 2025. For CertiK we found no earlier record: neither The Defiant’s text nor the CertiK pages we opened name a previous record year or figure, so “record” rests on The Defiant’s wording.

Why two hack trackers rarely agree

Scope explains part of it. CertiK logged 751 incidents from January to October on the dashboard and ranks phishing out of its top-incidents list. DefiLlama holds 325 entries for 2026, so its list is less than half as long. Timing adds to it. Dashboards are revised after the fact: CertiK’s second quarter is now $822.3 million, and it was $819.4 million in early October.

Oddly, the two series almost meet before October: $2.22 billion adjusted on CertiK and $2.24 billion on DefiLlama for the first nine months. We would not read much into that, since they count different things.

CertiK’s own series also needs care. Its monthly adjusted figures for 2025 add up to about $3.86 billion, whereas KuCoin News summarised its 2025 annual report at $3.35 billion across 630 incidents. The dashboard gives no explanation for the $500 million difference. September shows how much of a gap can be method alone. PeckShield counted about $766.5 million across 55 major incidents, almost the same as CertiK’s $768.4 million across 97, yet the dashboard’s adjusted line for that month is $488.2 million. Hacken put the third quarter at about $1.18 billion, as we set out in our comparison of the Q3 counts.

Most attacks are small, and October shows it

The dashboard’s breakdown for October is lopsided. Wallet compromise accounts for $6.44 billion, or 99% of the month’s losses, from 20 incidents. Exploits are the most common type, at 45 incidents or 48.9% of the count, and cost $25.1 million. Behind Binance come Ledger users at $99.0 million and CoinDCX at $16.0 million.

The two largest entries of the year on DefiLlama are key failures, not blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract bugs: “Key Leaked via Infrastructure” for Binance and a compromised hot wallet key for Bitget at $387 million. The list below them is more mixed, with Liquid Network’s $320 million unbacked cross-chain mint third. How Binance’s wallets were made to sign is still unknown. Our guide on where crypto hacks really happen explains why the weak point is so often outside the chain.

CertiK also tracks physical “wrench” attacks on holders, which rose from 39 incidents and $10.5 million of exposure in the first half of 2025 to 52 incidents and $124.2 million in the first half of 2026. Those sums are tiny next to Binance, and they disappear in any annual total.

What to check when a hack total is quoted

Three questions sort out most of these figures. Does the number come before or after frozen funds? Does it run to a stated date? Does it include the single largest incident? A total that answers none of them cannot be compared with anything, and for the $9.2 billion we can answer only the third, and that by inference.

For an exchange user, the annual total matters less than how a platform pays when it is hit. Our guide to choosing a crypto exchange covers what to look for in reserves and custody.

What is still unknown

CertiK has not, on the pages we opened, published a year-to-date gross total, a definition of adjusted losses, or a split of the $3.03 billion by incident. We found no October or year-to-date figure from PeckShield, Immunefi, TRM Labs or Chainalysis. Any of those would test the reading above, and a CertiK statement that the $9.2 billion is net of freezes would overturn it.

Two things may move the numbers. November’s data has not started on the dashboard. Binance’s full proof of reserves, first announced for Monday 2 November, is now expected on Tuesday 3 November according to Cryptoticker and Bitcoin.com News, though we could not open Binance’s own post. And if frozen tokens are returned, adjusted totals could change again, while DefiLlama’s Bybit entry suggests its headline amount would stay at $6.36 billion.