🔍 Read the full analysis: Black October 2026: AI, Vulnerabilities And A $6 Billion Crypto Heist on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The source reports 17,060 new CVE records in October 2026 and $3.47 billion in net crypto losses, including a theft from Binance that the FBI attributed to North Korea. The figures do not establish that AI caused the surge in vulnerabilities or the theft: CISA’s exploited-flaw additions rose much less than disclosures, and the Binance incident reportedly began with a compromised laptop.
A report published November 1 says October 2026 saw a record 17,060 new CVE records and $3.47 billion in net crypto losses, including a theft from Binance that the FBI attributed to North Korea. The figures describe separate trends: disclosures rose far faster than flaws added to the U.S. government’s active-exploitation list, and the source does not establish that AI caused either the vulnerability surge or the Binance theft.
The report’s author says he queried the U.S. National Vulnerability Database (NVD) API on November 1, counting records by publication date and excluding rejected records. On that basis, October’s total was 17,060 CVEs, compared with 4,273 in October 2025 and 3,564 in October 2024. From January through October 2026, the count reached 89,859, against 39,639 during the same months of 2025. The author notes that including rejected records would put October 2026 at 17,481.
A different measure rose more modestly: CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in October, compared with 31 in October 2025 and 17 in October 2024. The report says 282 flaws had been added in 2026 through October 30, already above the 245 added during all of 2025. KEV additions can include previously disclosed flaws for which new evidence of exploitation has emerged; the October additions are not a count of all attacks that took place that month.
For crypto losses, the report cites CertiK’s October estimate of $3.47 billion after frozen and returned funds, compared with $68 million in October 2025. It says the Binance incident represented 96.7% of October’s total and that the FBI attributed the theft to North Korea’s “TraderTraitor” on October 31. Those are attributed findings in the source report, not independently detailed incident records provided here.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The figures matter because a rising count of disclosed vulnerabilities is not the same as a rising count of successful attacks. CISA’s catalog provides a narrower indicator: flaws for which the agency says there is reliable evidence of active exploitation. In October, its 36 additions were up from 31 a year earlier, while monthly CVE publications increased from 4,273 to 17,060. The report calculates that KEV additions equaled about 0.2% of October 2026’s new CVEs, down from about 0.5% in October 2024. That ratio compares two different datasets and should not be read as the share of all vulnerabilities attackers used.
The gap is relevant to security teams deciding how to prioritize patches. A record disclosure count can overwhelm review and remediation processes, while a confirmed exploited flaw may call for faster action. The report lists October KEV additions affecting remote-access products, firewalls, collaboration software, virtualization tools, PHP and Google’s Brotli library. It does not provide a complete account of affected deployments, patch uptake or resulting incidents.
The crypto figure has a separate implication: a very large theft can dominate monthly loss totals. The report says Binance accounted for 96.7% of October’s net losses. That concentration means the headline total does not, on its own, show that thefts across the wider crypto sector became uniformly larger or more frequent. The source’s own account also cautions against linking the theft to AI-discovered software bugs: it says the incident began with a compromised laptop.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
What the Three Counts Measure
The report separates security activity into three “ledgers”: publicly disclosed CVEs, flaws added to CISA’s KEV catalog, and reported crypto losses. Each measures something different. CVEs are records of publicly identified vulnerabilities; they are not attack counts. KEV entries reflect evidence of exploitation, but catalog additions depend on identification and publication processes. Crypto loss estimates track a different kind of event and can change when funds are frozen or returned.
The source also warns that CVE totals depend on counting choices and assignment practices. It cites Google’s threat intelligence group as saying that automated assignment policies can inflate totals; the group reportedly counted about 5,000 Linux-kernel-related CVEs from January to August 2026 with zero observed zero-day exploitation. The source further attributes to that group an estimate that exploitation rose roughly alongside disclosure, with about one in 431 vulnerabilities disclosed in 2026 observed exploited. The report gives no full methodological detail for that ratio in the supplied material.
AI appears in the report as a developing part of vulnerability research, not as an established explanation for October’s overall numbers. The author says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He also points to PHP flaws patched October 21 that came from OpenAI’s Patch the Planet program and to Google’s Big Sleep research. These examples show reported research and fixes; they do not prove that AI caused the month’s CVE record or the Binance loss.
AI’s Role Is Not Established
The data presented do not show whether AI caused the increase in CVE publications, changed the overall pace of exploitation or contributed to the Binance theft. The source argues that attackers can use AI to turn fixes into exploits quickly and says PHP2Shell’s embargo broke before release, but the supplied material does not provide incident-level evidence, a measured comparison or a detailed timeline sufficient to assess those claims independently.
Several counts also have limits. NVD totals change with the counting method, and the report itself gives different October totals depending on whether rejected records are excluded. KEV additions record catalog updates, not every active attack. The source describes CertiK’s crypto loss figure as net of funds frozen and returned but does not provide a breakdown of the transactions or the calculation. The FBI attribution is reported by the author, while the source material does not include the FBI statement or supporting evidence.
It is also unclear from the supplied report how many organizations were affected by the listed vulnerabilities, how quickly patches were applied, or whether the 2026 publication surge reflects more flaws, changes in reporting and assignment practices, or a combination. The source says zero-days rose moderately, from an average of eight to 11 a month, but does not specify the full comparison period in the excerpt.
Watch for Attribution and Patch Data
The next useful evidence will be incident-level reporting on the Binance theft, including a clearer account of the alleged compromised laptop and the FBI’s attribution to TraderTraitor. Further updates to CISA’s KEV catalog and later threat-intelligence assessments can show whether the October pattern of rising exploitation additions continues, though those records will still measure confirmed catalog entries rather than every attack.
For the vulnerability trend, later NVD totals and clearer details about assignment and reporting practices will help establish whether the October record persists under comparable methods. More information about patch adoption and confirmed exploitation would help distinguish a disclosure surge from a broader increase in real-world risk. The source’s central thesis—that AI could speed both discovery and exploit development—remains a claim to test against such evidence, not a conclusion established by October’s counts alone.
Key Questions
What was the main development reported for October 2026?
The report says the NVD published 17,060 new CVE records in October and CertiK estimated $3.47 billion in net crypto losses. It also reports that the FBI attributed the Binance theft to North Korea’s TraderTraitor.
Does the record CVE count mean attacks also hit a record?
No. CVE records count disclosed vulnerabilities, not attacks. The report says CISA added 36 flaws to its KEV catalog in October, compared with 31 a year earlier, a much smaller increase than the rise in CVE publications.
Did AI cause the Binance theft?
The supplied report does not establish that. It says the FBI attributed the theft to North Korea’s TraderTraitor and says the incident began with a compromised laptop, rather than an AI-found software bug.
How certain is the $3.47 billion crypto-loss figure?
It is the October estimate cited from CertiK, after frozen and returned funds, according to the source report. The supplied material does not include CertiK’s full calculation or transaction-level breakdown.
Source: ThorstenMeyerAI.com
