🔍 Read the full analysis: A $6 Billion Crypto Heist And Record CVEs Put AI In The Black October 2026 Picture on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 analysis reports that the NVD published 17,060 CVE records in October 2026 and CISA added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. CertiK estimated $3.47 billion in crypto losses after frozen and returned funds, while the FBI attributed a Binance theft reported at more than $6 billion to North Korea. The figures show a sharp rise in disclosures, but do not establish that AI caused the theft or that exploitation rose at the same rate.
October 2026 set a record for published vulnerability disclosures and saw a crypto theft reported at more than $6 billion, but the available figures do not show exploitation rising as fast as disclosures. In a November 1 analysis, Thorsten Meyer reported that the National Vulnerability Database published 17,060 new CVE records during the month, while the Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog. The FBI attributed the Binance theft to North Korea’s TraderTraitor; the reported loss and vulnerability counts measure different risks and do not establish a common cause.
Meyer said his count from the NVD API, excluding rejected records, found 17,060 CVEs published in October, compared with 4,273 in October 2025. For January through October, the count was 89,859, against 39,639 in the same period a year earlier. He noted that including rejected records would put October 2026 at 17,481, illustrating how counting methods affect the totals. A CVE is a public vulnerability record, not proof that an attacker exploited the flaw.
The exploitation data rose less sharply. CISA added 36 flaws to KEV in October, versus 31 in October 2025 and 17 in October 2024. The catalog, dated October 30 in Meyer’s account, had 282 additions so far in 2026, already above the 245 added during all of 2025. Five October additions concerned older vulnerabilities from 2015 to 2023 for which new exploitation evidence had emerged.
On cryptocurrency, Meyer cited CertiK’s estimate of $3.47 billion in October losses after accounting for frozen and returned funds, compared with $68 million in October 2025. The analysis said the Binance incident accounted for 96.7% of October’s total and reported that more than $6 billion left Binance in a single evening on October 29. The FBI attributed the theft to North Korea’s TraderTraitor on October 31. These are separate reported figures: the source does not explain how the amount said to have left Binance relates to CertiK’s net-loss calculation.
The report also identified vulnerability research and fixes involving AI. It said at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. Meyer’s account says PHP flaws dubbed PHP2Shell were patched on October 21 and came from OpenAI’s Patch the Planet program. Google said its Big Sleep system found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period; the source does not provide a count for that comparison.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The figures matter because vulnerability volume is not the same as active danger. A large jump in CVE records can reflect more flaws being found, more records being assigned, or changes in reporting practices; it does not mean attackers used every flaw. CISA’s KEV additions provide a narrower signal of vulnerabilities with evidence of exploitation, and their increase from 31 to 36 year over year was much smaller than the increase in new CVE records.
That distinction affects how organizations prioritize security work. A growing list of disclosures can stretch patching teams, while KEV entries identify flaws for which agencies and defenders have evidence of real-world use. The report points to remote-access systems, firewalls, support tools and widely used software among October’s KEV additions. That list is a reminder that exposed network-facing products can demand attention, but the article does not establish that every listed flaw was exploited broadly or caused a breach.
The crypto theft gives the month a separate financial dimension. A reported loss of this scale can affect users, exchanges and confidence in custody protections. Yet the report says the incident began with a compromised laptop, not a vulnerability discovered by AI. Linking the theft to AI would go beyond the source material. The evidence supports a discussion of simultaneous trends, not a claim that AI caused the heist.
Meyer also cites Google Threat Intelligence Group figures suggesting that exploitation rose roughly in step with disclosure over a longer period, and that about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. The ratio is attributed to that group’s analysis and should not be read as a universal measure of risk: catalog coverage and observation methods shape what can be counted.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor
Apple MacBook Pro 2023 with M2 Pro Chip, 14‑inch, 16 GB RAM, 512 GB SSD – Space Gray
As an affiliate, we earn on qualifying purchases.
Three Different Security Ledgers
Meyer frames the month through three measures: disclosed vulnerabilities, observed exploitation and stolen crypto. They capture different events. NVD CVE publication counts record known flaws; CISA’s KEV catalog tracks vulnerabilities with credible evidence of exploitation; crypto-loss estimates reflect reported thefts and the treatment of recovered or frozen assets. Comparing them can help describe the security landscape, but one measure cannot stand in for another.
In the NVD figures cited by Meyer, October’s 17,060 CVEs followed 12,000-plus in August and about 14,900 in September. The source’s January-to-October total for 2026 was already 1.9 times the 48,151 records it counted for all of 2025. Meyer cautions that totals depend on whether rejected records are included and how records are counted. CVE identifiers themselves are not a reliable count of published flaws because numbering authorities may reserve blocks in advance.
There is also a reporting-practice caveat. Meyer cites Google Threat Intelligence Group’s observation that automated assignment policies can inflate totals; descriptions mentioning the Linux kernel alone accounted for about 5,000 CVEs from January through August 2026, with no zero-day exploitation observed in that set, according to the group. The source also reports zero-day averages rising moderately, from eight to 11 per month. These caveats make the record disclosure total informative, but not a direct measure of attacker activity.
For exploitation trends, the report cites the group’s September 30 analysis: it counted 141 distinct vulnerabilities disclosed and exploited from January through August 2026, more than the 127 counted for all of 2025. It estimated an average of 18 exploited vulnerabilities per month in that 2026 period, up from 10.5 a month in 2025. Those figures differ in scope and method from CISA’s monthly KEV additions, so they should not be combined as if they were one dataset.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, describing his interpretation
What the October Counts Cannot Show
The report does not independently establish that AI caused the rise in published CVEs or that AI-generated exploits drove October’s incidents. It documents AI-related research and security-release credits, but does not provide a comparable baseline for how many vulnerabilities would have been found or fixed without those tools. Meyer’s claim that fixes shipped in the same month is his interpretation of the examples presented.
The relationship between the reported more than $6 billion leaving Binance and CertiK’s $3.47 billion estimate of net October losses after frozen and returned funds is not explained. The source attributes the theft to North Korea based on an FBI statement, but provides no technical account of the intrusion, evidence about the compromised laptop, or details of the attribution. The exact amount ultimately unrecovered is therefore not clear from the material supplied.
Nor do CVE or KEV counts show how many organizations were affected, how quickly they patched, or the severity of every flaw. The source reports approximately one observed exploited vulnerability per 431 disclosures in 2026, but does not supply the full methodology behind that ratio. The totals should be treated as reported measurements with stated counting limits, not as a complete account of attacks.
Tracking Patches and Loss Estimates
The next useful developments are fuller incident details and revised loss accounting. Binance’s public account, if provided, could clarify the amount taken, what was frozen or returned, and how the reported compromise occurred. Additional law-enforcement or technical disclosures could add evidence to the FBI’s attribution; the source does not state whether such details or a follow-up investigation announcement are expected.
For defenders, the immediate practical step is to check whether affected products appear in CISA’s KEV catalog and follow the applicable vendor and agency remediation guidance. Future NVD and KEV updates will show whether October’s disclosure and exploitation patterns continued, though monthly counts alone cannot establish how much risk organizations faced. Researchers and readers will also need clearer methods and baselines to evaluate how much AI contributed to finding flaws, developing exploits or speeding fixes.
Key Questions
What happened in October 2026?
The report says the NVD published 17,060 CVE records, CISA added 36 vulnerabilities to its KEV catalog, and CertiK estimated $3.47 billion in crypto losses after frozen and returned funds. It also reports a Binance theft of more than $6 billion, which the FBI attributed to North Korea’s TraderTraitor.
Do record CVE disclosures mean attackers exploited record numbers of flaws?
No. A CVE publication records a vulnerability; it does not show that attackers used it. CISA’s KEV additions rose from 31 in October 2025 to 36 in October 2026, a much smaller change than the increase in CVE publications reported by Meyer.
Did AI cause the Binance theft?
The source does not say that. It attributes the theft to North Korea’s TraderTraitor based on an FBI statement and says the incident began with a compromised laptop. It does not connect the theft to an AI-discovered flaw.
Why are the Binance and CertiK loss figures different?
The source reports more than $6 billion leaving Binance and a CertiK estimate of $3.47 billion in October losses after frozen and returned funds. It does not explain the calculation linking those figures or state the final unrecovered amount.
What should organizations take from the KEV figures?
The KEV catalog tracks vulnerabilities for which CISA reports evidence of active exploitation. Organizations can review catalog entries relevant to their systems and follow vendor and agency remediation guidance; the monthly totals do not show how many organizations were affected.
Source: ThorstenMeyerAI.com
