Significant Security Breaches in Crypto Exchanges and DeFi Protocols: November 2026 Overview

Key Updates This Week

Major Exchange Breaches

DeFi Protocol and Infrastructure Exploits

Vulnerabilities in Self-Hosted Software

Auth and Withdrawal Logic Flaws

Significant Security Breaches Shake Crypto Landscape: Over $40 Million Stolen in Just Days

November 8, 2026

In a tumultuous week for the cryptocurrency sector, exchanges and decentralized finance (DeFi) protocols across multiple blockchains reported alarming security breaches between November 1 and November 5, 2026. This wave of attacks has raised serious concerns about the vulnerabilities inherent in both centralized exchanges and DeFi infrastructure.

Key Updates This Week

• Mercado Bitcoin reported a staggering $40 million was siphoned from its wallets following a security breach on November 2.
• DeFiLlama revealed that losses in 2026 have reached an eye-watering $8.776 billion across 333 incidents as of November 8.
• A vulnerability in BTCPay Server, exploited in 682 separate sweeps on November 1, was patched in version 2.4.2 released in August, highlighting the risks of outdated software.

Major Exchange Breaches

Brazil’s largest cryptocurrency exchange, Mercado Bitcoin, was forced to pause its deposit and withdrawal services after a significant security breach on November 2. Attackers managed to transfer over $40 million in cryptocurrency from wallets associated with the exchange across various blockchains. In a swift response, Tether froze more than $4.5 million of the stolen USDT.

On the same day, BitMart reported a breach where approximately $391,000 was stolen from wallets across three blockchains: Base, Arbitrum, and Optimism. Blockchain investigators traced portions of these stolen funds back to the Mercado Bitcoin exploit, indicating a coordinated attack.

DeFi Protocol and Infrastructure Exploits

The DeFi sector was not spared, with several protocols experiencing targeted attacks. On November 5, TENDRIL suffered a breach where an attacker exploited the token sell logic in a PancakeSwap V2 pool on Binance Smart Chain, draining around $550,000 in USDT. ExVul estimated the attacker’s profit from this campaign at approximately $181,910 USDT.

Loopscale Lending also paused operations on Solana the same day after facing a sustained attack involving over 30,000 malicious API requests directed at its SOL and USDC Genesis Vaults. Fortunately, Loopscale reported that the affected vaults were made whole, and no user deposits were lost.

Vulnerabilities in Self-Hosted Software

The BTCPay Server platform was compromised on November 1, with attackers exploiting vulnerabilities in version 2.4.1 and earlier. This led to the theft of BTC and LTC from compromised self-hosted installations, with Bitquery reporting 682 separate sweeps. A staggering 87% of the theft occurred in a single wave between 14:12 and 22:16 UTC, totaling $1.62 million stolen from hot wallets on outdated software.

Despite the release of version 2.4.2 in August 2026 to address these vulnerabilities, the continued exploitation underscores the risks of running outdated installations.

Auth and Withdrawal Logic Flaws

In addition to the breaches, security gaps were identified in authentication and withdrawal mechanisms. Keplr wallets created using Google or Apple social logins were targeted, with attackers exploiting Web3Auth’s third-party authentication infrastructure to execute unauthorized transactions. In a separate incident, Premia V3 lost approximately $437,000 on Arbitrum on November 1 due to a flaw in its withdrawal logic.

Conclusion

As the cryptocurrency landscape grapples with these significant security breaches, the need for robust security measures and timely software updates has never been more critical. With billions lost in 2026 alone, both centralized exchanges and DeFi protocols must prioritize security to protect users and restore confidence in the digital asset ecosystem.