In the first half of 2026, the crypto industry experienced a total of 182 publicly reported security incidents, resulting in losses of approximately $956 million. More concerning than the total loss amount is the direction of the funds: according to SlowMist's statistics, only 18 incidents out of those in the first half had stolen funds recovered or frozen, totaling about $118 million, which accounts for 12.3% of the total loss, while nearly 90% of the remaining stolen funds cannot be recovered.

Another number may be easily misinterpreted: the $956 million loss decreased by nearly 60% compared to the same period last year, but this does not mean that the industry has become safer. The decrease in losses was almost entirely due to the absence of last year's massive Bybit incident (about $1.5 billion), whereas the number of incidents actually increased by about 50% year-on-year. Attacks did not weaken but changed direction—from targeting protocol contracts to targeting people.

The two highest-value attacks in the first half did not involve breaching smart contracts: Drift Protocol was drained of about $285 million through a six-month-long social engineering infiltration that started with a few "unnoticeable" transactions signed by a multi-signature signer; a victim in Singapore was invited to a government high-level meeting that was entirely AI-generated, resulting in a loss of about 4.9 million Singapore dollars. The most expensive vulnerabilities are now found in people.

This is one of the core judgments released in the 2026 OKX Web3 Security Half-Year Report by the OKX Web3 Security Team in collaboration with SlowMist and OtterSec, which shares a common conclusion with the 2026 Half-Year Blockchain Security and Anti-Money Laundering Report published concurrently by SlowMist. The two reports come from a trading platform and a security company but point to the same judgment: the frequency of attacks is increasing, the methods are evolving, and the targets are shifting from "code" to "people."

Losses decreased by nearly 60% year-on-year, but attack activity increased instead

The same set of data can yield contradictory conclusions when segmented differently, which is a prerequisite for understanding the security situation over the past six months.

According to the OKX report, citing SlowMist's hacked archives statistics, there were 182 incidents in the first half causing losses of about $956 million; in the same period of 2025, there were 121 incidents and losses of approximately $2.373 billion. The number of incidents rose by about 50% year-on-year, while the amount decreased by about 60%. The primary reason for the drop in the amount is the extreme case of the Bybit incident of February 2025 (approximately $1.5 billion, where hackers compromised the computers of the developer of their signature tool Safe{Wallet} and tampered with the official website scripts). The OKX report concludes that once this outlier is excluded, the comparable losses for this year have not only not decreased but have increased.

The OKX report further splits the attack causes into two perspectives: by event count, contract and logical vulnerabilities remain the top causes, totaling 85 incidents; however, by loss amount, supply chain attacks lead with approximately $298 million, followed by contract vulnerabilities (about $152 million) and private key leaks (about $130 million). SlowMist summarizes this characteristic with eight words: events are decentralized, losses are concentrated. Among them, the truly fatal large losses are concentrated in key areas such as infrastructure, cross-chain, and supply chains. A notable imbalance is that although only 20 incidents occurred in cross-chain bridges over the entire half year, they accounted for approximately $346 million in losses.

Funds are no longer primarily leaking from contract vulnerabilities. The OKX report summarizes the changes in the past six months into three main lines: large losses increasingly occur outside contracts; ordinary users have become the primary targets of attacks; AI agents are shifting from tools to prey. Additionally, there are two ongoing clues: the infiltration of the development phase through supply chain poisoning, and the downstream laundering where all stolen funds ultimately flow. The following elaborates on each.

For project parties: the biggest losses occur in areas not covered by audits

The projects that suffered the worst losses in the first half were mostly not unaudited, but the vulnerabilities were precisely in areas outside the audit's scope: the signing process, cloud keys, verification nodes, and developer devices. Audits can verify the logic of contracts but cannot guarantee the safety of these operational segments.

KelpDAO: The breach was not of a contract but of the verification path. This is the largest single loss in the first half. According to OtterSec's review, the attacker polluted the internal RPC nodes of LayerZero while launching a DDoS attack against honest external nodes. Cross-chain messages should have been cross-validated by multiple independent nodes, but this bridge at the time used a "1-of-1" single validation node configuration. The only validation point received only forged data, eventually allowing a withdrawal supported by no real assets, with approximately 116,500 rsETH transferred out, of which about $75 million was frozen afterward. The single validation node, long regarded as a high-risk configuration, was only a theoretical warning during structural reviews, but after the KelpDAO incident, it became a real loss of nearly $300 million. SlowMist supplemented the destination of the stolen funds: LayerZero attributed the incident to the Lazarus sub-group TraderTraitor, and the stolen tokens were subsequently used as collateral to borrow about $236 million in real assets (WETH) on lending platforms like Aave, temporarily triggering a liquidity crisis in the DeFi market.

Drift: A six-month-long inducement to sign. Its mechanism is worth explaining: durable nonce serves as a "pre-signed transaction voucher that can be redeemed at any point in the future." The attacker, posing as a disguised quantitative institution and operating with over $1 million in real deposits, built trust over six months, inducing signers to pre-sign such management transactions. At the time of signing, no impact was discernible; when the project team subsequently adjusted the multi-signature threshold and opened a window lacking timelock (a sensitive operation requires a public delay before taking effect) protection, the attacker broadcast pre-obtained signed transactions, completing 31 withdrawals in 12 minutes and taking away more than half of the locked assets. The core lesson of this incident is that signing a transaction that "has no impact" at the moment does not mean it won't be redeemed in the future; blind signing, pre-signing, and unresolvable management transactions should all be regarded as high-risk operations.

A portrayal of single-point failures. Resolv Labs' AWS cloud key was stolen, allowing the attacker to mint about 80 million unbacked tokens; Step Finance was compromised through executive devices, and private keys were used to empty the treasury; Humanity Protocol faced developer devices infected with malware, leading to uncontrolled private keys. SlowMist mentioned that on-chain analyst ZachXBT tracked and discovered that the stolen funds showed signs of mixing with KelpDAO's stolen funds, fundamentally ruling out the possibility of internal collusion, again pointing to Lazarus.

The SlowMist report also documented a set of more foundational cases, taking attacks down to the cryptographic engineering implementation level. The common point among the three incidents is that the vulnerabilities were outside the usual coverage of code audits.

• Taiko (June 22, about $1.7 million): A signing private key was erroneously submitted to a public GitHub repository, allowing attackers to forge layer-two network state proofs and trick funds into being released, causing the TAIKO token to drop more than 20% in the short term.
• SecondFi / Formerly Yoroi (June 21–23, about $2.4 million): A missing necessary random masking step in the signature algorithm implementation resulted in an on-chain signature being able to reverse-engineer the complete private key, with 374 addresses being stolen. The defect stemmed from an unverified third-party component introduced two weeks before the incident.
• THORChain (May 15, about $10.7 million): The treasury private key was guarded collectively by multiple nodes (threshold signing); while this was intended so that no single node had complete control of the private key, a malicious node gradually collected key fragments during multiple rounds of normal signing, ultimately reconstructing the complete private key.

From cross-chain validation, cloud keys, to signature algorithms, these cases exhibit different forms of the same failure: as long as there is a node in the critical path that can independently decide the direction of funds, it will become the preferred target of attackers.

Based on this judgment, OKX not only validates "whether transactions are initiated by the user" in its signature risk control but also focuses on ensuring that users understand the consequences of transactions before signing. In contexts such as durable nonce and account ownership changes, OKX intercepted or alerted regarding over 4 million high-risk operations in the first half of the year, protecting a cumulative amount of about $526 million. Furthermore, it has parsed over 50,000 on-chain methods, translating hard-to-read calldata into "which assets this transaction will change and which permissions it will grant." It should be noted that such capabilities can only reduce rather than eliminate risks; trading platforms and wallet service providers themselves are the highest value attack targets. The 2025 Bybit incident stemmed from the compromise of a signing tool, and neither party can claim immunity.

User side: Attacks begin at the most familiar entrance

As the cost of attacking protocols rises, attackers turn to users. According to the OKX report, today's attack entry points often occur in scenarios where users are least vigilant: app stores, top search results, friend accounts, meeting software, and recruitment processes.

• Malicious browser extensions adopt a "local shell, cloud poisoning" model: the extension itself does not contain malicious logic and can pass through the static review of app stores; the actual phishing pages are delivered in real-time from remote servers and can change domain names at any time (SlowMist captured a similar extension impersonating TronLink in May). Once users input their mnemonic phrases on such pages, control over their assets transfers.
• Search ad poisoning is closer to day-to-day operations. In a recorded case by the OKX report, a user searched for development tools after purchasing a new computer, clicked on a paid ad at the top of the search results and executed a command on the terminal suggested by the page, which actually deployed a clipboard-hijacking Trojan; when the user later transferred about $20,000, the receiving address was automatically replaced. The difficulty in defending against such attacks lies in the fact that the victim merely performed "searching the official site, downloading tools, copying commands," all routine operations.
• Job interview scams follow the path of "reconnaissance—target profile—precision strike": attackers, posing as technical interviewers, request candidates to share their screens and open wallets to "confirm DeFi experience," while actually recording their wallet addresses, holdings, and commonly used protocols; subsequently, they forge airdrop pages based on protocols the victims have genuinely used and send customized phishing information. One case documented by the OKX report saw a victim losing about $88,000 because of this.

There are also two noteworthy new tactics. The first is faux "2FA security verification": attackers send emails using the wallet's official name, employing an impersonation domain that differs from the official domain by only one character, supplemented by countdowns to create a sense of urgency, luring users to input their mnemonic phrases "to complete verification." The second is business process fraud: using business scenarios like "external audit" or "token entitlement confirmation" as bait to deliver malicious attachments (one sample analyzed by SlowMist disguised a script as a document with a double extension), which, when opened, pretended to be a system update to steal passwords and subsequently request camera, screen recording, and keyboard listening permissions. The ultimate targets are often office terminals and cloud service permissions rather than personal wallets.

Regarding the former, both reports provide a consistent bottom-line warning:

Any page that requires inputting mnemonics for verification, authentication, recovery, or upgrading is a scam. Mnemonics are not verification codes but the very control over assets; no legitimate wallet would request mnemonics through a webpage.

Since many losses do not originate from on-chain transactions but rather from earlier malicious applications or phishing websites, OKX has shifted its defensive measures to devices and access points: its security scanning assistant has completed over 200,000 risk assessments, discovering over 60,000 high-risk applications; against phishing websites and malicious DApps, the cumulative shielding of over 7 million access to risky sites aims to intercept before users input mnemonics or connect wallets.

Furthermore, a significant portion of the risks has been embedded even earlier in the software supply chain before attackers reach users.

Supply chain: What is poisoned is not the software package but trust itself

The peculiarity of supply chain poisoning is that victims make no errors; they simply install a dependency, update a version, or access an official domain as usual. This is the chapter most elaborated upon in the SlowMist report, where three representative cases reflect the evolution of such attacks in breadth, depth, and height.

• Breadth: Shai-Hulud worm. In mid-May, one account released 637 malicious versions involving 317 package names in just 22 minutes, impacting popular components like echarts-for-react (over 3.8 million monthly downloads) and size-sensor (over 4.2 million monthly downloads). During installation, the malicious package triggered obfuscated payloads, systematically collecting sensitive information from AWS, GCP, Azure credentials, Kubernetes cluster keys, SSH private keys, and encrypting them for external transmission, while also containing a self-propagation module for worm-like distribution and preset persistence mechanisms targeting Claude Code and VS Code. Its targets no longer focused on a single software package but rather the permissions across the entire development pipeline.
• Depth: The layered transmission of trust. In March, the Python library LiteLLM, which had 97 million monthly downloads, was attacked. The attacker did not directly invade the library but first poisoned the security scanning tool Trivy, which the build process relied on, in order to steal the release key and push malicious versions. Developers trusted LiteLLM, LiteLLM trusted Trivy, and since Trivy was compromised, the security tool that should have been responsible for protection became part of the attack chain. The poisoning of the official CDN of Apifox detected by SlowMist that month was of a similar nature: attackers tampered with the official scripts to implant malicious code with a random timer, which would activate 30 minutes to three hours after installation, making it difficult for users to associate the abnormality with specific actions. This indicates that "official sources" no longer necessarily equate to "safety."
• Height: The attacker's "attack surface thinking." SlowMist's Chief Information Security Officer 23pds warned in April: the Lazarus sub-organization HexagonalRodent uses high-paying remote jobs as bait to lure developers into executing code with backdoors. According to the OKX report, this organization extensively leverages ChatGPT and Cursor to generate code and scripts to replicate company websites and executive identities, even using AI to "self-check" their malicious code to evade detection; in just one quarter, they stole wallet data from over 2,700 developer systems. Meanwhile, AI-generated code itself is producing new risks; according to the OKX report citing OtterSec data, Georgia Tech attributed 35 out of 74 CVEs in March to AI-generated code, and a scan targeting around 1,400 "spur-of-the-moment generated" applications discovered 2,038 severe vulnerabilities and over 400 exposed keys. "Functionality available" does not equal "production-ready."

Similar incidents include the sudden appearance of an anomalous version of node-ipc after 21 months without updates, and TrapDoor, which is cross-ecosystem coordinated poisoning. The common conclusion points to the fact that past protective measures focused on auditing code, but now auditing the sources of trust is necessary. This is particularly crucial for the Agent ecosystem, where Agents will actively read, install, and execute external plugins. Based on this, OKX has established an admission review and regular inspection mechanism for the plugin integration in Agentic Wallet, covering code security, permission scopes, and external dependencies, shifting the judgment of "whether the dependencies are trustworthy" to before plugins go live.

AI: From forging single pieces of content to synthesizing entire environments

Connecting the preceding content, we can see an underlying mainline: There is an inherent trust in "smarter systems." The increasing collective misconception forming now is: Agents are more reliable than humans. This understanding has not yet been sufficiently corrected by enough incidents, but the costs have already emerged.

The Bankr incident in May is an almost non-"invasive" case: the attacker did not steal private keys, did not attack contracts, nor breached servers, but merely asked Grok to translate a Morse code segment. BankrBot is an AI agent deployed on the X platform that can automatically execute on-chain transactions based on natural language instructions. According to SlowMist's retrospective, the attacker first airdropped a membership NFT to the associated wallet, triggering its high-privilege mode, then sent a Morse code message for Grok to translate; after Grok completed the decoding and addressed @BankrBot, the hidden transfer instruction (approximately 3 billion DRB tokens) was output in plaintext, and BankrBot executed it as a trusted instruction. The loss was around $150,000 to $200,000 (SlowMist recorded it as approximately $175,000), and about 80% was recovered afterward. Neither Grok nor BankrBot has traditional vulnerabilities; what truly failed was the unverified trust boundary between the two automated systems. When Agents possess the capability for signing and transferring, a malicious instruction disguised as normal input can translate into a real asset loss.

SlowMist categorizes attacks targeting Agents into four layers based on the chain from cognition to execution, each with corresponding real cases:

• Input layer: Indirect prompt injection. Injecting malicious instructions into external content that Agents will read actively; the Bankr incident is an example of this.
• Memory layer: Memory contamination. Validation by Palo Alto Networks Unit 42 shows that malicious rules can be written into an Agent's long-term memory (such as marking the attacker's address as a "common payment address") and continuously be valid in subsequent sessions.
• Tool layer: Permission penetration. In the OpenClaw "Claw Chain" incident disclosed in May, security company Cyera discovered four interconnected exploitable vulnerabilities (highest critical rating CVSS 9.6) that could be chained to gain complete control over the execution environment.
• Supply chain layer: The OpenClaw plugin center lacked review, and a malicious skill disguised itself as a functional description document, hiding commands in code and employing a "two-stage" process to dynamically pull the real malicious payload from a remote source.

AI's deeper transformation of phishing scenarios is upgrading fraud from "forging single pieces of content" to operating an entire set of "synthesized realities." According to the OKX report, relaying information from Check Point's revealed "Truman Show" operation, attackers induced victims into a private investment group where the "experts" and "investors" were all portrayed by AI, continually providing analysis, showcasing returns, and interacting in real-time; the victims faced not just an isolated fraudster but a fabricated environment with a complete social and trust structure. The case mentioned at the beginning of this article concerning the AI-generated video conference in Singapore (with AI-generated Prime Minister, President, and representatives from the financial management bureau all present, resulting in a loss of about 4.9 million Singapore dollars) is an extreme manifestation of this same technique.

Thus, the attack target has fundamentally changed: what needs to be deceived is no longer the user's judgment of a single piece of information but their perception of the entire environment's authenticity. The judgment that "vulnerabilities appear in people" should also be extended further; when machines begin to replace humans in making judgments, the risk boundaries expand from "people" to all segments that are default trusted, including the trust boundaries between machines. Traditional defenses centered on "identifying suspicious information" are proving ineffective.

In terms of response, the industry has formed a consensus: Agents can organize transactions more intelligently, but their execution phases must be subject to stricter constraints. SlowMist embeds security capabilities into the operation processes of Agents; its MistEye Security Gate provides "detection first, execution later" hard-block mechanisms for coding agents like Claude Code and Cursor, while MistTrack Skills relies on over 400 million on-chain address tags covering 19 mainstream public chains to complete anti-money laundering risk screenings before transfers. OKX's approach is similarly to not fully rely on Agents' own judgments for security: regardless of how a transaction is generated, it undergoes independent risk testing before signing and broadcasting, and once a risk is identified, it requires secondary confirmation or direct interception.

Six, Fund Direction: Only about 12% recoverable, money laundering has become highly industrialized

Returning to the numbers mentioned at the beginning. This chapter's anti-money laundering and regulatory data primarily comes from SlowMist's tracking: there were only 18 incidents in the first half that resulted in recoverable or frozen funds, involving about $389 million stolen, with $118 million recovered or frozen, accounting for 12.3% of total losses. The vast majority of stolen funds are difficult to recover once transferred out, mainly because their downstream laundering processes have become highly industrialized.

Taking Lazarus as an example, its money laundering chain is interconnected: first, it cuts on-chain associations through privacy protocols like Umbra, then exchanges the funds into Bitcoin through non-identity verification cross-chain protocols like THORChain (which is liquid and easy to split), and subsequently distributes the funds to thousands of new addresses, processing them through mixing services like Sinbad, YoMix, and Wasabi, ultimately exchanging them offshore for fiat currency through Chinese OTC desks or Russian exchanges (such as Garantex and its successor Grinex). If the stolen assets are tokens like rsETH, they will first be mortgaged within DeFi protocols to borrow real assets before being exchanged; the stolen funds from KelpDAO followed this path. Once money enters the cross-chain and mixing processes, the windows for recovery are essentially closed.

The inflow of funds into privacy protocols serves as a side corroboration: according to SlowMist's statistics based on Dune, main privacy protocols saw an inflow of about $974 million in the first half, with Tornado Cash accounting for around 71%, Railgun for about 23% with nearly 90% of its inflow being stablecoins. The other side of illicit activities reflects the "service-ization" of tools: within SlowMist's tracked drain-as-a-service platforms, Rublevka Team has stolen over $10 million since 2023, successfully executing at least 240,000 thefts, offering up to 80% share to affiliates; StepDrainer lists a full stack of phishing tools, with the complete source code priced at about $750. The threshold for obtaining attack tools has now dropped to a very low level.

Regulatory constraints are also tightening and beginning to precisely target key nodes in the money laundering pathways. In SlowMist's overview of dynamics, three key actions directly impact the aforementioned networks: the 20th round of EU sanctions against Russia comprehensively prohibits transactions with Russian-based crypto service providers, directly targeting payout channels like Garantex and Grinex; Dubai's DIFC entirely prohibits the trading of privacy coins, addressing the mixing phase; in February, eight departments in China established new regulations explicitly stating that stablecoins pegged to the RMB may not be issued overseas without approval. Other measures are similarly advancing, such as Hong Kong issuing the first batch of stablecoin issuer licenses, South Korea planning to impose fines of up to 10% of the stolen amount on exchanges attacked by hackers, and the U.S. GENIUS Act becoming the first stablecoin regulation. The starting point of the money laundering chain is often a malicious address or a risky authorization. The OKX report also emphasizes that its KYS risk capability will continuously identify abnormal addresses, malicious tokens, and high-risk authorizations, striving to mark risks before funds enter mixing and cross-chain paths.

Seven, Conclusion: Moving the defensive line before confirmation

At the moment Drift signers press the confirm button, all defenses lose their significance. Most lessons from the first half of 2026 occurred before the action of "confirmation": someone signed a transaction they did not understand, a system granted excessive permissions, a team trusted incorrect data sources, and a user believed in sufficiently convincing impersonations.

Whether it is OKX's "understand before signing, avoid single point risks, verify first then trust" or SlowMist's overarching "verify first, trust later" philosophy, they ultimately point in the same direction: moving judgment before actions occur. Based on this, three outlines can be summarized.

For project parties: Key transactions should not only confirm "who signed" but also ensure "whether the signer understands the consequences." Multi-signature, contract upgrades, owner changes, cross-chain configurations, etc., should have processes that are interpretable, simulatable, and verifiable; significant fund outflows and permission changes should set timelocks and abnormal alerts. No single link should independently decide the direction of funds, for example, an RPC, a validation node, a cloud key, or an administrator address. Dependency scanning should be incorporated into regular processes; requests involving funds, authorizations, and deployments should not be validated through a single channel—video meetings and friend accounts do not constitute proof of identity.

For ordinary users: Transactions that cannot be understood should not be signed. Large assets should be stored separately from daily interaction wallets, and seldom-used authorizations should be revoked regularly, especially for unlimited authorizations and Permit/Permit2 operations; most attacks do not immediately transfer assets, but first obtain authorizations and then act on it. Any request asking for mnemonics is a scam; any request for remote control, screen sharing, installation of unfamiliar meeting software, or execution of terminal commands should first be verified.

For Agent users and developers: Input filtering, tool calling sandbox, permission grading, secondary confirmation of sensitive operations, and verification before execution are basic configurations for any Agent that holds funds, not optional. System prompts should not be viewed as security control measures; Agents should be responsible for generating plans, while an uncompromising rules system should be responsible for authorizations.

The first half of 2026 did not represent an overall improvement in security situations but rather a systematic shift in the attack paradigm, moving from contract codes to the people, infrastructure, and trust beyond the code itself. In an era where synthesized realities become possible, the focus of validation shifts from a piece of information to the environment itself. The goal of security should never be to require every participant to become an expert but rather to intercept risks at the most error-prone links before confirmation.

The most urgent repair needed in the first half of 2026 is not a single contract but the people and processes themselves.