The security annual report of 2026 is marked by a glaring figure: according to CertiK data, losses of cryptocurrency assets due to vulnerabilities and phishing amounted to approximately $9.2 billion that year, marking the most significant loss to date. The main contributor to pushing this number into the record range was the concentrated explosion in October — a single month loss of about $6.5 billion, with a total of 89 recorded security incidents on-chain and on platforms, of which approximately $3.03 billion was frozen or returned afterward, resulting in an adjusted actual loss of about $3.47 billion. The incident disclosed by Binance on October 30, estimating an impact of approximately $6.3 billion, almost single-handedly changed the annual curve, compounded by the approximately $387.5 million incident involving Bitget in September being transferred to an attacker-controlled address, creating a picture of "regular attacks layered with several super black swans." Ironically, CertiK released this update on the 18th anniversary of the Bitcoin white paper, juxtaposing the milestone of the decentralized narrative with the reality of high security losses; researchers simultaneously warned that attackers have begun using autonomous AI tools to automate phishing, vulnerability research, and credential theft, leading to a burgeoning race regarding offensive and defensive efficiency, with the crypto industry needing to acknowledge that it has been dragged into this AI-accelerated security game.
How the $9.2 Billion Annual Loss Accumulated
If we view the annual loss of approximately $9.2 billion as a time curve, October 2026 stands out as the most prominent spike. According to CertiK data, monthly cryptocurrency security incidents resulted in approximately $6.5 billion in losses, close to three-quarters of the annual figure. After the intervention of freezing and returning mechanisms, around $3.03 billion was pulled back from the attack path, yet the adjusted actual loss still reached about $3.47 billion, accounting for more than a third of the annual losses. In other words, even if the defensive side was able to successfully recover nearly half of the monthly losses afterward, the extreme nature of October was still enough to change the statistical landscape for the entire year.
This is not just a result of one or two isolated "black swan" events. October recorded a total of 89 security incidents, meaning almost every day saw new attacks disclosed, with incidents ranging from phishing to exploitations, resulting in dual increases: the number of incidents is rising, and the scale of monthly losses is also expanding. The approximately $6.3 billion impact disclosed by Binance on October 30, along with the approximately $387.5 million incident involving Bitget in September, are just a few visible nodes that illustrate how a single platform incident can swiftly rewrite the outlines of a month’s, and even a year’s, losses. Under the backdrop where researchers have observed an acceleration of attack processes by autonomous tools, this seemingly fragmented but continually high-frequency security breach has been compounded year after year, ultimately converging into a systematic wound of $9.2 billion on the statistical sheet.
Attackers Developing AI Tools to Accelerate Attacks
According to disclosures from researchers, attackers are no longer satisfied with manually piecing together scripts but have started using autonomous tools to compile phishing, vulnerability research, and credential theft into a continuous attack chain. The phishing phase utilizes tools to automatically generate highly realistic templates and dialogues, rapidly iterating against different platforms and victim groups; vulnerability research is assigned to automated scanning and analysis modules, which produce a list of suspected weak points in a short period; once victims input credentials into the fraudulent page, that information is directly fed into the subsequent theft process, shortening the time gap between "gaining access to accounts" and "breaching the system." With this assembly line-like transformation, attackers can simultaneously control more phishing scenarios and vulnerability tests, rather than slowly probing individual projects and addresses.
This AI-centered automation description still comes from a single research source, and public materials have neither provided the names of the tools and developers nor detailed specific technical elements. There has also been no on-chain case-by-case labeling of "which addresses and which attacks are driven by a certain AI tool." According to publicly available information, both Binance and Bitget have yet to directly attribute their significant security incidents to AI, and the causes of these incidents remain partially undisclosed. At this stage, we can only confirm that the efficiency of the attack processes in phishing, vulnerability scanning, and credential theft has indeed been enhanced by autonomous tools, yet we cannot simply label a specific significant loss as an "AI attack," meaning that all judgments regarding "AI being the main culprit" must be based on more complete evidence and more cautious attributions on-chain.
Concentration of Losses from Binance and Bitget Blasts
According to CertiK monitoring data, the curve of approximately $9.2 billion in losses for 2026 did not result from countless small and medium incidents stacked evenly but rather is a typical representation of a "single explosion" dragging through the whole year. Binance disclosed on October 30 that its single security incident was estimated to have caused an impact of approximately $6.3 billion, nearly coinciding with the overall loss of about $6.5 billion for the month of October, directly turning the 89 recorded security incidents for that month into a "spike." Further tracing back, approximately $387.5 million from the September incident at Bitget was also written into the statistics in a concentrated bleeding manner. These two figures from centralized platforms occupy a significant weight in the total annual loss of $9.2 billion, causing October's statistics to show a remarkable concentration far exceeding that of other months.
From the perspective of security landscape, the incidents at Binance and Bitget illustrate that large centralized exchanges are both the concentrated custodians of user assets and systemic risk nodes: once the defenses are breached, the impact is not merely sporadic contracts being tested one after another but vast amounts of funds being uniformly migrated to attacker-controlled addresses in a very short time. Even more notably, both platforms have not publicly locked the causes of the incidents as attributable to AI, and existing materials do not specify the types of vulnerabilities, attack vectors, or the ratio of funds recovered, meaning we can only acknowledge the exposure to risk and loss scale, but we must view the causes as possibly stemming from a complex black box of multiple intertwined factors.
Defensive Attempts and Asset Recovery in the AI Era
Within this narrative of a total loss of $9.2 billion for the year, October was not solely about loss and consumption. According to CertiK data, approximately $3.03 billion in assets were frozen or returned in October, which often means that part of the attack paths were identified, risk addresses were marked, and even some funds were regained from the attacker-controlled environment. Security auditing, on-chain monitoring platforms, and various automated risk control tools are attempting to weave a "chasing net" during the response phase to pull back funds that have crossed the defensive line as much as possible. However, the adjusted figures remain bleak: the actual loss for October still approximates $3.47 billion, and the freezing and returns did not pull the attack impact for that month back from "disastrous" to "controllable," rather more just slightly buffering some extreme consequences.
From a defensive perspective, the fact that CertiK was able to present annual loss statistics and trend updates on October 31 itself demonstrates that the monitoring platform is continuously tracking incidents and mapping the risk landscape, providing necessary references for security audits and tool iterations. However, the existing public materials do not disclose the success rate of various defensive tools in individual incidents, nor do they specify the specific application paths of AI on the defensive side, leading us to infer from the demand side: as researchers have confirmed that attackers are using autonomous tools to automate phishing, vulnerability research, and credential theft, the defense side is compelled to accelerate follow-up in auditing processes, real-time monitoring, and automated handling. Otherwise, they will continually lag behind on the track where the AI has sped up the attack processes. According to CertiK data, even if there exists a certain scale of assets frozen or returned, in the face of the reality that the efficiency of attacks is being continually pushed higher by AI, such limited recovery capabilities remain unable to change the direction of continually rising overall risk exposure.
Future Attack and Defense Observations: From Attack Efficiency to Accountability
The $9.2 billion annual loss, the concentrated explosion of $6.5 billion in October, and the approximately $387.5 million from Bitget being transferred to an attacker-controlled address constitute three core signals of security incidents in 2026: attack efficiency has been significantly heightened, risks are sharply concentrated at a few centralized nodes, and the assets that have truly been locked and recovered are just the tip of the iceberg. On October 31, 2026, on the 18th anniversary of the Bitcoin white paper's release, CertiK published this data set, noting the trend of AI accelerating attack processes within the report, alongside the significant events at Binance and Bitget, which have yet to fully disclose their causes, sketching a reality of ambiguous attribution: we know that attacks are speeding up and losses are enlarging, yet we often cannot clearly identify whether it is a single technical defect, governance error, or an overall absence of risk control consensus. Variables that warrant continued attention in the future include the speed and complexity of the proliferation of AI tools on the attack side, the pace of transparency upgrades by centralized nodes such as exchanges regarding asset flows and risk control decisions, and whether regulatory attitudes will prompt the industry to redraw responsibilities in the absence of formal resolutions for specific incidents — who pays for on-chain losses, how the minimum safety baseline is defined, and how audit and risk control commitments are quantified and held accountable, the answers to these questions will collectively shape the next stage of the attack and defense landscape.
Join our community, let’s discuss and become stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
