GoPlus October 2026 Web3 & AI Security Data Report Throughout October, Web3 recorded 45 major security incidents, with total losses of approximately $6,469,246,091 ($6.469 billion)—8.2 times September’s approximately $793 million and 34.4 times August’s approximately $188 million. October became the worst month for losses so far this year. The largest single incident, involving Binance’s multichain hot wallets, accounted for $6.3 billion. The top five incidents totaled approximately $6.423 billion, or 99.3% of total losses. Losses were overwhelmingly concentrated in exploits: 39 incidents accounted for approximately $6,465,088,419. Compared with September, October’s risk became even more concentrated in centralized operational risks and supply-chain risks. Three categories—compromised platform signing and permission systems (approximately $6.313 billion), supply-chain and distribution-channel attacks (approximately $90.13 million), and hot-wallet, private-key, and weak-randomness issues (approximately $29.77 million)—accounted for approximately 99.4% of total losses. Binance and Ledger alone accounted for approximately $6.387 billion, or 98.7% of the monthly total. This month’s figures reflect reported incident losses before deducting frozen or subsequently recovered assets. In AI security, October marked a shift from asking “Is the agent itself secure?” to examining “How does trust propagate across agents, protocols, identities, and tools?” AI-driven attack and defense also began operating at machine speed. AI agents carried out end-to-end real-world intrusions, while malicious instructions spread along internal trust chains in MCP/A2A environments. Hardcoding issues in IBM MCP Context Forge again exposed weaknesses in agent gateways’ default security. Both attackers and defenders are entering the machine-speed era. I. Web3 Security Overview 1. Overall Figures: October 2026 Incidents: 45 Total losses: $6,469,246,091 (approximately $6.469 billion) Exploits: 39 incidents, approximately $6,465,088,419 Phishing involving substantial losses: 6 incidents, approximately $4,157,672 Largest single loss: $6.3 billion (Binance) Top five incidents combined: Approximately $6.423 billion, or 99.3% of total losses Incidents with losses exceeding $1 million: 19 October’s incident count rose approximately 15% from September’s 39, while total losses increased to 8.2 times September’s level. The top five incidents’ share of losses rose from 94.8% to 99.3%. Four incidents exceeded $9 million in individual losses; two exceeded $80 million, and one reached $6.3 billion. Binance alone accounted for approximately 97.4% of the month’s reported losses, making it the decisive factor behind the surge. Meanwhile, the 15 incidents explicitly classified as “smart contract vulnerabilities” averaged approximately $590,000 in losses each. The pattern of frequent incidents with relatively low individual losses remained unchanged. 2. Major Attack Types October’s major attack types, grouped by losses, were as follows: Viewed by attack surface, five structural trends warrant particular attention: Trust roots and permission systems: Three incidents involving platform signing and permission systems caused approximately $6.3125 billion in combined losses. Binance’s central issue points to abuse of its signing or withdrawal systems, rather than a straightforward onchain contract vulnerability. At 79thVault, compromise of a privileged administrator address caused approximately $12.5 million in losses. The absence of direct private-key exposure does not establish that withdrawal and signing workflows are secure. Supply chains and distribution channels: Five incidents caused approximately $90.13 million in combined losses, spanning five entry points: a hardware-wallet reseller, a third-party RUM script, an API documentation website, wallet-extension source code, and a domain registrar. Attackers are looking beyond projects’ own code, prioritizing upstream nodes where one compromise can spread through multiple distribution paths. Account abstraction and signing mechanisms: EIP-7702 featured in the Binance platform-level incident, an individual’s approximately $3.55 million loss through malicious delegation, the AlpsCon[.]ai attack, and a vulnerability in Argent-style smart wallets. The Safe incident exposed another risk: granting token approvals to an address before any code has been deployed there. Weaponized governance: x100 lost approximately $4.85 million to a flash-loan governance takeover. Following BarnBridge/BonkDAO in July, term_labs in August, and Neutron in September, governance attacks appeared among major monthly incidents for the fourth consecutive month. Proposals have become a persistent attack vector. The long tail of contract and cross-chain logic flaws: Contract and business-logic vulnerabilities accounted for 19 incidents, with widely varying losses. Initia, Autheo, and Cysic again showed that flaws in VM execution security, business-logic implementation, or cross-chain minting permissions can cause severe financial losses. 3. Notable Incidents Binance: Attack on Multichain Hot-Wallet Signing Systems, Approximately $6.3 Billion in Reported Losses On October 30, Binance’s multichain hot-wallet infrastructure suffered large-scale unauthorized outflows, with reported losses of approximately $6.3 billion—the largest single security incident so far this year. Approximately $3 billion in stolen funds has been frozen. Binance.US operates independently and was unaffected. BNB Chain itself was not attacked, and the incident did not involve a protocol-level vulnerability in Ethereum or EIP-7702. Onchain evidence shows that the attacker obtained a valid EIP-7702 authorization signature for the Binance 14 hot wallet, delegated the wallet to a malicious contract, and then transferred ETH and 63 different tokens in batches. The attacker also gained control over USDC in Hot Wallet 34. EIP-7702 primarily increased the efficiency of asset transfers in this attack. Authorization signatures covering more than 50 consecutive nonces, coordinated theft across multiple chains, and directly signed transfers from other wallets make compromised signing infrastructure a more plausible explanation than the exposure of a single raw private key. The root cause, however, remains subject to the final investigation. The incident again demonstrates that a valid authorization signature does not establish that the signing action was genuine or legitimate. Ledger Reseller Incident: Tampered Hardware Wallets Cause Approximately $87 Million in Losses On October 10, an incident involving Ledger reseller CryptoBillis’s distribution channel led to widespread user losses. Some hardware wallets purchased through this channel had been tampered with before delivery, and assets subsequently deposited were stolen. The incident database records approximately $87 million in losses. A hardware wallet’s security boundary extends beyond its chip and firmware to production, logistics, distribution, activation, and authenticity verification. Confirming that a device works normally does not prove that it remains trustworthy. CoinDCX: Suspected Hot-Wallet Theft, Approximately $16 Million Lost On October 22, CoinDCX suffered a suspected hot-wallet theft involving approximately 15.99 million USDT and 5,783.81 TRX, with total losses of approximately $16 million. Following Bitget and Duelbits in September, hot wallets at exchanges and platforms holding large balances remained priority targets. For these platforms, the security of signing services, automated withdrawals, and backend operations systems often directly determines the losses and damage that can follow a single point of compromise. 79thVault: Privileged Administrator Address Compromised, Approximately $12.5 Million Lost On October 8, BNB Chain project 79thVault lost approximately $12.5 million through either a leaked private key for a privileged administrator address or insider activity. Nearly 10,000 token holders were affected. Administrator privileges remain one of the most dangerous single points of failure across many projects. Safe Multisig Address: Approvals Granted Before Code Deployment, Approximately $7.45 Million Lost On October 27, a vault associated with a Safe multisig address on Avalanche was exploited for approximately $7.45 million. The Safe had authorized an address to spend four tokens without ensuring that only trusted application code could execute at that address. No contract had been deployed at the address when the approvals were granted. An external actor subsequently used public deployment tooling to deploy their own withdrawal code there, then used the existing token approvals to transfer funds without another Safe signature. The incident shows that, in account-abstraction environments, trusting an address does not mean that code deployed there in the future can also be trusted. x100: Flash-Loan Governance Takeover, Approximately $4.85 Million Lost On October 24, x100 suffered a flash-loan governance takeover. Within a single transaction, the attacker acquired two of the Senate’s three seats and immediately executed a proposal to sell the treasury’s X tokens into a thin-liquidity pool they had just created, ultimately obtaining approximately 4.848 million USDT. Acquiring governance power, passing the proposal, executing it, and transferring assets all occurred within the same transaction. Governance defenses that rely on voting periods and manual review face substantial risk; safeguards such as timelocks are essential. Polymarket: Third-Party Monitoring Script Compromised, Approximately $2.71 Million Lost On October 29 (UTC), users of Polymarket’s international site suffered asset theft. A supply-chain compromise of third-party performance monitoring provider DebugBear’s RUM script delivered malicious code to user pages. The code abused users’ trading and signing permissions. Onchain analysis shows that the primary attack path involved 710 DepositWallets and 731 addresses, with approximately $2.71 million in losses. Address counts do not represent unique users. Every third-party script introduced into a frontend may gain access to user sessions and signing interactions. Software supply-chain security reviews must account for that exposure. Initia: MoveVM Type Confusion Enables Unbacked Minting, Approximately $2.73 Million Lost On October 22, a vulnerability in Initia’s MoveVM was exploited. The attacker induced a failure in the verified-script cache, causing cross-module ABI type confusion and bypassing normal MintRef handling and supply accounting to mint unbacked iUSD, AUSD0, USDC, and WETH. The assets were then moved cross-chain through LayerZero, IBC/Noble, and CCTP. Losses totaled approximately $2.73 million. 4. Security Recommendations Continuously review trading-platform signing and withdrawal workflows through an independent chain of trust. Validate transaction-data integrity, caller identity, and authorization context. Implement real-time circuit breakers for consecutive nonces, anomalous batch authorizations, and synchronized withdrawals across chains, alongside per-wallet limits and execution delays. Monitor EIP-7702 delegations and smart-account permissions explicitly. Clearly display delegation-target code and permission scope, and provide one-click revocation and anomaly alerts. Do not grant asset permissions in advance to addresses whose code is not yet determined or can be deployed by someone else. Extend supply-chain defenses across delivery and runtime. Purchase hardware wallets only through official channels and verify authenticity. Minimize third-party scripts, enforce integrity checks and CSP restrictions, enable registrar locks and multifactor authentication for DNS management, and establish reproducible builds and signed releases for wallet extensions. Minimize and isolate administrator and governance privileges, and enforce timelocks. Asset control, parameter changes, additional issuance, and upgrades must not be concentrated in one address. Enforce delays between acquiring governance power, executing proposals, and transferring treasury assets that cannot be bypassed within a single transaction. Generate wallet seeds and keys with cryptographically secure random number generators. Do not use randomness sources whose outputs can be feasibly enumerated, such as Math.random(). Assess wallets historically generated with weak randomness and migrate their assets. Establish continuous smart contract auditing to prevent financial losses caused by contract vulnerabilities. II. AI Security Incidents and Trends If September’s AI security themes were “data assets and authorization boundaries,” October made another shift clear: authorization is flowing across agents, protocols, and identity systems, while AI agents are beginning to execute attacks end to end at machine speed. The month’s notable incidents and developments reflect changes across real-world attack surfaces, protocol trust, endpoint rendering, gateway control planes, and frontier offensive and defensive capabilities. AI-Driven Multicloud Intrusions: Agents Are No Longer Just Assisting Attackers On October 19, Wiz CIRT published findings from investigations into multiple real-world intrusions. AI agent systems were no longer merely advising attackers. They were executing entire workflows: finding entry points, collecting credentials, moving laterally across platforms, exfiltrating data, and debugging scripts. One representative case began with an exposed Kafka UI Java remote code execution vulnerability, then spread across Kubernetes, GCP, AWS, CI/CD, GitOps, and identity providers. The agent generated cloud credentials in bulk, obtained cluster-admin privileges, created backdoor identities with administrator access, and ran five workflows simultaneously: secret collection, reachability mapping, credential spraying, service exploitation, and compute expansion. These attacks performed hundreds to thousands of actions per hour. After failures, the agents read error messages, rewrote scripts on the fly, and retried. The same source IP also scanned more than 600 other Wiz customer environments during the same window. The activity was not stealthy—it was conspicuously noisy. But its traces were scattered across cloud control-plane, identity, CI/CD, and workload logs, leaving no single alert capable of reconstructing the full attack. The defining change is not a more sophisticated individual exploit. It is lower execution costs for cross-platform attack chains and trial-and-error cycles compressed to machine speed. MCP/A2A “Protocol Hopping”: Malicious Instructions Propagate Along Internal Trust Chains On October 6, security researchers disclosed how attackers could first manipulate an internal agent, then pass malicious instructions to other agents as routine delegated tasks. Downstream agents trusted upstream agents by default, while MCP servers held credentials for each agent. Prompts that model guardrails might otherwise reject could trigger data access, outbound requests, and even SSRF after being forwarded across protocols and undergoing identity transformations. The research covered MCP, Google A2A, and Agent Network Protocol, among others. In Google MCP Toolbox for Databases, the HTTP client lacked redirect checks and destination-IP validation. Attackers could craft path parameters that caused the tool to follow redirects to internal endpoints. The issue was fixed through network-range allowlists and blocklists, alongside startup validation. The core issue in this kind of protocol hopping is a failure in how authorization and context are handled across protocols. Internal agent-to-agent calls can no longer be treated as inherently trusted internal-network traffic. Identity, permissions, and task scope must be revalidated. IBM MCP Context Forge Hardcoded JWT [REDACTED CREDENTIAL] Admin Tokens Can Enable Gateway Takeover In October, CVE-2026-53709, a hardcoded JWT secret vulnerability in IBM MCP Context Forge, drew attention with a CVSS score of 9.8. Affected versions—1.0.1 and earlier—shipped the same default JWT_SECRET_KEY in the source code and .env.example, while defaulting to REQUIRE_USER_IN_DB=false. Anyone with access to the public repository could forge platform-administrator JWTs without an account, password, or valid user record in the database. Deleting administrator accounts, changing passwords, and revoking sessions could not stop an attacker from generating fresh valid tokens. Platform administrators could read and modify registered tools, gateways, servers, prompts, and resources, access some credentials, and register malicious upstream MCP servers. A gateway compromise could thus become a supply-chain attack against every connected client. The issue was fixed in version 1.0.2 and later. Agent gateways are becoming a new control plane. Default keys, default administrators, and permissive initialization settings can be as dangerous as default passwords on traditional network appliances. AI Security Recommendations Enforce zero trust at every agent-to-agent hop. Revalidate identity, audience, permissions, and task scope whenever a request crosses MCP/A2A or another protocol. Do not inherit implicit trust from upstream agents. Apply destination allowlists and redirect validation to tool-generated outbound traffic. Build threat intelligence and automated response for attacks operating at machine speed. Every team needs an always-on AI CISO—Chief Information Security Officer—to continuously track threats, assess business impact, coordinate risk validation, and develop actionable remediation and incident-response plans. Configure agent gateways to fail closed. Block startup with default or weak signing keys. Automatically generate a unique, strong key on initial deployment, and bootstrap administrator access using one-time tokens and actual user identities recorded in the database. Upgrade MCP Context Forge promptly, and audit gateway registrations and upstream tool changes. III. Summary and Outlook In October 2026, Web3’s approximately $6.469 billion in reported losses and the top five incidents’ 99.3% share were driven sharply higher by the exceptional Binance incident. Excluding Binance, losses totaled approximately $169 million, down about 78.7% from September. Yet 45 incidents, 19 with losses exceeding $1 million, and a fourth consecutive month of governance attacks show that the risk surface has not narrowed. Defense must expand beyond private-key protection and contract auditing to include signing-context validation, supply-chain integrity, and governance of account execution environments. In AI security, real-world end-to-end agent intrusions, cross-protocol propagation of malicious prompts, and default gateway keys show that guardrails at the model-output layer are insufficient. Identity, permissions, tools, rendering, and distribution must all be brought under engineering controls. Frontier models discovering and exploiting complex vulnerability chains at scale also require defenders to adopt AI for continuous scanning, rapid validation, and automated response. For Web3 and AI, the next stage of security must extend beyond patching individual vulnerabilities to governing trust roots, enforcing authorization at every hop, validating the full supply chain, developing AI-driven offensive and defensive capabilities, and coordinating defense at machine speed.(Historical earnings: For fiscal 2026Q3 (period ended 2026-09-30), IBM reported basic EPS of 5.92, diluted EPS of 5.85, and net income of USD 5.571 billion. Consensus expectations: For the upcoming 2026Q4 event on 2027-01-26, consensus EPS is 4.6122 and consensus revenue is USD 20.468 billion.)