Binance's $6.34B breach pushes 2026 crypto hack losses to $8.78B, with transaction signing gaps in focus
Crypto hacks and exploits have stolen $8.78 billion across 329 recorded incidents in 2026, according to the article, a figure that includes assets later frozen or recovered. The largest case is the Binance breach of late October, put at about $6.34 billion, which the article calls the largest crypto hack on record, ahead of the roughly $1.5 billion Bybit theft of February 2025. Binance reported that about $2.85 billion of the affected assets were frozen or intercepted and that it had replenished 98% of the impacted token assets by October 31. The article also cites more than $1.31 billion in losses in the first half of 2026, including over $444 million across 33 wallet-compromise incidents. Its central argument is that attackers now exploit transaction approval as well as exchange infrastructure, and it uses the launch of Ambire Ice to make the case, so it reads partly as product promotion. The article does not describe how the Binance intrusion happened, and the Binance report could not be opened during research.
Detalhes técnicos
- In the Bybit case, the article says North Korean hackers compromised infrastructure supporting the Safe wallet interface and changed the information shown to employees approving a transaction (gbhackers.com). The approvers used hardware wallets but signed instructions that let the attackers take control of the funds (gbhackers.com).
- The article presents this as a limit of hardware wallets: isolating private keys does not protect users who cannot understand what they are signing (gbhackers.com). It says the Ethereum Foundation has announced an initiative on clear signing, which it identifies as a security weakness tied to major losses including Bybit (gbhackers.com).
- The article attributes the Binance losses to hackers without naming a group or an intrusion vector, and it gives no CVE or ATT&CK mapping for either case.
Remediação
- Ambire Ice is an open-source hardware wallet built for Safe accounts, with clear signing and an air-gap switch (blog.ambire.com). Its vendor page lists a pre-order for the first 200 units at $119 (blog.ambire.com). The article adds two secure elements from NXP and Infineon, offline signing, and a physical switch that disconnects USB and Bluetooth (gbhackers.com).
- Defenders should check what a transaction actually does before signing, including destination, granted permissions and any change of account control, which is the gap the article highlights (gbhackers.com).
- The article itself notes that hardware wallets cannot fix exchange infrastructure, remove malicious smart contracts, or protect a user who knowingly approves a fraudulent transaction (gbhackers.com).
Linha do tempo
-
Binance's $6.34B breach pushes 2026 crypto hack losses to $8.78B, with transaction signing gaps in focus
ler a análise desta fonte ocultar
Crypto hacks and exploits have stolen $8.78 billion across 329 recorded incidents in 2026, according to the article, a figure that includes assets later frozen or recovered. The largest case is the Binance breach of late October, put at about $6.34 billion, which the article calls the largest crypto hack on record, ahead of the roughly $1.5 billion Bybit theft of February 2025. Binance reported that about $2.85 billion of the affected assets were frozen or intercepted and that it had replenished 98% of the impacted token assets by October 31. The article also cites more than $1.31 billion in losses in the first half of 2026, including over $444 million across 33 wallet-compromise incidents. Its central argument is that attackers now exploit transaction approval as well as exchange infrastructure, and it uses the launch of Ambire Ice to make the case, so it reads partly as product promotion. The article does not describe how the Binance intrusion happened, and the Binance report could not be opened during research.
Technical Details
- In the Bybit case, the article says North Korean hackers compromised infrastructure supporting the Safe wallet interface and changed the information shown to employees approving a transaction (gbhackers.com). The approvers used hardware wallets but signed instructions that let the attackers take control of the funds (gbhackers.com).
- The article presents this as a limit of hardware wallets: isolating private keys does not protect users who cannot understand what they are signing (gbhackers.com). It says the Ethereum Foundation has announced an initiative on clear signing, which it identifies as a security weakness tied to major losses including Bybit (gbhackers.com).
- The article attributes the Binance losses to hackers without naming a group or an intrusion vector, and it gives no CVE or ATT&CK mapping for either case.
Remediation
- Ambire Ice is an open-source hardware wallet built for Safe accounts, with clear signing and an air-gap switch (blog.ambire.com). Its vendor page lists a pre-order for the first 200 units at $119 (blog.ambire.com). The article adds two secure elements from NXP and Infineon, offline signing, and a physical switch that disconnects USB and Bluetooth (gbhackers.com).
- Defenders should check what a transaction actually does before signing, including destination, granted permissions and any change of account control, which is the gap the article highlights (gbhackers.com).
- The article itself notes that hardware wallets cannot fix exchange infrastructure, remove malicious smart contracts, or protect a user who knowingly approves a fraudulent transaction (gbhackers.com).