Risk in DeFi: October post-mortem

Overview

This review examines the most significant onchain incidents of October 2026, measuring each against Credora’s risk assessment methodology to reach a verdict on whether the methodology would have covered it. It serves two ends: an account of how and why each failure happened, and a standing test of the methodology against realized losses. The verdicts that fall short matter as much as the ones that land, since they mark where the framework must evolve. A scorecard follows at the end.

October was the costliest month for crypto hacks on record. PeckShield counted 56 major incidents and about $6.48B lost, a 745% jump from September. October pushes 2026 to a record ~$8.6B lost so far by PeckShield’s count and $9.2B by CertiK’s. Nearly three-quarters of PeckShield’s year-to-date total comes from one event: the October 29 Binance hot-wallet breach, ~$6.34B and roughly 97% of October’s losses on its own. The second- and third-largest losses were also custody failures: the Ledger supply-chain attack through reseller CryptoBilis (~$93M to $102M) and CoinDCX’s failed sweep of retired wallets (~$16M). About $2.85B of the Binance outflow has since been frozen or intercepted, so the net figure is well below the gross.

Risk in DeFi: Custody and access

October’s losses came almost entirely from failures around custody rather than code: an exchange’s signing infrastructure and a hardware wallet’s supply chain. Neither of the two largest incidents touched a smart contract. The Binance breach is exactly the custodian risk a centrally custodied asset like BTCB is assessed on, and the assumption behind that assessment (that the custodian can absorb a loss) was put to the test. Binance absorbed the loss from company funds and reported 98% of affected token assets replenished as of October 31. The Ledger attack sat outside any asset’s risk profile; it compromised holders’ keys, whatever they held.

Onchain, the pattern shifted from the collateral manipulation that defined August and September toward treasury access control. Examples: a vault drained after its own multisig whitelisted the attacker’s contract and a Safe emptied through unlimited approvals it had granted months earlier to an address nobody controlled yet. The remaining onchain failures were a settlement bug in a tokenized-credit tranche vault and a staking integration that read a zero-amount withdrawal as a request for everything. All of them map to the risks the framework prices in advance.

1. Binance, est. ~$6.34B, October 29

Binance lost about $6.34B from its hot wallets starting around 20:05 UTC on October 29, the largest crypto theft on record and roughly four times Bybit’s 2025 loss. Most of the funds left in about 20 minutes across roughly ten chains, about $3.79B on Ethereum and about 18,270 BTC among them. The FBI, TRM Labs, and Chainalysis attributed it to North Korea’s TraderTraitor group. Approximately $2.85B has since been frozen or intercepted. Binance reserved more than $6.34B of company funds to cover customer losses, kept its BTC reserves whole at about 692,000 BTC, and completed a zero-knowledge proof of reserves for ten assets, including BTC, afterward.

No key was stolen. Binance’s own report attributes the theft to unauthorized access to an internal wallet signing service, reached through a multi-stage campaign, which began with a tampered Homebrew install that compromised a Binance Wallet DevOps engineer in June. Then came the malware delivered through a fake job interview in September; on October 20, an internal AI tool was used to compromise the accounts of two wallet-infrastructure engineers. Finally, on October 29, a third engineer’s computer was compromised, from which the attacker used the second engineer’s credentials to deploy a container that reached the signing service. With that access the attacker could ask the signing service to sign whatever it chose, and used it to sign EIP-7702 authorizations that delegated affected Binance hot wallets to the attacker’s sweeper contract. Binance co-founder Yi He said the exchange had blocked 57 suspected North Korea-linked threats earlier in 2026.

Methodology mapping.

→ Privilege Scope: the framework reads what an authorized signer is permitted to do, not how well its keys are held. Binance’s signing service signed transfers to attacker-controlled destinations across roughly ten chains once requests reached it; nothing between the system that assembles a transfer and the quorum that signs it stopped them. Once the attacker could place requests in front of that quorum, the authority it held became the attacker’s authority.

→ Circuit Breaker Sophistication: this is the dimension that would have caught it, and the one the framework is most explicit about. It scores whether outflows are bounded per transaction and per window, and whether a halt fires automatically within a block rather than waiting for a human. Credora’s own custody work names the per-transaction cap as the control Resolv lacked in March 2026, when a compromised, hardware-protected signing key minted 80M unbacked USR and the attacker extracted about $24M. Nothing comparable bounded Binance’s hot wallets: $6.34B left across roughly ten chains, most of it within about twenty minutes, with nothing automated halting outflows between the signature and the settlement. A cap would not have stopped the compromise, only limited its size.

→ Incident Playbook: the modifier scores whether an operator can detect, contain, and recover from signer compromise, including emergency pauses and role rotation. Binance raised an alert within minutes but could not stop the drain. Suspending withdrawals did not invalidate the attacker’s EIP-7702 delegations already onchain, and because the wallets ran MPC there was no single key to revoke them quickly. Sweeps continued until 23:56 UTC, nearly four hours after the first transfer, and Binance says it cleared the delegation at 00:10 UTC on October 30.

Verdict: COVERS. All three dimensions above would have flagged this in advance: a signing service that signed whatever reached it, no cap or automated halt bounding what it could move in a single window, and no fast way to neutralize authorizations already written onchain. Credora treats inputs an issuer has not published as absent, and Binance had published no outflow caps or revocation playbook for its hot wallets; BTCB sits at B−, with a 3.165% PD as of November 4. The dimension a reader would expect to carry a custody failure is missing from that list on purpose. Key Custody Environment scores the probability a private key is stolen. Binance’s hot wallets ran MPC and no key was stolen, so the metric would have had nothing to flag, whatever tier Binance earned on it. Our own files anticipate the pattern, noting that DPRK has industrialized attacks on signing infrastructure regardless of custody tier, but the metric that scores custody still measures key theft rather than signer abuse, which is the calibration this month argues for.

One caveat on the verdict. On mechanism alone this is Covers, since three dimensions would have flagged it in advance. There is still a scope question underneath it: Credora rates BTCB, the Binance-custodied bitcoin, not the exchange’s customer deposits where the $6.34B sat, and BTCB’s backing held: the breach did not touch its reserve address, and Binance covered the customer loss from its own funds. Tracked separately, the reading is “covers on mechanism, out of scope on the asset,” and a single label compresses the two.

2. Base wstETH vault, est. ~$6M, October 4

A vault on Base lost about $6M, roughly 1,783 wstETH, after its own multisig added an attacker’s contract to the lending whitelist. The vault is controlled by a 3-of-7 Safe whose signers remain unidentified, and no team has claimed it. The Safe signed a transaction whitelisting a brand-new contract (two whitelist edits landed within about a minute), and within 19 minutes that contract borrowed 1,783 aBaswstETH, Aave’s deposit receipt for wstETH, and redeemed it through Aave V3. The signatures were valid; Aave and Base were not at fault. About $31.7M remained in the vault afterward.

How the signatures were obtained is still unknown. The possibilities include stolen signer keys, a deceptive transaction shown to signers, or an insider. Whatever the path, a single whitelist action was enough to point the vault’s entire wstETH position at a new contract, and nothing capped or delayed what that contract could then draw.

Methodology mapping.

→ Key Custody Environment: the metric scores how the keys behind privileged actions are held, from software through hardware to true MPC. A vault run by seven unidentified signers publishes nothing about how its keys are held, so there is nothing to verify and it scores at the bottom tier by default.

→ Privilege Scope: the dimension scores how much a single privileged action can reach. One whitelist edit exposed the whole vault balance to a contract deployed minutes earlier, which is the unbounded reach the metric penalizes.

→ Circuit Breaker Sophistication: the dimension scores whether an admin action is delayed and whether abnormal outflows are bounded. A timelock between whitelisting and first use would have forced a delay before the new contract could draw (here it drew within 19 minutes), and a borrow cap would have limited the draw. Neither existed.

Verdict: COVERS. Unverifiable key custody, unbounded privilege, and the absence of any delay or cap are all scored. A vault whose entire position sits one whitelist edit away from any address a 3-of-7 approves would have rated poorly in advance, independent of how the specific signatures were produced.

3. Avalanche Safe, stale approvals, est. ~$7.45M, October 26

A 2-of-7 Safe on Avalanche C-Chain lost about $7.45M, roughly 3.09M USDC, 350,000 WAVAX, 182 WETH.e, and 10.8 BTC.b. No key was stolen and no signer was phished. In March 2026 the Safe had granted unlimited token approvals to an address that existed on other chains but was empty on Avalanche. Seven months later an attacker deployed a contract at that address and pulled every approved token. An MEV bot copied the attacker’s transaction, which itself reverted, and ended up holding the funds; a Safe owner then agreed onchain to let the bot keep 42,500 WAVAX (about $371K), and the bot reportedly returned the rest.

The failure was approval hygiene. Unlimited allowances were left standing to a counterparty address that had never been deployed on the chain where the approvals lived, which turned a cross-chain address collision into a drain. Nothing in the Safe’s operating routine reviewed or revoked those approvals once the counterparty relationship ended. A circuit breaker would not have helped here: a transferFrom against a standing allowance executes on the token contract, which the Safe cannot pause. The controls that mattered were granting a bounded approval in the first place, a guard rejecting approvals to addresses with no code, and revoking the approval when it fell out of use.

Methodology mapping.

→ Operational Security: the modifier scores the operating discipline around a treasury, including whether standing approvals are scoped, reviewed, and revoked. Unlimited allowances left for seven months to an undeployed address are the operational lapse this dimension reads.

→ Privilege Scope: an unlimited approval is unbounded reach by construction; it lets whoever controls the approved address take the full balance. Scoping approvals to the amount and duration needed is the control the metric scores.

Verdict: COVERS. Standing approvals and the discipline around them are scored. A treasury carrying unlimited, unrevoked allowances to an address with no deployed code on that chain would have rated poorly on operational security well before October, with no key compromise required.

4. Fence Finance / Valinor Digital TranchePool, est. ~$1.01M, October 28

A tranche vault on Avalanche tied to Fence Finance and Valinor Digital lost about 1,013,000 USDC shortly after midnight UTC on October 28. Early reports described a flash loan used to mint inflated tranche shares; later technical analyses point to a settlement accounting flaw instead. An attacker opened a borrowing facility through a permissionless path, funded it, drew the funds out, then drew them again with identical calldata, withdrawing twice against a single deposit around a daily principal-settlement rollover. No oracle manipulation, no reentrancy, and no admin role were involved. The funds were bridged to Solana through CCTP within minutes.

The vault is tokenized credit: tranched exposure to offchain lending. The bug sat in the contract logic that settles principal between tranches, and once a second draw cleared, nothing paused the pool before the remaining USDC left.

Methodology mapping.

→ Smart Contract Risk: the framework assesses a protocol’s own code in depth, including how it accounts for deposits, draws, and settlement across periods. Logic that lets the same deposit be drawn twice across a settlement boundary is a core accounting flaw in the vault’s own contracts.

→ Circuit Breaker Sophistication: the dimension scores whether abnormal outflows can be capped or halted. Two draws against one deposit cleared with no limit or pause, so the brake that would have contained the second draw did not exist.

Verdict: COVERS. Settlement accounting and outflow controls are scored, and for tokenized credit they are the heart of the assessment. A tranche vault whose draw logic can be replayed across a settlement rollover, with no cap on withdrawals, would have rated poorly before any draw was attempted.

5. b14g, est. ~$1.47M, October 31

b14g, a Bitcoin dual-staking protocol on Core, lost about 97M CORE, roughly $1.47M, in a single transaction that submitted 99 withdrawal requests for zero CORE and emptied 91 staking orders. Core’s native staking contract treats a zero-amount withdrawal as an instruction to withdraw the entire staked balance, and b14g’s integration passed those zero-amount requests straight through. b14g paused the affected contracts; about 9M CORE was frozen by exchanges. The BTC staked through the protocol remains time-locked on Bitcoin and was not affected, and Core said its network and validators were unaffected. CORE fell about 12% to an all-time low.

Reports differ on where the flaw sits, in Core’s “zero means all” convention or in b14g’s failure to validate amounts before forwarding them. The two are not exclusive: a downstream integration that passes raw user input into a contract with a known edge case owns the consequence of not checking it.

Methodology mapping.

→ Smart Contract Risk: the framework assesses a protocol’s own code, including how it validates inputs before calling into dependencies it does not control. Forwarding a zero-amount withdrawal into a staking contract that reads zero as “everything” is an input-validation flaw in b14g’s own integration logic.

Verdict: COVERS. Input validation at the boundary with an external contract is part of the smart-contract assessment, and an integration that forwards unchecked amounts into a dependency with a documented edge case would have rated poorly before October 31. The convention lives in Core; the failure to guard against it is b14g’s.

Credora scorecard: October 2026

Incident	Date	Estimated loss	Root cause	Primary Credora dimensions	Verdict
Binance	Oct 29	~$6.34B (~$2.85B frozen)	MPC hot-wallet signing service driven by attacker; no outflow cap; no single key to revoke EIP-7702 delegations quickly	Circuit Breaker, Privilege Scope, Incident Playbook (Key Custody tier missed it)	Covers
Base wstETH vault (unnamed)	Oct 4	~$6M (1,783 wstETH)	3-of-7 Safe whitelisted a new contract that borrowed the vault’s Aave wstETH	Key Custody Environment, Privilege Scope, Circuit Breaker	Covers
Avalanche Safe (unnamed)	Oct 26	~$7.45M	Unlimited approvals left to an undeployed address; attacker deployed there and drained	Operational Security, Privilege Scope	Covers
Fence Finance / Valinor TranchePool	Oct 28	~$1.01M	Settlement accounting flaw allowed a second draw against one deposit	Smart Contract Risk, Circuit Breaker	Covers
b14g (Core)	Oct 31	~$1.47M (97M CORE)	Zero-amount withdrawals forwarded to a contract that reads zero as “withdraw all”	Smart Contract Risk	Covers
Other events (out of scope)
Ledger / CryptoBilis	Oct 9-13	~$93M to $102M	Hardware implant in reseller-sold devices read seed phrases during setup	None (device supply chain)	Out of scope
CoinDCX	Oct 21	~$16M	Failed sweep of retired deposit wallets; initially denied, then confirmed	None (CEX operations)	Out of scope
MetaMask staking infrastructure	Oct 1	No user loss	Validator infrastructure incident; affected validators exited	None (operator infrastructure)	Out of scope

Every featured incident above maps to a dimension the framework scores, and in each case a poor score would have been assignable in advance. Binance carries the month on size; the other four are the onchain failures, about $16M combined.

The out-of-scope events of the month sit below the asset entirely. Ledger confirmed an unauthorized implant in a device sold through reseller CryptoBilis that read recovery phrases at setup and transmitted them over LTE; third-party trackers tie the losses to devices sold by the same reseller. CoinDCX lost about $16M when an internal process meant to sweep retired deposit wallets failed, after first calling the outflow a false alarm. MetaMask disclosed an incident in the infrastructure behind its staking validators and exited them as a precaution, with no evidence of user-fund impact. Smaller onchain exploits that the framework would also read include two swap-logic bugs (GoldPesa’s Uniswap v4 hook, ~$114K; MALT’s swap function, ~$72K), a Safe-module exploit on two Aave-linked wallets (~$305K), and the Talis NFT marketplace on Injective.

How to read the verdicts

Covers means the failure maps to a risk the framework scores, and a poor score would have been assignable before the event. All five featured incidents qualify: Binance, the Base vault, the Avalanche Safe, the Fence tranche pool, and b14g. Coverage does not mean the rating times the exact transaction or names the defective line; it means the standing weakness was scorable in advance.

Partially covers means the framework sees part of the risk but not the dominant part. No October incident fell here, though Binance sits close to the line. The dimensions that read privilege, outflow limits, and containment would all have flagged it, which is why it lands on Covers, but the $6.34B sat in exchange customer deposits rather than in a rated asset. Credora rates BTCB, the Binance-custodied bitcoin, and its backing held. The line against September’s Bitget is still deliberate: that was Out of scope because no rated asset depended on Bitget’s custody, whereas BTCB depends on Binance’s.

Not covered is the most consequential verdict: an incident within the framework’s remit that it failed to flag at all. No October incident fell here.

Out of scope means the failure sits on a layer an asset rating does not read. Ledger was a tampered device in a reseller’s supply chain; CoinDCX was an exchange’s own wallet operations with no rated asset depending on it; MetaMask was a staking operator’s infrastructure with no user loss. All sit at the device, exchange, and operator layers, the same boundary as September’s Trezor, August’s Coinsbuy, and July’s Coldcard.

Key takeaways

October set the all-time loss record and almost none of it touched the asset layer. One exchange breach was about 97% of the month, the next two losses were a hardware supply chain and an exchange’s wallet operations, and the four onchain protocol failures together were roughly $16M. Every featured incident mapped to a risk the framework prices in advance, Binance included. Binance is the one worth sitting with: the dimensions that read outflow limits, privilege, and containment would have flagged it, while the one that reads key custody would have missed the vector entirely.

Two patterns are worth marking. The first is that the custody layer’s largest failures this month came through the supply chain, and the biggest one went around the key rather than through it. Binance ran MPC, the architecture behind the strongest key custody tier the framework recognizes, and lost $6.34B anyway, because the attacker walked in through a tampered software install and a fake job interview and then simply asked the signing service to sign. Ledger was compromised through tampered hardware before the device reached the user, reading the recovery phrase at setup rather than breaking the secure chip.

The lesson for the methodology is one its own files already half-state: a custody tier measures how hard a key is to steal, and the largest attack of the month never needed to steal one. What limits the damage sits in two other dimensions: the circuit breaker bounding how much can leave in one window, and the playbook’s ability to revoke what the signer authorized. That is where our Resolv note already pointed. The second pattern is onchain and more actionable: the two largest onchain losses were treasury access-control failures rather than price manipulation. A multisig whitelist with unbounded reach and a set of stale unlimited approvals together cost more than every oracle or accounting bug in the month. Approval hygiene and privilege scope are not exotic dimensions, but October shows them doing most of the onchain damage.

Frequently Asked Questions

How does Credora assess risk in DeFi beyond the asset layer?

Credora’s methodology accounts for both onchain and offchain risk surfaces, across dimensions including Key Custody Environment, Privilege Scope, Circuit Breaker Sophistication, Operational Security, Bridge Risk, and Smart Contract Risk. Some layers remain beyond its scope. A hardware wallet’s supply chain, as in October’s Ledger case, sits below what an asset rating reads, the same boundary as September’s Trezor and July’s Coldcard. An exchange’s own customer deposits are also not a rated asset, which is why the Binance verdict carries a scope caveat even though the mechanism is covered. There is also a calibration point: Binance ran MPC, the architecture behind the strongest key custody tier the framework recognizes, and the attacker never needed a key, reaching the signing service instead. What would have flagged it is the absence of an outflow cap bounding what that signer could move in one window, and of a fast way to neutralize the authorizations it granted.

How does the Probability of Significant Loss (PSL) measure risk in DeFi?

The PSL is Credora’s main risk metric for markets and vaults: the probability that a position loses 1% or more of principal over a 30-day horizon, estimated by Monte Carlo simulation and annualized. A companion metric, the Probability of Default (PD), rates individual assets on the same scale. Both convert qualitative factors, from smart-contract audit quality and key custody to reserve transparency, peg performance, and counterparty dependencies, into a single value that compares markets, vaults, and assets, expressed as a rating from A+ to D.

What were the main DeFi exploit categories in October 2026?

Onchain, the losses were treasury access-control failures (a multisig whitelist on the Base vault, stale unlimited approvals on the Avalanche Safe), a settlement accounting bug in a tokenized-credit tranche vault (Fence / Valinor), and a staking-integration input flaw (b14g). The month’s record dollar figure came from outside DeFi proper: the Binance hot-wallet breach, where the privilege, outflow and containment dimensions all apply but the loss landed in exchange customer deposits rather than a rated asset, plus the Ledger hardware supply-chain attack and CoinDCX’s wallet operations.