October bridge and chain exploits are small one by one, and a $718 million monthly figure is unverified
October 23, 2026 (October 17 to 24, 2026)
Cysic's BNB Chain bridge lost about $727,000 on October 17 after attackers used access to a supporting database to feed it a forged message that minted 10 million unauthorized tokens. The WAX multi-chain bridge lost about $90,500 on October 22 because a missing input check accepted a negative fee value. Initia halted its chain after a flaw in how its MoveVM caches scripts let attackers mint tokens, with losses of about $2.6 million to $2.7 million. Chainalysis data cited by Blockworks puts October DeFi losses at $718 million across 11 hacks, 82% from bridges, but one analyst could not confirm that against a primary Chainalysis release and found the verified bridge incidents total far less. Separately, CoinDCX denied a report of about $16 million leaving its wallets, saying the addresses date from its 2025 breach. The Binance theft on October 29, covered in its own entry, pushed October past any earlier month on record, according to Crypto Times.
Why it matters
The pattern matches the larger thefts: the weak point is the off-chain infrastructure and verification logic around a bridge, not arithmetic inside the contracts.
What defenders can take from it
- Harden the databases and services that feed instructions to a bridge, and be able to halt within minutes. Initia halted about 42 minutes after the exploit began.
- Treat monthly loss totals as estimates and check which tracker produced them.