In the first half of 2026, the crypto industry experienced a total of 182 publicly disclosed security incidents, resulting in approximately $956 million in losses. More concerning than the total amount lost is the destination of the funds: according to SlowMist's statistics, in the first half of the year, only 18 incidents were able to recover or freeze stolen funds, totaling around $118 million, accounting for 12.3% of the total losses. The remaining nearly 90% of the stolen funds are irretrievable.

Another easily misleading figure is the $956 million, which represents a nearly 60% decrease from the same period last year. However, this does not indicate an improvement in the industry's security. The decrease in losses is mainly due to the absence of a repeat of last year's singular large-scale event involving Bybit (around $1.5 billion); in fact, the number of incidents has increased by approximately 50% year-on-year. The attacks have not diminished but rather shifted focus from protocol contracts to individuals.

The two most costly attacks in the first half of the year did not involve exploiting smart contracts: Drift Protocol fell victim to a six-month-long social engineering attack that siphoned approximately $285 million, starting with a few "seemingly innocuous" transactions signed by a multi-signer; a Singaporean individual was lured into a government official-led AI-generated video conference, resulting in a loss of around 4.9 million SGD. The most expensive vulnerabilities were found in people.

This is one of the key findings of the "2026 OKX Web3 Security Half-Yearly Report" jointly released by the OKX Web3 Security Team, SlowMist, and OtterSec, in alignment with the "2026 H1 Blockchain Security and Anti-Money Laundering Report" released by SlowMist during the same period. Although originating from a cryptocurrency exchange and a security firm, both reports arrived at a shared conclusion: the frequency of attacks is rising, techniques are evolving, and the focus is shifting from "code" to "people."

A Nearly 60% Year-on-Year Decrease in Losses, Yet Cyberattack Activity Is On the Rise

Interpreting the security landscape of the past six months hinges on understanding this premise: the same dataset, viewed from different perspectives, yields contradictory conclusions.

According to the OKX report citing data from SlowMist's black-hat archive, there were 182 incidents in the first half of the year, resulting in approximately $956 million in losses; for the same period in 2025, there were 121 incidents totaling around $2.373 billion in losses. The number of incidents increased by approximately 50%, while the amount decreased by about 60% year-on-year. The primary reason for the decrease in the total amount lost was the extreme case of the Bybit incident in February 2025 (around $1.5 billion, where hackers compromised the developer's computer of their signature tool, Safe{Wallet}, and tampered with the official website script). The OKX report's assessment is that excluding this outlier, this year's comparable losses have not decreased but instead risen.

The OKX report further split the attacks into two categories: by the number of incidents, smart contract and logic bugs remain the top cause, totaling 85 cases; but by the amount of losses, supply chain attacks lead with around $298 million, followed by contract bugs (around $152 million) and private key leaks (around $130 million). SlowMist summarized this characteristic in eight words: decentralized incidents, centralized losses. Among them, the truly fatal large losses are concentrated in key areas such as infrastructure, cross-chain, and supply chain. An unsettling footnote is that cross-chain bridges experienced only 20 incidents in the entire first half of the year, yet resulted in approximately $346 million in losses.

Funds are no longer primarily lost through smart contract bugs. The OKX report summarized the changes in the past six months into three main trends: increasing large losses occurring outside of contracts; ordinary users becoming the main targets of attacks; and AI Agent shifting from a tool to a prey. Additionally, there are two consistent threads throughout: the infiltration of the development process through supply chain poisoning, and the money laundering downstream where all stolen funds ultimately converge. These will be elaborated below.

Project Teams: The Biggest Losses Occur in Unaudited Areas

The projects that suffered the most severe losses in the first half of the year were mostly not unaudited, but the breach points were precisely beyond the scope of the audits: signature flows, cloud keys, validation nodes, developer devices. Audits can prove the correctness of contract logic but cannot demonstrate the security of these operational aspects.

KelpDAO: The breach did not occur in the smart contract but in the validation path. This was the largest single loss in the first half of the year. According to OtterSec's retrospective, the attacker contaminated the LayerZero internal RPC node while launching a DDoS attack against honest external nodes. Cross-chain messages were supposed to be cross-validated by multiple independent nodes, but the bridge was using a "1-of-1" single validation node configuration at the time. The sole validation point received only falsified data, eventually releasing a withdrawal with no real asset backing, allowing approximately 116,500 rsETH tokens to be transferred out, of which around $75 million was later frozen. The single validation node had long been considered a high-risk configuration, previously just a theoretical suggestion in architectural reviews. After the KelpDAO incident, it turned into a nearly $300 million real loss. SlowMist added insight into the stolen funds: LayerZero attributed the incident to the Lazarus sub-group TraderTraitor, and the stolen tokens were subsequently used as collateral to borrow around $236 million worth of real assets (WETH) on lending platforms like Aave, at one point triggering a liquidity crisis in the DeFi market.

Drift: A six-month-long Signature Induction Attack. The mechanism is worth explaining: a durable nonce is equivalent to a "pre-signed, redeemable at any future time" transaction voucher. The attacker, disguised as a quant institution, operated with over $1 million in real deposits for six months, inducing the signer to pre-sign such management transactions. At the time of signing, there seemed to be no immediate effect; however, when the project later adjusted the multi-signature threshold and introduced a window without timelock protection, the attacker broadcasted the pre-signed transactions obtained in advance, completing 31 withdrawals within 12 minutes, siphoning off over half of the locked assets. The core lesson of this event is that a transaction signed at the moment with "no impact" does not mean it will not be redeemed in the future; blind signing, pre-signing, and opaque management transactions should all be considered high-risk operations.

The Domino Effect of Single Point Failures. Resolv Labs had its AWS cloud key stolen, leading to the minting of approximately 80 million untethered tokens; Step Finance suffered a breach of executive devices, where private keys were used to drain the treasury; Humanity Protocol had developer devices infected with malware, leading to key compromise. SlowMist mentioned that on-chain analyst ZachXBT's tracking revealed mixing of the stolen funds with KelpDAO, essentially ruling out internal collusion, once again pointing to Lazarus.

The SlowMist report also documented a set of more foundational cases, digging the attacks down to the cryptographic engineering implementation layer. The commonality among the three incidents was that the vulnerabilities were outside the usual scope of code audits.

• Taiko (June 22, about $1.7 million): A signing key was mistakenly committed to a public GitHub repository, allowing the attacker to forge a Layer 2 network state proof and deceive fund release, causing the TAIKO token to plummet over 20% in the short term.

• SecondFi / Formerly Yoroi (June 21–23, about $2.4 million): The signature algorithm implementation lacked a necessary random blinding step, enabling the complete private key to be reverse-engineered from a single on-chain signature, resulting in 374 addresses being drained. The flaw stemmed from an unaudited third-party component introduced two weeks before the incident.

• THORChain (May 15, about $10.7 million): The treasury private key was collectively managed by multiple nodes (threshold signature), intended for no single node to possess the complete key; however, a malicious node gradually collected key fragments over multiple normal signing rounds, ultimately reconstructing the full private key.

From cross-chain validation and cloud key management to signature algorithms, these cases showcase different manifestations of the same kind of failure: as long as there is a node on a critical path that can independently determine the fund flow, it will become the attacker's prime target.

Based on the same judgment, OKX not only verifies "whether the transaction is initiated by the user" in signature risk control, but also focuses on enabling users to understand the consequences of the transaction before signing. Around high-risk scenarios such as durable nonce and account ownership changes, OKX intercepted or alerted related high-risk operations over 4 million times in the first half of the year, protecting a cumulative amount of approximately $526 million. OKX has analyzed over 50,000 on-chain methods, translating incomprehensible calldata into "which assets will be affected by this transaction and what permissions will be granted." It should be noted that this capability can only reduce but not eliminate risks. Both the exchange platforms and wallet service providers themselves are prime targets for attacks. The 2025 Bybit incident was a result of a breach in the signature tool, proving that no party can claim to be immune.

User Side: Attacks Begin at the Most Familiar Entry Point

As the cost of protocol attacks rises, attackers have turned to users. According to the OKX report, the current attack entry points are mostly scenarios where users are least vigilant: app stores, top search results, friend accounts, video conferencing software, and recruitment processes.

• Malicious browser extensions use a "local shellholding, cloud-based poisoning" model: The extension itself does not contain malicious logic and can pass static reviews in the app store. However, the actual phishing page is dynamically delivered by a remote server and can change domains at any time (a case similar to the imitation of TronLink extension was captured by SlowMist in May). Once users enter their mnemonic phrase on such a page, control of their assets is compromised.

• Search ad poisoning is more aligned with everyday operations. In a case documented in the OKX report, a user who had purchased a new computer searched for development tools, clicked on the top-paid ad in the search results, followed a prompt on the page to execute an "installation command" in the terminal, which actually deployed a clipboard hijacking trojan. When the user later attempted to transfer around $20,000, the receiving address was automatically replaced. The challenge of defending against such attacks lies in the fact that the victim only went through routine operations like "searching on the official website, downloading a tool, copying a command," throughout.

• Recruitment interview scams follow a path of "reconnaissance - profiling - targeted attack": Attackers, under the guise of a technical interview, request applicants to share their screens and open their wallets to "confirm DeFi usage experience," actually recording their wallet addresses, holdings, and commonly used protocols. Subsequently, they forge airdrop pages based on the protocols the victim has genuinely used and deliver customized phishing information. In a case noted in the OKX report, a victim lost approximately $88,000 due to this.

Two other emerging tactics are worth noting. First is the fake "2FA security verification": Attackers send emails in the wallet's official name using a spoofed domain name that differs by only one character from the official one, creating a sense of urgency with a countdown timer to induce users to enter their mnemonic phrase to "complete the verification." The second is business process fraud: Using business scenarios such as "external audit" and "token ownership confirmation" as bait to deliver malicious attachments (one sample analyzed by SlowMist disguised a script as a document with a double extension), which when opened, masquerade as system updates to steal passwords. They then request camera, screen recording, and keyboard monitoring permissions. The ultimate target is often office terminals and cloud service permissions, rather than personal wallets.

The two reports regarding the former came to a consistent conclusion:

Any page requesting your recovery phrase for verification, authentication, recovery, or upgrade is a scam. The recovery phrase is not a verification code but rather the key to your assets. No legitimate wallet will ask for your recovery phrase via a webpage.

Due to a significant number of losses originating not from on-chain transactions but from earlier malicious applications or phishing websites, OKX has shifted its defense to devices and access points: its Security Scan Assistant has completed over 200,000 risk assessments, detecting over 60,000 high-risk applications. For phishing websites and malicious DApps, over 7 million risky website visits have been intercepted, aiming to block any attempts before users input their recovery phrase or connect their wallets.

Prior to attackers contacting users, a considerable amount of risk has already been embedded in more upstream processes—the software supply chain.

Supply Chain: It's Trust Itself That's Been Poisoned

The particularity of a supply chain attack lies in this: victims have committed no mistakes but simply installed a dependency, updated a version, or visited an official domain. This is the focal point of the SlowMist report, with three illustrative cases demonstrating the breadth, depth, and sophistication of such attacks.

• Breadth: The Shai-Hulud worm. In mid-May, an account released 637 malicious versions involving 317 package names within 22 minutes, impacting popular components such as echarts-for-react (with a monthly download volume of over 3.8 million) and size-sensor (with a monthly download volume of over 4.2 million). During the installation process of the malicious packages, an obfuscated payload is triggered, systematically collecting various sensitive information such as AWS, GCP, Azure credentials, Kubernetes cluster keys, SSH private keys, and encrypting them for exfiltration. Additionally, a self-propagation module is integrated to achieve worm-like spread, along with preset persistence mechanisms targeting Claude Code and VS Code. The objective no longer focuses on a single package but rather the entire development pipeline's privileges.

• Depth: The layered transmission of trust. In March, LiteLLM, a Python library with a monthly download volume of 97 million, suffered an attack. The attacker did not directly compromise the library but first poisoned the security scanning tool Trivy, which the library's build process relied on, in order to steal the release key and push malicious versions. Developers trust LiteLLM, LiteLLM trusts Trivy, and Trivy has been compromised, turning a security tool that should bear protective responsibilities into a link in the attack chain. A similar incident occurred in the same month with the poisoning of the Apifox official CDN by SlowMist: attackers tampered with official scripts, injected malicious code with a random timer, causing the malicious actions to trigger half an hour to three hours after installation, making it difficult for users to associate the anomalies with specific operations. This indicates that "official sources" are no longer synonymous with "secure."

• Height: The attacker's "attack surface mindset". SlowMist's Chief Information Security Officer 23pds issued a warning in April: The Lazarus sub-group HexagonalRodent used high-paying remote positions as bait to induce developers to run code containing backdoors. According to an OKX report, the organization extensively utilized ChatGPT, Cursor-generated code and dialogues to generate code using AI website building tools to forge company websites and executive identities, even using AI to "self-audit" their own malicious code to evade detection; in just one quarter, they stole wallet data from over 2,700 developer systems. Meanwhile, the AI-generated code itself has introduced new risks, with the OKX report citing OtterSec data: Georgia Tech attributed 35 out of 74 CVEs in March to AI-generated code, and a scan targeting around 1,400 "quick-generated" apps discovered 2,038 severe vulnerabilities and over 400 exposed keys. "Feature-ready" does not equate to "production-ready."

Similar events include the sudden appearance of abnormal versions of node-ipc after 21 months of inactivity, and the TrapDoor poisoning coordinated across three major ecosystems. All point to one conclusion: while the past focus of defense was on auditing code, now the focus must be on auditing trusted sources. This is particularly crucial for the Agent ecosystem, where Agents actively read, install, and execute external plugins. Based on this, OKX has established an admission review and regular inspection mechanism covering code security, permission scope, and external dependencies for plugin integration in the Agentic Wallet, shifting the judgment of "trustworthiness of dependencies" to before plugin deployment.

AI: From Faking a Single Piece of Content to Synthesizing an Entire Environment

Tying the previous content together, we can see an implicit main thread: there is a natural trust in "smarter systems" from the outside world. The next collective misjudgment that is forming is: Agents are more reliable than humans. This perception has not been corrected by a sufficient number of incidents yet, but the cost has already become evident.

The Bankr event in May was a case that was almost unlike an "intrusion": the attacker did not steal private keys, did not attack contracts, did not invade servers, but simply asked Grok to translate a Morse code message. BankrBot is an AI Agent deployed on the X platform that can automatically execute on-chain transactions based on natural language commands. According to SlowMist's retrospective, the attacker first airdropped a membership NFT to a linked wallet to trigger its high permission mode, then sent a Morse code message to Grok for translation; after Grok decoded it, the attacker tagged @BankrBot, including a hidden transfer instruction (approximately 3 billion DRB tokens) in the plaintext output. BankrBot considered this a trusted instruction and executed it directly. The loss was around $150,000 to $200,000 (SlowMist reported it as approximately $175,000), with about 80% being recovered afterwards. Neither Grok nor BankrBot had traditional vulnerabilities; the real failure was the unverified trust boundary between two automated systems. When an Agent has signing and transfer capabilities, a malicious instruction disguised as normal input can easily transform into a real asset loss.

SlowMist categorizes attacks against the Agent into four layers based on the chain of events from awareness to execution, with each layer having a corresponding real-world example:

• Input Layer: Indirect Hint Injection. This involves embedding malicious instructions into external content that the Agent will actively read, with the Bankr incident being a prime example.

• Memory Layer: Memory Corruption. Validation by Palo Alto Networks Unit 42 demonstrated that malicious rules can be written into the Agent's long-term memory (such as tagging the attacker's address as a "common receiving address") and persist across subsequent sessions.

• Tool Layer: Permission Elevation. In the OpenClaw "Claw Chain" incident disclosed in May, security firm Cyera discovered four sequentially exploitable vulnerabilities (with a maximum CVSS severity rating of 9.6), which could be chained together to achieve full control over the execution environment.

• Supply Chain Layer: Lack of audit in the OpenClaw Plugin Center, where malicious skills masquerade as feature documentation, hide commands in encoding, and employ a "two-stage" approach to dynamically fetch the actual malicious payload remotely.

AI's deeper transformation of the phishing landscape involves evolving fraud from "forging a single piece of content" to running an entire "synthetic reality" operation. Citing a report from OKX on Check Point's disclosure of "Operation Truman Show," attackers lead victims into a private investment group where both the "experts" and "investors" in the group are AI-driven, continuously providing analysis, showcasing returns, and engaging in real-time interactions. Victims are not facing individual scammers but rather an artificial environment with a complete social and trust structure. The Singaporean video conference case mentioned at the beginning of this article (involving an AI-generated Prime Minister, President, and Monetary Authority representative present, with losses amounting to approximately 4.9 million SGD) represents an extreme form of the same tactic.

As a result, the attack target has fundamentally shifted: the deception target is no longer the user's judgment of a single piece of information but rather their perception of the overall environment's authenticity. The assessment that "vulnerabilities exist in humans" should also be further extended, as when machines begin to make judgments in place of humans, the risk boundary extends from "humans" to all aspects of trust by default, including trust boundaries between machines. Traditional "identify suspicious information" defense mechanisms are becoming ineffective.

In response, the industry has reached a consensus: while the Agent can intelligently organize transactions, its execution phase must be subject to stricter constraints. SlowMist embeds security capabilities into the Agent's operation flow, with its MistEye Security Gate providing a "detect first, execute later" hard-blocking mechanism for coding agents like Claude Code and Cursor, and MistTrack Skills leveraging over 400 million on-chain address tags across 19 mainstream blockchains to conduct anti-money laundering risk screening before transfers. OKX's approach similarly does not solely rely on the Agent's own judgment for security: regardless of how transactions are generated, an independent risk assessment is conducted before signature and broadcast, prompting a second confirmation or direct interception upon risk detection.

Funds Flow: Only About 12% Recoverable, Money Laundering Highly Industrialized

Going back to the initial numbers. The anti-money laundering and regulatory data in this chapter mainly come from the SlowMist report: in the first half of the year, there were only 18 events where funds could be recovered or frozen, involving approximately $389 million stolen, of which about $118 million was recovered or frozen, accounting for 12.3% of the total loss. The vast majority of stolen funds are difficult to recover once they have been transferred out, primarily because the downstream money laundering process has become highly industrialized.

Take Lazarus as an example, its money laundering chain is intricate: first, it severs on-chain links through privacy protocols like Umbra, then exchanges the funds into Bitcoin through non-KYC cross-chain protocols like THORChain (with abundant liquidity and easy to split), afterwards disperses the funds to thousands of new addresses, processes them through coin mixing services like Sinbad, YoMix, Wasabi, and finally converts them offshore into fiat currency through Chinese OTC desks or Russian exchange networks (such as Garantex and its successor Grinex). If the stolen assets are tokens like rsETH, they would first be used as collateral in DeFi protocols to borrow real assets before conversion. The KelpDAO funds followed this path. Once funds enter the cross-chain and coin mixing stages, the window for recovery is essentially closed.

The inflow of funds through privacy protocols serves as indirect evidence: according to SlowMist's statistics based on Dune, the cumulative inflow of major privacy protocols in the first half of the year was approximately $974 million, with Tornado Cash accounting for about 71%, Railgun about 23%, and nearly 90% of the inflow being stablecoins. The other end of the dark industry is reflected in the "service-ification" of tools: in SlowMist's tracking of coin theft as a service platforms, the Rublevka Team has stolen over $10 million since 2023, completed at least 240,000 successful skimming operations, and offers its associates up to 80% of the proceeds; StepDrainer prices the entire phishing toolkit openly, with the full source code priced at around $750. The barrier to acquiring attack tools has been significantly lowered.

Regulatory constraints are also tightening, now aiming precisely at key nodes in the money laundering channels. Three measures directly affecting the aforementioned chain include: in the EU's 20th round of Russia sanctions, it fully prohibits transactions with Russian domestic crypto service providers, directly targeting off-ramps like Garantex and Grinex; Dubai's DIFC completely bans privacy coin transactions, focusing on the coin mixing stage; China's eight ministries' new rules in February explicitly state that stablecoins pegged to the Renminbi cannot be issued overseas without approval. Other measures are moving in the same direction, with Hong Kong issuing the first batch of stablecoin issuer licenses, South Korea planning to impose fines of up to 10% of the stolen amount on exchanges hacked by cybercriminals, and the U.S. GENIUS Act implementing the first stablecoin regulations. The starting point of a money laundering chain is often a malicious address or a high-risk authorization, as emphasized in the OKX report, which continuously identifies abnormal addresses, malicious tokens, and high-risk authorizations through its KYC risk capabilities, striving to flag risks before funds enter coin mixing and cross-chain channels.

Epilogue: Moving the Defense Line to Pre-Confirmation

At the moment the Drift signatories press the confirm button, all defense has lost its meaning. Most of the lessons learned in the first half of 2026 happened before the "confirmation" action: someone signed a transaction they did not understand, a system granted excessive permissions, a team trusted the wrong data source, a user believed a sufficiently realistic impersonation.

Whether it is OKX's proposal of "Understand Before Signing, Avoid Single Point of Failure, Verify Before Trust" or Slow Mist's pervasive "Verify First, Trust Later" approach, they all ultimately point in the same direction: moving judgment before the action occurs. This can be summarized into three checklists.

For projects: Critical transactions should not only confirm "who signs," but also confirm "whether the signer understands the consequences." Operations such as multi-signature, contract upgrades, owner changes, cross-chain configurations should have processes that are interpretable, simulatable, and auditable; large fund outflows and permission changes should have timelocks and anomaly alerts in place. No single link should independently determine the destination of funds, such as an RPC, a validation node, a cloud key, or an admin address. Dependency scanning should be part of standard procedures; requests involving funds, permissions, and deployments should not be confirmed through a single channel only, and video conferences and friend accounts do not constitute identity verification.

For regular users: Transactions that are not understood should not be signed. Large assets and daily interaction wallets should be stored separately, infrequently used authorizations should be regularly revoked, extreme caution should be exercised with unlimited authorization, Permit/Permit2 operations, etc., as most attacks do not immediately transfer assets but first obtain authorization and then act when the opportunity arises. Any page requesting a mnemonic phrase is fraudulent; any request for remote control, screen sharing, installation of unfamiliar meeting software, or execution of terminal commands should be verified first.

For Agent users and developers: Input filtering, tool invocation sandbox, hierarchical permissions, secondary confirmation of sensitive operations, and pre-execution verification are basic configurations for any Agent holding funds, not optional. System prompt words should not be used as security controls; solution generation should be the responsibility of the Agent, with non-negotiable rule systems responsible for authorization.

The first half of 2026 is not a complete improvement in the overall security situation, but a systematic migration of the attack paradigm from contract code to individuals outside the code, infrastructure, and trust itself. In an era where synthetic reality becomes possible, what needs to be verified is no longer a single piece of information but the environment itself. The goal of security is not to require every participant to become an expert, but to intercept risk at the most error-prone point before confirmation.

In the first half of 2026, what most needs fixing is not a particular contract, but the people and processes themselves.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia