If you write smart contracts, most security talk you hear is about the contract: reentrancy, rounding, oracle prices, access control. Those bugs are real. They are not where most of the money went.
Monitoring Room keeps a record of every crypto hack in DefiLlama's dataset: 1,319 incidents, $21.2 billion stolen since 2011 (data as of 26 October 2026). Sorted by technique, the top of the list looks like this:
| Technique | Hacks | Stolen |
|---|---|---|
| Weak key generation | 10 | $3.6B |
| Hot wallet key compromised | 60 | $3.1B |
| Signer phishing | 5 | $1.6B |
| Private key compromised | 69 | $1.3B |
| Improper access control | 142 | $1.2B |
| Phishing | 29 | $1.0B |
Add up the four rows that are about keys and the people who hold them (weak key generation, hot wallet key compromised, private key compromised, signer phishing): 144 hacks, about 11 % of the record, and $9.6 billion, about 45 % of everything stolen. Improper access control, the most common contract-side technique in the table, happened about as often (142 times) and cost $1.2 billion.
Ten hacks, $3.6 billion
Weak key generation has only ten entries and the largest total. One of them is the biggest hack on the record: LuBian, $3.5 billion in bitcoin, 28 December 2020. Nobody broke a contract. The dataset's label is weak key generation: keys created with too little randomness, which an attacker can search for.
The same door, twice
Two names on the recent pages show why this is an operations problem, not a one-off:
- CoinDCX — $44.2 million on 19 July 2025, then $16.0 million on 21 October 2026. Both entries: hot wallet key compromised.
- Bitget — $100 million on 20 April 2025 (a market-maker bot exploited), then $387 million on 24 September 2026 (hot wallet key compromised).
A code audit would not have caught either second incident. A hot wallet is a key on a machine that is online, so the attack surface is the machine, the people with access and the process around them.
2026 so far
311 incidents and $2.4 billion lost this year. The record updates daily; the newest entries on the day we wrote this were from 21–25 October.
- Check a platform you use, or browse every incident by chain and technique: Was it hacked? — the crypto hack checker
- The rest of the live situations we track: monitoringroom.com
Source: DefiLlama hacks dataset as served on monitoringroom.com/situation/crypto-hack, read 26 October 2026 00:36 UTC. Technique labels are the dataset's. Information, not investment or security advice.
Top comments (0)