Not everything stolen stays lost.
Some assets are frozen, intercepted or later recovered. An initial breach amount is not automatically a final economic loss.
INTELLIGENCE / ECONOMICS OF EXPOSURE
CASE 001 / BINANCE / 29 OCT 2026
What happens when
defenses fail.
Documented cyber incidents translated into financial exposure, operational consequences and security lessons. Every data point is labeled by what it actually measures.
$6.34B
BINANCE / 2026Gross digital-asset impact reported after a hot-wallet compromise, not the final net unrecovered loss.Read the company's November 3 update ↗
01 / VERIFIED INCIDENTSPUBLIC SOURCES / NOV 2026
The loss is
never just a number.
Direct theft, ransom, lost sales, diminished earnings, remediation costs and diverted funds are fundamentally different measures. This catalogue preserves that distinction and avoids combining them into an invented total.
DIRECT THEFT
Funds or digital assets removed without authorization.
RANSOM
Extortion payments; recovery and other impacts are separate.
PAYMENT DIVERSION
Fraudulent transfers initiated through manipulated approvals.
BUSINESS DISRUPTION
Revenue, earnings or recovery cost impacts.
02 / THE INCIDENT DATABASE
Explore the evidence.
Filter by risk mode or search an organization. Select any row to open an annotated incident dossier.
ORGANIZATION / INCIDENTFINANCIAL MEASUREMODEDETAIL
03 / HOW TO READ THE NUMBERSNO INFLATED TOTALS
Guidance is not a booked expense.
Estimated reductions in sales or operating income should be presented as projections when announced, not settled costs.
Revenue and profit tell different stories.
A company's lost sales estimate and its lost earnings estimate frequently describe the same disruption from different accounting perspectives.
REPLACE ASSUMPTIONS WITH EVIDENCE
Request an assessment ↗