Black October

As October draws to a close, it’s pertinent to review what 2026 has meant for OSS security and what upstream failures mean for the chains and protocols we cover. Within crypto, this has been the worst year on record by incident count, with 300+ tracked exploits to date, up 111% YoY, and with losses at nearly $2.5B. 

While staggering, I think it’s surprising that these figures are so low given the state of the broader OSS supply chain. Disclosed vulnerabilities have more than tripled since January, in step with the pace of AI development, but the situation has rapidly accelerated this month. October brought critical CVEs in core PHP (leaked before disclosure) and Node.js runtimes plus two severe remote code execution paths in Next.js, which are where most frontends to interact with onchain apps live, and ~75% of websites more broadly. 

Separately, ongoing exploits and hacks were discovered in the Tor Network, eMudhra’s certificate authority, and a California state education contractor’s file server. Railway, the hosting platform a large share of crypto teams run their infra on, disclosed on October 21 that attackers had reached its environment variable storage and decrypted some of it. Ledger, which spends more on hardware security than any company in crypto, lost $93M this month to a supply chain attack.

Yesterday, Solflare lost its validator keys through its staking provider, and it was not alone, with at least four Solana validators, Blockdaemon’s own among them, going dark at the same slot and 1.2M delegated SOL earning nothing. Allium, a data provider behind a large share of the industry’s dashboards, disclosed unauthorized access to its systems dating back to Saturday and is still restoring features. Coinbase customer contact data leaked through Amplitude, its analytics vendor, with CZ counting four separate data leaks across crypto and Korean TradFi in a single day. 

It’s pretty clear that some of this increased cadence can be attributed to frontier AI labs, where it makes for some fantastic marketing material. The audit that surfaced PHP2Shell was funded by OpenAI, and Anthropic’s CISO Jason Clinton spent August warning that “the vulnerability tsunami is coming in just a few months,” and followed up last week, saying “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste.” The important distinction here is that the quality of code hasn’t gotten worse, and it’s unlikely that there has been a dramatic increase in the number of threat actor organizations. With current AI capabilities, open source code is just being read much faster. 

For OSS, the maintainer’s role has changed. The timeline between bug identification and bug exploitation has decreased to essentially zero, and most of the bugs being exploited today have existed for years. As a result, the security model for volunteer-run software is no longer that of maintainers having weeks between a private report and public exploitation. 

I think the same thing is already true for core blockchain software. Most validator clients, wallet libraries, and client SDKs are open source today. Most are old enough to carry the same memory and state bugs that PHP did, and they are identifiable by the same mechanisms. As a result, it’s more likely than not that vulnerabilities in some of these codebases have already been identified and attackers are waiting on the right moment to strike. The Nakamoto Coefficient of a consensus layer does not change the fact that OSS failures sit upstream of crypto failures. Almost all validators run on Linux servers, the vast majority of frontends leverage NPM packages, signers will always need to communicate with an RPC over TLS, and a growing share of all three run on hosting platforms like Railway. The attack surface has moved underneath the 2022-era smart contract audit, demonstrated by the fact that infrastructure failures account for ~60% of 2026 losses thus far.

This is bullish for blockchain tech on a longer time horizon. Historical crypto exploits have created some of the industry's most critical standards (self-custody, bridge security, proof of reserves). The same week Clinton posted, Anthropic published work using Claude to formally verify 100+ OSS libraries in a matter of weeks, a task that took 20 person-years a decade ago. The tools reading old code for bugs are the same tools that can verify specific properties of the next version. The protocols, teams, and codebases that survive the next cycle will be those that adopt and improve upon established OSS security practices and stop treating upstream dependency security as somebody else’s problem. 

We’re heading into a period where TVL is going to climb, which means the payoff for a patient attacker climbs with it. 2027’s exploits have in all likelihood already been found, and the teams that use the next few months to rotate keys, audit dependencies, and lock down signers will be the ones still standing at ATHs.

— Nick

September’s $743M was the largest monthly loss since Bybit in February 2025 and the fifth largest month in DefiLlama’s dataset. The pattern this year is not one blowup but a steady floor of $80M to $250M a month with two spikes, April and September, both driven by key compromise.

All of finance is coming onchain and the institutional heavyweights are headed to DAS London this November this 10-11th.

Grab your tickets for unmatched access to the leaders bringing institutional finance onchain.