There Are Too Many Crypto Hacks Happening. It’s Impossible to Keep Up.

Binance’s $6.3 billion hack and the efforts by North Korea-linked entities to launder the proceeds from it have dominated crypto coverage in recent days, and for good reason. But it is hardly the only addition to the industry’s miserable 2026 security record in recent weeks, or even recent days. In just the past week, other incidents have involved tens of millions of dollars at a Brazilian exchange, a suspected $106 million theft from an unnamed European entity, and attacks on several crypto services. Meanwhile, other attacks have reached beyond exchanges and DeFi apps to software and hardware that Bitcoin users rely on for self-storage of their coins. Brazil's Mercado Bitcoin lost about $49M across 17 chains overnight. The attacker picked at 8 small chains for 4 hours, then emptied the main hot wallets in 67 minutes. Hours later they swept 27,160 customer deposit addresses too. I traced every step 🧵 pic.twitter.com/Re3rO7hHFH — Dickson (@DicksonWuML) November 2, 2026 Brazilian exchange Mercado Bitcoin said it contained a “security incident in one of our systems” early Monday morning and temporarily suspended deposits and withdrawals. Certik engineer Dickson Wu traced $49 million worth of crypto assets associated with the incident, in addition to at least $6.2 million worth of frozen assets so far. Quick action from the likes of Tether and other crypto companies, which notably mirrored the maneuvering commonly found in the traditional banking system, was also seen in the aftermath of the recent Binance hack. On Monday morning, Blockchain investigator ZachXBT also flagged a suspected theft of more than $106 million from an unnamed entity in Europe on Telegram. He said multiple accounts at centralized exchanges were compromised, with funds withdrawn as USDC and USDT before being swapped, bridged across networks, and routed through instant-exchange services into the privacy-focused Monero altcoin. The victim and exchanges involved have not been publicly identified, and the figure remains an estimate based on blockchain analysis. Those incidents arrived alongside a growing list of smaller attacks. Polymarket temporarily switched its international exchange to cancel-only mode after hackers reportedly stole around $2.65 million through a compromised third-party vendor right before the Binance incident took place last Thursday. According to an analysis from Bitquery, an attacker also drained about 97 million CORE tokens, worth roughly $1.47 million, from bitcoin staking app b14g on Saturday. The affected funds were CORE staked through b14g, not bitcoin locked on the Bitcoin network. There are other incidents that are probably also worth mentioning, but it’s simply impossible to name them all at this point. I’m expecting more to pop up by the time I finish writing this article. Update on Crypto Hardware Wallet Supply Chain Attacks The attacks on trusted Bitcoin infrastructure have been among the most troubling security stories of the year. As I wrote in September, the Coldcard hardware wallet and Liquid Network incidents were especially unsettling because they challenged the assumption that users who avoid exchanges, stick with highly-trusted software, and exercise care with self-custody can insulate themselves from all of the hacking incidents going on at centralized crypto exchanges and the decentralized finance space. Those incidents involving Coldcard and Liquid were then followed by the supply chain attack on Ledger hardware wallets and separate security incidents at two other hardware wallet manufacturers. Now, a possible hardware supply-chain compromise has reached Ledger competitor Trezor. CryptoBilis update We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to us. IMPORTANT: If you bought a Trezor from… pic.twitter.com/TiaKfHBnX2 — Trezor (@Trezor) October 30, 2026 The company said it received a report alleging that a Trezor Safe 5 purchased from CryptoBilis, a former authorized reseller in Southeast Asia also involved in the Ledger attack, contained a hidden hardware implant. According to the customer’s description, the implant included a cellular module and antenna that could read information displayed on the device’s screen, including a wallet recovery phrase, and transmit it over a mobile network. Trezor has not examined the device and says it is treating the report as credible, rather than confirmed. The company said no CryptoBilis customer had reported stolen funds, but advised anyone who bought a Trezor from the reseller since March to move funds to a new wallet created with a fresh seed. On top of that, Singapore police said last week that preliminary investigations had found malicious hardware components in Ledger devices bought from some retail stores in the country. At least two cases have been reported since September, with combined losses of about 3.5 million Singapore dollars. Police have not named the stores, and it is not clear whether those cases are connected to the CryptoBilis incidents. Bitcoin Wallet and Payment Software Compromised Bitcoin payment infrastructure has also been caught up in the latest wave of attacks. BTCPay Server, an open-source tool that lets merchants accept bitcoin directly, urged operators to shut down their self-hosted servers on Sunday after receiving reports that attackers were sweeping wallets associated with the software. A later update said the attacks targeted versions 2.4.1 and earlier. The vulnerability they exploited had been patched in version 2.4.2, released August 7. It said it had no credible reports of wallet drains affecting the latest 2.4.7 release. BTCPay has not published a confirmed total for the losses or number of affected servers. However, Bitquery traced approximately $1.63 million in bitcoin and litecoin swept from hot wallets between October 30th and November 2nd. Electrum, one of Bitcoin’s oldest software wallets that is also included by default in the privacy and anonymity-focused Tails operating system, disclosed another high-severity issue just over a week ago on October 24th. A malicious Electrum server could intercept a newly broadcast payment and replace it in the wallet’s transaction history with a fake, invalid transaction directing the funds to an attacker. If the user then tried to speed up the payment using a technique known as Replace-by-Fee, Electrum could sign a valid replacement that paid the attacker instead. The project said it had received two reports of the attack in the wild, including one user who lost funds, but did not disclose the amount. Preemptive Defensive Scans Find Bugs in Bitcoin Core There is at least some positive news in the middle of all this. AI-assisted security scans have helped identify bugs in Bitcoin’s most critical software, Bitcoin Core, before attackers could exploit them, and the project has now publicly disclosed several issues after fixes became available. Brink co-founder and Bitcoin Optech contributor Mike Schmidt covered these developers in a series of X posts. According to Schmidt, the work involved Project Loupe, an automated large-language-model scanning effort at Jack Dorsey’s Block (formerly Square). Bitcoin Core’s disclosures credit the scan with finding vulnerabilities, while developer Gregory Sanders validated the findings and brought them to the project’s security team. The release notes for Bitcoin Core 32.1 also mention three medium and high severity vulnerabilities fixed in version 30.0 that will be disclosed in the coming weeks. Three vulnerabilities were disclosed on October 28 (today): Undo-file overflow (Low): extreme miner-crafted block sequences could overflow undo-file limits, corrupt data and stop nodes. Exploitation is considered impractical. The fixes cover 64-bit systems; 32-bit systems and… — Mike Schmidt (@bitschmidty) October 28, 2026 One disclosed Bitcoin Core bug allowed attackers to remotely crash some Bitcoin Core nodes. On Windows, macOS, and BSD systems, a malicious peer could send TCP urgent data and cause a connected node to queue unbounded data until it ran out of memory and crashed. Linux nodes were not affected. Bitcoin Core classified the issue as medium severity and released fixes in versions 29.5, 30.4, 31.2, and 32.1. Coinbase Chief Security Officer Jeff Lunglhofer also used the company’s access to advanced cyber models to scan Bitcoin Core. Schmidt noted that open-source contributors do not generally receive access to the latest cyber models. “We were curious how our frontier AI model would handle it,” Lunglhofer posted on X. “Last month we ran 16 agents across 5 of the top models for a week to look for issues in Bitcoin Core v32.0rc1. Impressively, they surfaced two minor items – both now disclosed responsibly.” Bunker Mode Indeed The growing list of incidents makes “bunker mode” sound less like crypto paranoia and more like a reasonable response to an increasingly hostile security environment. AI-powered hacking tools threaten to make that environment even more dangerous, although it remains unclear what role, if any, they played in most of these particular attacks. While the term recently surfaced in a debate over whether AI advances could accelerate attacks on the digital signatures used by Bitcoin, that specific scenario remains highly speculative. Back in May, OpenZeppelin co-founder Manuel Aráoz notably said he considered all of decentralized finance unsafe, arguing that AI coding agents had become exceptionally capable at finding vulnerabilities while attackers only need one exploitable flaw. Of course, crypto is hardly the only software ecosystem dealing with serious vulnerabilities right now. A couple of weeks ago, ⁠two critical PHP flaws prompted emergency patches after researchers warned that attackers could use them to take control of vulnerable web servers. Meanwhile, a separate ⁠attack on unpatched Plex media servers saw hackers install crypto miners and software that lets outsiders route their internet traffic through victims’ home connections. In another recent incident from last week, ⁠hackers took control of digital billboards in multiple countries to display porn by exploiting software used to manage the displays, with some systems apparently exposed through interfaces lacking basic security protections.