Introduction

October 2026 saw attackers take approximately $6.43 billion across the 38 major incidents analysed in this report, more than eight times September's total of $776 million. The incidents spanned the world's largest centralised exchange, a crypto casino, two prediction markets, three layer-1 networks, cross-chain bridges, wallet software, DeFi lending and yield vaults, DEXs, DAO treasuries, an on-chain private credit pool, a perpetuals platform and a long tail of token-level exploits on Ethereum and BNB Chain.

‍

One incident defined the month. On 29 October, attackers reached Binance's hot wallet signing infrastructure, reportedly through a compromised DevOps engineer's laptop, and drained roughly $6.36 billion across ten blockchains in a matter of minutes. It is the largest crypto theft on record, around four times the $1.46 billion Bybit hack of February 2025, and it has been attributed to North Korea. Binance alone accounted for around 99% of October's losses. Yet the most consequential part of the story came in the hours that followed, when stablecoin issuers and the Arbitrum Security Council froze roughly $2.7 billion to $3.0 billion of the stolen assets before they could be laundered.

Setting Binance aside, the remaining 37 incidents produced approximately $69.3 million in losses, almost exactly in line with September's underlying run rate of $68.5 million. The largest of these was a $12.5 million operator key compromise at BNB Chain staking protocol 79th Vault, followed by a $10.7 million unauthorised mint of ARRR on Pirate Chain, a $7.45 million drain of an Avalanche multisig through stale token approvals, and a $6 million drain of an anonymous Aave-based vault on Base.

Four themes ran through the month. The signing and authorisation layer was again the most expensive point of failure, at Binance and at crypto casino Gamdom, one month after Bitget and Duelbits. Governance attacks returned in a cluster, with X100, Hifi Finance and Yapeswap all drained in the space of five days. Unbacked minting continued across bridges and base layers, at Autheo, Initia, Pirate Chain and Affluent. And chain-level and issuer-level intervention again shaped the outcome, from the Binance freezes to network halts at Qubic and Initia.

Tornado Cash remained the most common laundering venue, appearing in the X7 Finance, X100, Predict.fun, Hifi Finance, MakerDAO keeper and Base vault incidents, with Railgun also used in Predict.fun. Cross-chain routes played a larger role than usual: Chainflip in NEAR Intents, THORChain and Hyperliquid in Gamdom, and Circle's CCTP in both Initia and TranchePool.

Major crypto attacks in October 2026

NEAR Intents - 01/10/2026

Type: Cross-Chain Bridge Logic Exploit

An integration flaw between NEAR Intents' smart contracts and its Omni deposit and withdrawal layer let the attacker make unauthorised withdrawals from a hot wallet on BNB Chain. Part of the proceeds was routed towards KuCoin, and the rest was bridged to Ethereum and swapped through Chainflip into roughly 33.7 BTC, which now sits across four Bitcoin addresses. The attacker interacted with known Lazarus Group infrastructure. NEAR Intents patched the flaw, paused Omni bridge operations across 11 chains and pledged full compensation from protocol reserves.

Impact: $3,865,000

FlashLoopAdapter (Aave v3 Loop Safe Module) - 01/10/2026

Type: Access Control

A third-party adapter built on Aave v3 let the attacker spoof Safe authentication, bypass its module authorisation check and execute unauthorised transactions on two Safes that had enabled it. A Morpho WETH flash loan repaid the Safes' Aave debt to free their weETH collateral, leaving the attacker with around 114 ETH. Aave confirmed its own contracts were unaffected.

Impact: $305,000

GoldPesa - 02/10/2026

Type: Smart Contract Vulnerability

GoldPesa's GPXHooks contract on Base rebalanced through a shared, flash-accounted Uniswap v4 PoolManager without checking that its currency deltas were zero. The attacker created around $115,000 of phantom USDC debt, triggered the hook's rebalance so that its credit was absorbed by that debt, and withdrew the difference. The proceeds were swapped to USDT and bridged off Base through Rango.

Impact: $114,900

MALT - 03/10/2026

Type: Smart Contract Vulnerability

MALT's swap function on Polygon snapshotted reserves and caller input before running an external rebalance hook, which moved treasury DAI into the pool mid-swap. The invariant check then counted that DAI as if the caller had supplied it, so a negligible input returned a disproportionate MALT payout.

Impact: $72,000

Unnamed Base vault - 04/10/2026

Type: Access Control

An anonymous vault on Base holding wstETH in Aave v3 was drained after its 3-of-7 Safe whitelisted a freshly deployed attacker contract, most likely through compromised signer keys. The contract pulled 1,783 aBaswstETH in six transfers and redeemed them for wstETH. Around 1,001 wstETH entered the Base-to-Ethereum withdrawal queue and around 782 wstETH stayed on Base. The attacker's gas had been seeded through Tornado Cash. Neither Base nor Aave's core contracts were affected, and the vault's signers have not been identified.

Impact: $6,000,000

MakerDAO ETH-A liquidation keeper - 06/10/2026

Type: Access Control

A dormant third-party liquidation keeper had won four MakerDAO auctions in 2020 but never claimed the 200 WETH of collateral. An address funded through Tornado Cash called an unprotected function on the keeper to settle the auctions and withdraw the WETH. MakerDAO's core contracts were not affected.

Impact: $538,000

Set Protocol - 06/10/2026

Type: Smart Contract Vulnerability

Set Protocol's fee function rounded share units upwards even when no fee was minted. The attacker issued shares before the update and redeemed them afterwards to capture the rounding gain, using Uniswap v4 flash accounting to scale it.

Impact: $13,700

79th Vault - 07/10/2026

Type: Private Key Compromise

An operator key for 79th Vault's 79AU token on BNB Chain was compromised. The key held a single-signer operator role, with no multisig or timelock, that the team had used to pull tokens from the PancakeSwap pool for rewards. The attacker used it to move 2.01 million 79AU out of the pool, sold them back for USDT, cut the pool's reserves from around $15.2 million to $3.9 million and cashed out 16,249 BNB. A small test deposit went to KuCoin, and the team has opened bounty negotiations with the attacker on-chain.

Impact: $12,500,000

X7 Finance - 08/10/2026

Type: Smart Contract Vulnerability

X7Pioneer's claimRewards function added the contract's unrecorded ETH balance to total rewards on every call, but only updated its record when a claim was paid. Calling it with an empty array left the record unchanged, so the same balance was counted again and again. The attacker donated ETH to widen the gap, drained 6.78 ETH and sent 3.3 ETH to Tornado Cash.

Impact: $16,514

BitBay StableVault - 09/10/2026

Type: Smart Contract Vulnerability

BitBay's DAI/USDC vault on Polygon sent its entire balance to the caller whenever vault liquidity was zero. The attacker forced liquidity to zero, redeemed a single minimal share and received 14,838 DAI.

Impact: $14,838

EtherVista - 09/10/2026

Type: Smart Contract Vulnerability

An integer overflow in EtherVista's K-invariant check let swaps pass even after reserves had fallen sharply. The attacker registered its own contract as an authorised router and ran two crafted swaps to drain WETH and VISTA.

Impact: $18,600

Papertrade - 10/10/2026

Type: Price/Collateral Manipulation

Synthetic perpetuals platform Papertrade launched on HyperEVM with no order book, settlement against Hyperliquid's mid-price, positions of up to 1000x and loose open-interest caps. Eight hours after launch, a trader moved spot ETH on Hyperliquid by around 0.12% while holding very large positions on Papertrade, including a short of roughly $297 million notional. The trader extracted $1.28 million from the shared USDC pool for about $52,000 in fees, and Papertrade has since cut its caps.

Impact: $1,280,000

Autheo Network - 12/10/2026

Type: Cross-Chain Bridge Logic Exploit

A flaw in Autheo Network's cross-chain message verification let an attacker mint 19 million THEO on Base with nothing locked on the source chain. The tokens were dumped into DEX pools for around 298.9 ETH, crashing THEO by more than 92%, and 280.45 ETH was bridged to Ethereum through Relay. Early alerts put the loss at $1.76 million, but the receiving wallet already held around 400 ETH before the attack.

Impact: $750,000

Gamdom - 13/10/2026

Type: Infrastructure Compromise

Crypto casino Gamdom found an unauthorised connection on the backend server that signs its hot wallet withdrawals, after monitoring first flagged what looked like a disk failure. The attacker drained around $2.2 million across EVM chains, $965,000 on Solana, $668,000 in bitcoin and $375,000 on TRON, then moved the funds through THORChain and Hyperliquid. Gamdom halted withdrawals and moved its remaining funds to cold storage.

Impact: $4,208,000

UNCX Network - 14/10/2026

Type: Smart Contract Vulnerability

UNCX Network's Vesting V2 contracts counted total token shares inconsistently between release and cancellation. The attacker created several schedules, released some, donated tokens to lower the shares-per-token rate, then topped up and cancelled released schedules to inflate the payout on a retained one. Repeated across chains, this drained around $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base.

Impact: $1,490,000

Pirate Chain - 14/10/2026

Type: Consensus/Software Vulnerability

Two validation failures in Pirate Chain's source code let an attacker create around 39.8 million ARRR, about 20% of total supply, and move it into the shielded Sapling pool. Exchange NonKYC restricted suspicious deposits, dPoW notarisations were suspended, and exchanges and pools were asked to pause. The figure reflects the value of the unbacked supply rather than confirmed cash-out.

Impact: $10,746,000

Affluent - 16/10/2026

Type: Smart Contract Vulnerability

The Affluent DeFi protocol on TON suffered an unbacked minting incident caused by a flaw in its token and share accounting. Few technical details have been published.

Impact: $1,053,000

Qubic - 17/10/2026

Type: Supply Chain Attack

Some Qubic wallet seeds had been generated with JavaScript's Math.random, including those created in browsers on iPhone and iPad, in Safari on Mac and in early versions of the iOS app, which made them predictable. An attacker brute-forced the seeds and drained around 2.94 trillion QU from 1,404 wallets in under two hours. Qubic's operators halted the network, leaving 87.1% of the drained funds immobilised on-chain, and MEXC froze the remaining 12.9%.

Impact: $1,300,000

AlpsCon AI Trade Hub - 18/10/2026

Type: Access Control

A Hardhat default test account, whose private key is public, had been left on AlpsCon AI Trade Hub's KYC whitelist on BNB Chain for around 14 months. The attacker used it through EIP-7702, flash-loaned USDC to buy and stake ALPS, and exploited a reward bug that treated a fresh stake as a long-held one.

Impact: $152,809

BiFi - 19/10/2026

Type: Smart Contract Vulnerability

BiFi's USDT market on Ethereum had been idle for around 36 days, and a flaw in its interest logic let that full period of interest be applied again on every call within one block. The original attacker was front-run by MEV bot c0ffeebabe.eth, which took a 40.5 million USDT flash loan from Morpho, pushed up utilisation and extracted 165,600 USDT.

Impact: $165,600

Argent-style smart wallet system - 19/10/2026

Type: Smart Contract Vulnerability

The recovery module of an Argent-style smart wallet system accepted a crafted recovery period that pushed the deadline into the past, so ownership could change within a single transaction. The execution module also accepted the same signed payload repeatedly. The attacker replayed transactions 28 times against a thin MARK/WETH pool.

Impact: $59,800

Slice - 21/10/2026

Type: Smart Contract Vulnerability

Slice's FundsModule on Base trusted release amounts reported by caller-chosen source contracts without checking that any assets had arrived. The attacker deployed two contracts that reported releases while sending nothing, then withdrew pooled ETH and USDC in one transaction.

Impact: $41,000

Fearless Wallet - 21/10/2026

Type: Supply Chain Attack

Polkadot warned that the Fearless Wallet browser extension, a third-party wallet, had been compromised since February 2025 and was sending users' private keys to an attacker server whenever the wallet was unlocked. Eight users reported losses totalling 17,286 DOT.

Impact: $20,000

NEM (NemTokenV2) - 22/10/2026

Type: Smart Contract Vulnerability

The NemTokenV2 contract on BNB Chain counted transfers into its PancakeSwap pool as sells without checking that a swap had settled. The attacker cycled transfer, skim and recycle calls 42 times to burn the pool's existing reserves, then sold NEM at the inflated price.

Impact: $821,920

WAX Multi-Chain Bridge - 22/10/2026

Type: Cross-Chain Bridge Logic Exploit

The WAX bridge failed to check that a withdrawal's maximum fee was not negative. By setting the fee to minus the withdrawal amount, the attacker zeroed the debit while still generating a full withdrawal record, which released real assets on Solana and Ethereum.

Impact: $90,500

Kimchi Token - 23/10/2026

Type: Rug Pull

Solana memecoin KIMCHI climbed to a market cap of around $14 million after influencer @kimchi1x received 500 million tokens and promoted it, with a repost from @a1lon9. Both posts were later withdrawn and the price fell by more than 95%. On-chain analysis showed pre-funded wallets buying early and selling at the peak, consistent with a coordinated pump-and-dump.

Impact: $385,000

Initia - 23/10/2026

Type: Consensus/Software Vulnerability

A zero-day flaw in Initia's MoveVM implementation on the Cosmos SDK let one account forge $7.48 million of unbacked USDC, AUSD, WETH and iUSD in 13 seconds. Over the next 33 minutes the attacker pegged out through LayerZero adapters and Circle's CCTP via Noble, draining Noble's USDC reserve from $1.09 million to $63, and consolidated the proceeds into 1,135.5 ETH. Validators halted the chain 42 minutes after the minting began, and Kraken and Upbit suspended INIT deposits and withdrawals.

Impact: $2,730,000

X100 - 24/10/2026

Type: Governance Attack

X100's governance was run by a three-seat Senate, with seats held by the largest locked token balances and no timelock or voting snapshot. The attacker flash-borrowed around $1.94 million USDT from Aave, bought and locked X tokens to take two seats by a margin of 0.000001 X, and in the same transaction passed a proposal selling 400,000 X from the treasury into its own thin pool for about $36. Copycat attackers then used the open seats to pull further value. The main attacker converted proceeds into 2,022.86 ETH, part of which went to Tornado Cash.

Impact: $4,850,000

Yapeswap - 25/10/2026

Type: Governance Attack

Yapeswap's governance contract had a quorum of zero, so a proposal backed by around 0.000055% of voting power handed a key factory role to the attacker. The attacker then installed a malicious registry that diverted deposits into vaults that issued no redeemable shares.

Impact: $21,900

Bloom Trading - 26/10/2026

Type: Supply Chain Attack

A remote code execution flaw in a third-party module used by trading automation platform Bloom Trading let attackers drain around 9,408 SOL from 49 wallets belonging to nine users. Bloom said no private keys were compromised and pledged full reimbursement.

Impact: $947,000

Unnamed Safe multisig (Avalanche) - 26/10/2026

Type: Misconfiguration

A 2-of-7 Safe on Avalanche holding trading inventory had granted unlimited approvals in March to an address that hosted the team's pool contract on other chains but was empty on Avalanche. The attacker deployed the missing factory contract, advanced its nonce and landed a sweeper at exactly that address. An MEV bot front-ran the attempt and took USDC, WAVAX, WETH.e and BTC.b, then returned around $7 million in exchange for a 42,500 WAVAX bounty worth about $371,000.

Impact: $7,450,000 (around $7,000,000 since returned)

Predict.fun - 27/10/2026

Type: Private Key Compromise

Around 397,700 USDT was drained from 29 user smart wallets on BNB Chain prediction market Predict.fun in two waves, on 22 and 27 October. Each drain was signed with the owner's own key, and the protocol's contracts were not exploited. The team suspects a breach of its third-party API documentation site and has pledged full reimbursement. The funds were laundered through Tornado Cash and Railgun.

Impact: $397,708

Hifi Finance - 28/10/2026

Type: Governance Attack

Using addresses funded through Tornado Cash, the attacker cast four late votes to pass a malicious proposal, upgraded Hifi Finance's BalanceSheet contract and minted 25 million HIFI. The attacker then drained user collateral, mostly RWA tokens.

Impact: $1,000,000

TranchePool - 28/10/2026

Type: Smart Contract Vulnerability

A TranchePool on Avalanche linked to Valinor Digital, Oatfi and Fence Finance treated a scheduled principal payment as received at the UTC day rollover without checking that any USDC had arrived. The attacker flash-loaned 1,013,353 USDC from Aave, scheduled a repayment for midnight and, three seconds after the rollover, drew the same amount again. The USDC was bridged to Solana through Circle's CCTP, and Fence Finance offered a 10% bounty for the return of the rest.

Impact: $1,013,354

Polymarket International - 29/10/2026

Type: Supply Chain Attack

Website monitoring tool DebugBear, a third-party provider to Polymarket's international platform, was compromised and used to serve malicious JavaScript that drained some users' accounts. Trading was paused for about an hour, Polymarket pledged full reimbursement and the case was referred to UK law enforcement.

Impact: $2,700,000

Binance - 29/10/2026

Type: Infrastructure Compromise

From around 20:05 UTC on 29 October, funds began leaving Binance hot wallets across ten blockchains, including Ethereum, Bitcoin, TRON, Solana and the XRP Ledger. Binance's initial investigation points to a compromised DevOps engineer's laptop that gave the attacker access to internal systems and the hot wallet signing service, and the exchange says no private keys were leaked. On Ethereum, 50 pre-signed EIP-7702 authorisations turned the Binance 14 hot wallet into a sweeper, and a single call drained more than $2.5 billion. The attacker also pulled USDC through a secondary smart account, borrowed around 19,762 ETH on Aave against stablecoins to stay ahead of freezes, and dumped tokens that could not be frozen into AMM pools. Tether, Circle, Ripple, World Liberty and the Arbitrum Security Council froze around $2.7 billion to $3.0 billion, and Binance has said it will cover all losses. The attack has been attributed to North Korea's TraderTraitor unit within the Lazarus Group.

Impact: $6,360,000,000 (gross; around $3,000,000,000 frozen)

zkLink Nova - 29/10/2026

Type: Cross-Chain Bridge Logic Exploit

zkLink Nova's Arbitrator contract on Ethereum did not clear a temporary message hash between calls. Using a relayer that anyone could call, the attacker set a valid hash and reused it to run a batch-root update under the legitimate gateway's identity, installing a malicious root that let forged proofs withdraw ETH and ERC-20 tokens. One of the attacker addresses had taken part in the X100 copycat attacks five days earlier.

Impact: $783,100

b14g - 31/10/2026

Type: Unknown

Around 97 million CORE staked through Bitcoin dual-staking protocol b14g was withdrawn without authorisation and sent to attacker-controlled addresses. The team paused the affected contracts and is working with the Core team and exchanges to trace and freeze the funds. Bitcoin staked through the protocol remained time-locked and was unaffected.

Impact: $1,360,000

Key Findings and Trends

One signing-layer breach accounted for 99% of the month's losses

Binance's $6.36 billion loss made up roughly 99% of October's $6.43 billion total. As with Bitget in September, the attacker did not break a smart contract or steal a private key. They reached the system that signs on the exchange's behalf and had it sign their instructions. Crypto casino Gamdom lost $4.2 million the same way, through an unauthorised connection on the server that signs its withdrawals, one month after Duelbits lost $7 million in a similar hot wallet incident. The Binance attack also showed a new technique at scale: pre-signed EIP-7702 authorisations that turned a hot wallet into an attacker-controlled sweeper in a single transaction. EIP-7702 also featured in the smaller AlpsCon exploit. Nominis assesses that, for the second month running, the costliest failures sat in the systems that authorise transactions, not in the code or keys that audits and custody controls are built to protect.

Smart contract vulnerabilities were again the most frequent attack type, but among the least costly

Smart contract vulnerabilities accounted for 13 of October's 38 incidents (34%) but just $4.9 million in losses. Private key compromise produced two incidents and $12.9 million, led by 79th Vault. Access control failures produced four incidents and $7.0 million, governance attacks three incidents and $5.9 million, and cross-chain bridge exploits four incidents and $5.5 million. Supply chain attacks produced four incidents and $5.0 million. Of the 38 incidents, 21 were below $1 million and 10 were below $100,000, a long tail concentrated on Ethereum, which was involved in 18 incidents, and BNB Chain, involved in seven.

Governance attacks returned in a cluster

Three protocols were drained through their own governance in five days: X100 on 24 October, Yapeswap on 25 October and Hifi Finance on 28 October, for a combined $5.9 million. Each had a structural gap. X100 had no timelock or voting snapshot, so flash-borrowed tokens could buy a Senate majority and execute a proposal in one transaction. Yapeswap's quorum was set to zero. At Hifi, Tornado Cash-funded addresses swung the vote in its final minutes. Copycat attackers joined the X100 exploit within hours, and one of their addresses went on to take part in the zkLink Nova bridge exploit five days later. Nominis assesses that governance contracts without timelocks, snapshots or meaningful quorums now attract the same opportunistic copycat activity as any other public exploit.

Unbacked minting moved from bridges down to base layers

In September, unbacked minting was mostly a bridge problem. In October it reached the base layer. Pirate Chain's validation flaw created around 39.8 million ARRR, roughly 20% of supply, and Initia's MoveVM zero-day let one account forge $7.48 million in stablecoins and wrapped assets, $2.73 million of which was pegged out through LayerZero and Circle's CCTP. The pattern also continued at the application and bridge level, at Autheo, Affluent and Hifi Finance. Nominis assesses that minting authority, wherever it sits, has become one of the most valuable targets in the ecosystem, because one flaw turns into real value as soon as forged supply reaches a bridge, an exchange or a liquidity pool.

Supply chain and wallet software remained a monthly loss vector

Five incidents came through software or services that users and platforms trusted. Polymarket's international platform was drained through a compromised website monitoring tool. Bloom Trading lost funds through a flaw in a third-party module. The Fearless Wallet browser extension had been sending users' keys to an attacker since February 2025. Qubic's wallets generated predictable seeds, echoing the weak randomness behind RRWallet in August and the signing flaw in DCENT in September. Predict.fun's breach is suspected to have started at a third-party documentation site. Nominis assesses that these cases confirm wallet software and third-party dependencies as a consistent monthly risk.

Dormant code and standing permissions continued to be drained

Old permissions and forgotten code were exploited again. The Avalanche Safe lost $7.45 million through unlimited approvals granted in March to an address that was empty on that chain. A MakerDAO liquidation keeper was drained of collateral from auctions it won in 2020. AlpsCon's whitelist still contained a Hardhat test account whose private key is public, 14 months after it was added. BiFi's exploit relied on a market that had sat idle for 36 days. Nominis assesses that an approval, a whitelist entry or a deployed contract carries risk for as long as it exists on-chain, whether or not anyone is still watching it.

Freezes, halts and front-running shaped the outcome

Intervention again decided how much attackers kept. At Binance, stablecoin issuers and the Arbitrum Security Council froze roughly $2.7 billion to $3.0 billion within hours. Qubic's operators halted the network and MEXC froze the funds sent to it, leaving almost all of the drained QU immobilised. Initia's validators halted the chain 42 minutes after the attack began, and Pirate Chain suspended notarisations. MEV bots front-ran the original attackers twice, at BiFi and at the Avalanche Safe, where around $7 million was returned for a bounty, repeating the pattern seen with the Gnosis Safe drain in September. Nominis assesses that the speed of a freeze now matters as much as the strength of the original defences, and that speed depends on precise attribution reaching issuers, exchanges and validators in time.

Laundering mixed old venues with new evasion tactics

Tornado Cash appeared in six incidents: X7 Finance, X100, Predict.fun, Hifi Finance, the MakerDAO keeper and the Base vault. Railgun was used in Predict.fun. Cross-chain routes carried much of the rest, with Chainflip used in NEAR Intents, THORChain and Hyperliquid in Gamdom, Relay in Autheo, and Circle's CCTP in both Initia and TranchePool. The Binance attacker added a new evasion tactic, depositing stablecoins into Aave and borrowing around 19,762 ETH against them before issuers could freeze the collateral, and investigators have since reported funds moving to TRON addresses (CNBC). North Korea featured twice in the month's attacks, through Binance and through the NEAR Intents attacker's links to known Lazarus Group infrastructure.

Regulatory and Compliance Developments

October 2026 combined the largest theft in crypto history with some of the most far-reaching enforcement actions of the year. Treasury moved against Russia's A7 network and North Korea's IT worker cash-out channels, the UK sanctioned the payment processors behind Russian cybercrime, and US, EU and UK regulators all advanced their stablecoin rulebooks. Running through the month was a single lesson from the Binance response: when precise intelligence reaches the parties who can freeze funds, illicit value can be stopped in hours.

The Binance freezes: what fast action against illicit finance looks like

Within hours of the Binance theft, Tether froze around 1.57 billion USDT and Circle around 800 million USDC linked to the attack. Ripple froze around $200 million in RLUSD, and World Liberty and the Arbitrum Security Council also acted, bringing the total frozen to roughly $3 billion. Close to half of the largest crypto theft on record was stopped before the attacker could launder it. The attack has been attributed to North Korea's TraderTraitor unit within the Lazarus Group (CoinDesk), and Binance has said it will cover all user losses.

In his analysis of the hack, Nominis founder Snir Levi argues that the freezes are the most significant part of the story. The infrastructure to freeze already exists. What decides the outcome is how quickly reliable intelligence reaches the people who can act on it. He asks why that speed should be reserved for record-breaking hacks, when stablecoins also carry funds for sanctioned entities, terror financing networks and fraud operations. He also warns that it only works with precise attribution: a freeze on the wrong address harms legitimate users, and a freeze that comes too late lets the funds disappear.

Nominis assesses that the attacker still controls billions in ETH, BTC and other assets that no issuer can freeze, and that these will move through bridges, swaps and OTC desks in the coming weeks. Exchanges, payment providers and OTC desks should screen incoming deposits against the latest attacker-linked addresses, look beyond direct exposure to funds that have passed through several hops, review inbound transactions received since 29 October, and agree in advance who decides when to hold funds, file a suspicious activity report or contact law enforcement.

Treasury designates Russia's A7 Network as a transnational criminal organisation

On 1 October, OFAC designated the A7 Network as a significant transnational criminal organisation, listing it with addresses in Russia, Kyrgyzstan, Nigeria and Zimbabwe. The action widens the August 2025 designations of A7 LLC and Old Vector to cover the entire network. At the same time, FinCEN proposed a rule that would bar US financial institutions from any transfer involving A7's sub-agents, covering convertible virtual currency as well as fiat, and issued an alert setting out red flags and asking institutions to tag related suspicious activity reports with the key term FIN-2026-A7NETWORK.

FinCEN's figures show the scale of the network. Its sub-agents hold accounts at around 435 financial institutions in at least 83 countries and processed more than $17 billion between January 2025 and June 2026. Over a similar period, more than 180 entities moved at least $179.1 billion through A7A5, the network's ruble-backed token, most of it through the sanctioned exchanges Garantex and Grinex. A7A5 is issued on TRON and Ethereum and is most often converted into USDT before being paid out abroad.

The action follows the leaked A7 files covered in last month's report, which showed A7 operating primarily as a fiat payment system. Nominis' research on Russia's crypto sanctions ecosystem maps the links between A7A5, Garantex, sanctioned banks and the foreign hubs that connect them. Nominis assesses that FinCEN's proposed rule is the more consequential half of the action. Once it takes effect, exposure to any A7 sub-agent becomes a prohibited transfer, and most of those sub-agents are front companies that appear on no list. Identifying them requires entity intelligence that links on-chain counterparties to the companies, trade flows and banks behind them.

OFAC targets North Korea's IT worker cash-out network

On 28 October, the day before the Binance theft, OFAC sanctioned 10 individuals and one entity for supporting North Korea's government-run IT worker schemes, which the Treasury says fund the regime's weapons programmes. The entity, the First Financial and Technical Development Center, is based in Russia and controlled by North Korea. Russian national Ilya Boykov is accused of converting about $3.5 million in cryptocurrency for sanctioned company Alis since 2024, and Vitold Obertas of handling nearly $2 million in conversions for North Korean officials since January 2025, including for Amnokgang Technology Development Company, which OFAC sanctioned in March 2026. North Korean nationals Kim Ki Hyok and Kim Hyo Dong are accused of managing IT worker teams in Russia and collecting their cryptocurrency income.

Nominis assesses that the two North Korean revenue streams seen this month, theft at Binance and fraudulent employment, rely on the same final step: intermediaries who convert crypto into usable currency. Those intermediaries are where compliance teams have the most leverage to act, because they must eventually touch a regulated exchange, OTC desk or bank.

UK sanctions Cryptomus, Heleket and TokenSpot

On 8 October, the UK added Cryptomus, Heleket and Kyrgyz exchange TokenSpot to its Russia sanctions list as part of a package of 38 designations. Cryptomus, Heleket and Certa Payments were listed together as names of a single entity, Xeltox Enterprises Ltd, a company registered in British Columbia. Heleket launched in January 2025, the month before Cryptomus introduced mandatory identity checks. The action follows the UK's earlier designations of Garantex in May 2022 and Grinex in August 2025.

Nominis flagged both payment processors in 2024, two years before this designation. Nominis assesses that the joint listing is the right approach, because rebranding is a standard evasion tactic for sanctioned payment services. Compliance teams should treat exposure to Cryptomus, Heleket, TokenSpot, Grinex, Garantex or the A7 network as a red flag in a UK context, and should expect the same operators to reappear under new names.

Treasury sanctions a Hamas financing network that used crypto

On 2 October, Treasury sanctioned a Hamas financing network that it says moved more than $2 million to the group through sham charities and cryptocurrency wallets between 2020 and 2026. Around $1.5 million of that was raised after the 7 October 2023 attack on Israel. The funds were sent in crypto to a Hamas-linked individual who passed them on to the Al-Qassam Brigades.

Nominis assesses that the case fits a pattern seen across recent terror financing designations: charitable fundraising as the front end, and stablecoin or crypto transfers as the cross-border rail. As Nominis has set out in Stablecoins: the New Front Line in Terror Finance, the transfers involved are often small, so they rarely trigger value-based alerts. Catching them depends on attribution of the receiving wallets.

Stablecoin and licensing rulebooks take shape in the US, EU and UK

On 21 October, the Office of the Comptroller of the Currency finalised its rule implementing the GENIUS Act, the first federal regulator to do so. The rule sets reserve, redemption and risk management standards for payment stablecoin issuers under its jurisdiction and takes effect with the Act on 18 January 2027. Anti-money laundering and sanctions requirements for issuers will follow in a separate rulemaking.

In the EU, ESMA published an opinion on 8 October telling MiCA-authorised crypto-asset service providers to stop providing services related to stablecoins that do not comply with MiCA. In the UK, the FCA's authorisation gateway has been open since 30 September and closes on 28 February 2027, ahead of the new regime going live on 25 October 2027. The FCA published further consultations under the regime on 21 October.

Nominis assesses that, across all three jurisdictions, stablecoin issuers and the platforms that list their tokens are being pulled firmly inside the regulatory perimeter. The Binance freezes showed what issuers can already do. The rules now being written will increasingly determine when they are expected to do it.

DOJ prioritises early seizure in fraud cases

On 8 October, the Justice Department's National Fraud Enforcement Division issued Directive 26-13, instructing prosecutors to prioritise early seizure of fraud proceeds. The directive explicitly includes restraining orders and seizure letters to freeze funds at banks and crypto exchanges, and forfeiture actions against digital assets before charges are filed. For exchanges, this means more freeze requests, arriving earlier in investigations, often before a case is public.

Why this matters for compliance, KYT and the intelligence layer

October's developments point in one direction: the window between illicit activity and enforcement action is shrinking. Stablecoin issuers froze Binance proceeds within hours. FinCEN's A7 rule would prohibit transfers to front companies that appear on no list. The UK designated Cryptomus two years after Nominis first flagged it, and the DOJ is pushing for freezes before charges are filed. In each case, the firms that can act first are those that already know who sits behind an address, rather than waiting for a list to tell them.

The exploits detailed earlier reinforce this. Billions of dollars from Binance remain under the attacker's control and will need to reach an off-ramp. North Korea is running theft and IT worker fraud through the same kind of conversion intermediaries. Compliance teams that combine on-chain clustering with off-chain intelligence will be best placed to recognise those funds when they arrive.

Conclusion

October 2026 delivered approximately $6.43 billion in losses across 38 major incidents, almost all of it in a single event. Binance's $6.36 billion breach is the largest crypto theft on record, and it repeated the lesson of Bitget in September at four times the scale of Bybit: an exchange can lose billions without a single private key being stolen once attackers control what its signing systems trust. Beneath Binance, the rest of the month looked much like the months before it. Losses of $69.3 million across 37 incidents almost exactly matched September's underlying run rate, made up of a long tail of smart contract exploits, a cluster of governance attacks, unbacked minting at both bridge and base-layer level, and a steady flow of losses through wallet software, third-party services and permissions nobody was watching.

The through-line from July onwards continues to hold. Code-level vulnerabilities remain the most frequent incident type but rarely the most expensive, and the largest losses again came from the systems and credentials around the code. October added the clearest evidence yet of how much the response now matters. Stablecoin issuers froze around $3 billion within hours, validators halted Qubic and Initia, MEV bots intercepted two exploits, and victims from Binance to Polymarket absorbed losses from their own balance sheets. For compliance teams, custodians and protocol operators, the lesson is that monitoring must cover signing and authorisation infrastructure, governance contracts, minting authority, third-party dependencies and standing approvals, as well as the behavioural signals that come before funds move.

The month's enforcement points the same way. The A7 designation and FinCEN's proposed rule, the North Korea IT worker sanctions, the UK's action against Cryptomus and Heleket, and the stablecoin rules advancing in the US, EU and UK all reward firms that can identify illicit exposure before a list names it. With billions of dollars from Binance still under North Korean control, the firms that stay ahead will be those that treat attribution as continuous intelligence work, ready to act the moment those funds reach an off-ramp.

‍

All research content and accompanying reports are provided for informational purposes only and should not be relied upon as professional advice. Accessing these materials does not create any professional relationship or duty of care. Readers are encouraged to consult appropriately qualified professionals for guidance. We uphold the highest standards of accuracy in all the information we provide. For any questions or feedback, please contact us at contact@nominis.io.

‍