🔍 Read the full analysis: Black October 2026: A $6 Billion Crypto Heist, Record CVEs And AI on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1 report by Thorsten Meyer says the NVD published 17,060 CVE records in October 2026, while CertiK counted $3.47 billion in crypto losses after frozen and returned funds. The FBI attributed Binance’s reported theft to North Korea, but the report’s figures show that vulnerability disclosures rose much faster than CISA’s additions to its exploited-flaws catalog.
A November 1 report by Thorsten Meyer says October 2026 brought a record 17,060 new CVE records in the U.S. National Vulnerability Database and $3.47 billion in cryptocurrency losses, after frozen and returned funds were accounted for. The report also says the FBI attributed a theft from Binance to North Korea’s TraderTraitor group, while warning that its evidence does not show AI caused either the month’s vulnerability surge or the largest reported theft.
Meyer says he counted CVE records using the NVD API, grouping them by publication date and excluding rejected records. The October total was four times the 4,273 records counted for October 2025. From January through October, the report counts 89,859 records, compared with 39,639 in the same period a year earlier. Including rejected entries would raise October 2026’s total to 17,481, the report says.
Evidence of active exploitation rose more modestly. The report’s reading of the CISA Known Exploited Vulnerabilities catalog says 36 flaws were added in October, up from 31 in October 2025 and 17 in October 2024. CISA had added 282 vulnerabilities in the first ten months of 2026, already more than its 245 additions for all of 2025. These are catalog additions, not a count of every attack or every vulnerability being exploited.
For cryptocurrency losses, the report cites CertiK’s estimate of $3.47 billion in October losses after frozen and returned funds. That compares with $68 million in October 2025. It says Binance accounted for 96.7% of the October 2026 total. The FBI attributed the Binance theft to North Korea’s TraderTraitor on October 31, according to Meyer; the supplied material does not include the FBI’s underlying statement or a detailed account of the incident.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosures Outpaced Exploitation
The figures describe three different measures: public vulnerability disclosures, flaws added to a government list based on evidence of exploitation, and reported crypto losses. They should not be treated as interchangeable measures of cyber risk. A sharp increase in disclosed flaws does not, by itself, mean attackers exploited all or even most of them.
That distinction is central to the report’s assessment of AI. Meyer says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, including one flaw already exploited in the wild. He also says OpenAI’s Patch the Planet program produced the PHP2Shell flaws, which were patched on October 21. Those examples point to AI’s role in finding bugs, but do not establish that AI drove the month’s overall record or that AI-generated discoveries were routinely turned into attacks.
The potential consequences remain significant for defenders. The report says attackers can use AI to help turn public fixes into exploits within days, and that PHP2Shell’s embargo was broken before the patch release. Separately, the reported Binance loss illustrates the scale of financial harm that a single incident can represent. Meyer’s account says the theft began with a compromised laptop, not a flaw found by AI, which complicates any claim that AI explains the month’s losses.
Products Worth Considering
eufy Security E30 4K Indoor Camera, 2-Pack
Arlo Pro Wireless Security Camera, 2K HDR, 6th Generation, 4-Camera Kit
eufy Security SoloCam E42 4-Camera Kit, 4K Solar Security Cameras with HomeBase 3
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer’s report separates the month into three “ledgers.” A CVE record documents a publicly disclosed vulnerability; it does not establish that the flaw has been exploited. CISA’s KEV catalog tracks vulnerabilities for which the agency has reliable evidence of active exploitation. Crypto-loss estimates, meanwhile, track reported financial losses and may change when funds are frozen or returned.
The report says CVE counts vary according to counting rules. Its primary NVD total excludes rejected records, and it notes that CVE numbering authorities may reserve blocks of identifiers. The number of IDs alone is not a reliable measure of published flaws. It also cites Google Threat Intelligence Group’s warning that automated assignment policies affect totals: descriptions mentioning the Linux kernel produced about 5,000 CVEs from January through August 2026, with no zero-day exploitation observed for those entries, according to the report.
On AI-related research, Meyer says Google’s Big Sleep found more actionable bugs in Chrome’s JavaScript engine than Google’s own fuzzer over a six-month period. The source presents this as an example of AI-assisted vulnerability discovery, not proof that AI caused the broader October rise. It also cites a Google threat-intelligence assessment that exploitation rose roughly in step with disclosure over a longer period, with about one in 431 vulnerabilities disclosed in 2026 observed exploited. The supplied excerpt does not provide the full assessment or all its methods.
“For me, October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, author of the November 1 report
AI’s Role Remains Unproven
The figures do not establish that AI caused the record CVE count, the increase in exploited vulnerabilities, or the Binance theft. The report identifies examples of AI-linked research and says fixes can be turned into exploits quickly, but the supplied material does not quantify how many October attacks used AI or how many disclosures resulted from AI tools.
The crypto-loss figure is attributed to CertiK and is stated after frozen and returned funds; estimates may differ by methodology and can change as incidents are reviewed. The supplied source says the FBI attributed the Binance theft to North Korea’s TraderTraitor, but does not provide the FBI’s wording, the evidence behind that attribution, or a full incident timeline. Its claim that a compromised laptop was the starting point also comes from the report and is not independently detailed in the material provided.
The CVE totals depend on the report’s query date and inclusion rules. The source gives a November 1 NVD query and excludes rejected records, but does not include the underlying query results here. Comparisons with other databases or counting methods may produce different totals.
Further Data and Incident Details
Readers should look for updates to the NVD and CISA catalog, as additional records or exploitation evidence may change the October totals and subsequent comparisons. Further technical reporting on the Binance incident may clarify the theft’s mechanics, the role of the compromised laptop, and the basis for the FBI’s attribution.
For the AI question, the next useful evidence would be documented cases connecting AI tools to vulnerability discovery, exploit development, or attacks, with clear methods and timelines. Meyer’s report also points readers to an accompanying video, described as a five-minute presentation of the three ledgers and the author’s thesis; it says the narration uses an AI voice clone and the images are AI-generated.
Key Questions
What records did October 2026 set, according to the report?
The report counts 17,060 new NVD CVE records in October and cites $3.47 billion in crypto losses after frozen and returned funds. It describes the crypto figure as a CertiK estimate.
Did exploitation increase as quickly as vulnerability disclosures?
No, according to the figures in the report. October CVE records were four times the October 2025 total, while CISA’s KEV additions rose from 31 to 36. The measures track different things and should not be read as a direct count of all attacks.
Did AI cause the Binance theft?
The supplied report does not say that. It says the FBI attributed the theft to North Korea’s TraderTraitor group and says the incident began with a compromised laptop, rather than an AI-found bug.
What does the report say AI contributed to cybersecurity in October?
It says at least 65 entries in Microsoft’s October security release credited an AI model or an AI vulnerability research firm, and that OpenAI’s Patch the Planet program produced the PHP2Shell flaws. These examples do not establish AI’s share of all vulnerabilities or attacks that month.
Source: ThorstenMeyerAI.com
