October bridge and chain exploits are small one by one, and a $718 million monthly figure is unverified
October 23, 2026 (October 17 to 24, 2026)
Cysic's BNB Chain bridge lost about $727,000 on October 17 after attackers used access to a supporting database to feed it a forged message that minted 10 million unauthorized tokens. The WAX multi-chain bridge lost about $90,500 on October 22 because a missing input check accepted a negative fee value. Initia halted its chain after a flaw in how its MoveVM caches scripts let attackers mint tokens, with losses of about $2.6 million to $2.7 million. Chainalysis data cited by Blockworks puts October DeFi losses at $718 million across 11 hacks, 82% from bridges, but one analyst could not confirm that against a primary Chainalysis release and found the verified bridge incidents total far less. Separately, CoinDCX denied a report of about $16 million leaving its wallets, saying the addresses date from its 2025 breach.
Why it matters
The pattern matches the larger thefts: the weak point is the off-chain infrastructure and verification logic around a bridge, not arithmetic inside the contracts.
What defenders can take from it
- Harden the databases and services that feed instructions to a bridge, and be able to halt within minutes. Initia halted about 42 minutes after the exploit began.
- Treat monthly loss totals as estimates and check which tracker produced them.