In an era where AI-generated reality is possible, what needs to be verified is no longer a specific piece of information, but the environment itself.
In the first half of 2026, there were a total of 182 public security incidents in the cryptocurrency industry, resulting in losses of approximately $956 million. More concerning than the total losses is the direction of the funds: According to SlowMist statistics, only 18 incidents of stolen funds were recovered or frozen, amounting to about $118 million, accounting for 12.3% of total losses, while nearly ninety percent of the stolen funds could not be recovered.
Another figure is easily misread: the $956 million loss decreased by nearly sixty percent compared to the same period last year, but this does not mean the industry has become safer. The drop in losses was almost entirely due to last year's Bybit single catastrophic incident (approximately $1.5 billion) not being repeated; the actual number of incidents increased by about 50% year-on-year. Attacks have not weakened but have changed direction—from targeting protocol contracts to targeting individuals.
The two highest losses in the first half of the year did not stem from breaking into smart contracts: Drift Protocol lost about $285 million in a social engineering infiltration that lasted six months, starting from a few “unimpactful” transactions signed by a multi-signature signer; a victim in Singapore was invited to a government video conference where all officials were AI-generated, losing approximately 4.9 million Singapore dollars. The most expensive vulnerabilities appeared in personal interactions.
This is one of the core judgments from the "2026 OKX Web3 Security Half-Year Report" published by the OKX Web3 security team in collaboration with SlowMist and OtterSec, echoing similar conclusions in SlowMist's "2026 First Half Blockchain Security and Anti-Money Laundering Report." Although the two reports come from a trading platform and a security company respectively, they point to the same conclusion: the frequency of attacks is increasing, tactics are evolving, and the focus is shifting from "code" to "people."
Losses down nearly sixty percent year-on-year, but attack activities are on the rise
The same set of data, sliced with different metrics, can yield opposite conclusions, which is a precondition for understanding the security landscape of the past six months.
According to the OKX report citing statistics from SlowMist's black archives, in the first half of the year, there were 182 incidents resulting in losses of about $956 million; in the same period of 2025, there were 121 incidents, amounting to approximately $2.373 billion. The number of incidents increased by about 50% year-on-year, while the amount decreased by about 60% year-on-year. The main reason for the drop in amounts is due to the extreme nature of the February 2025 Bybit incident (approximately $1.5 billion, where hackers compromised the computer of Safe{Wallet} developers, altering the official website's scripts). The OKX report concludes that excluding this anomaly, comparable losses this year have not decreased but rather increased.
The OKX report further split the data by the cause of attacks: by the number of incidents, contract and logical vulnerabilities still rank as the leading cause, with 85 occurrences; however, by the amount of losses, supply chain attacks top the list with approximately $298 million, followed by contract vulnerabilities (about $152 million) and private key leaks (around $130 million). SlowMist summarized this characteristic in eight words: incident decentralization, loss centralization. Among these, the truly catastrophic large losses are concentrated in critical areas such as infrastructure, cross-chain transactions, and supply chains. An unbalanced footnote is that there were only 20 incidents involving cross-chain bridges throughout the half-year, yet they caused approximately $346 million in losses.
Funds are no longer mainly lost through contract vulnerabilities. The OKX report summarizes the changes over the past six months into three main themes: large losses increasingly occur outside contracts; ordinary users are becoming primary attack targets; AI agents have shifted from tools to prey. Additionally, there are two persistent clues: the infiltration of the development process through supply chain poisoning, and the money laundering downstream where all stolen funds ultimately flow. Below, these are detailed one by one.
Project parties: the biggest losses occur in areas beyond audit coverage
The projects that suffered the most severe losses in the first half of the year were mostly not unaudited; the points of failure happened to lie outside the audit scope: signing processes, cloud keys, verification nodes, developer devices. Audits can verify that contract logic is correct but cannot prove the security of these operational links.
KelpDAO: What was compromised was not the contract, but the verification path. This was the largest single loss in the first half of the year. According to OtterSec's review, attackers polluted LayerZero's internal RPC nodes while launching a DDoS attack on honest external nodes. Cross-chain messages were supposed to be validated by multiple independent nodes, but this bridge used a "1-of-1" single validation node configuration at the time. The only validation point received only forged data and ultimately allowed a withdrawal without real asset backing, resulting in about 116,500 rsETH being transferred out, with approximately $75 million frozen afterward. Long regarded as a high-risk configuration, the single validation node, previously only a theoretical caution in architectural reviews, became a real loss of nearly $300 million after the KelpDAO incident. SlowMist supplemented the whereabouts of the stolen funds: LayerZero attributed the incident to the Lazarus subgroup TraderTraitor, with the stolen tokens subsequently used as collateral, borrowing about $236 million in real assets (WETH) on platforms like Aave, which triggered a liquidity crisis in the DeFi market.
Drift: a six-month-long signature inducement. Its mechanism is worth explaining: durable nonce acts as a "pre-signed transaction voucher that can be redeemed at any future time." The attacker, posing as a disguised quantitative institution, managed to establish trust with over $1 million in real deposits over six months,诱导 signing parties to pre-sign such managerial transactions. At the time of signing, no impact was apparent; when the project later adjusted the multi-signature threshold, creating a window lacking timelock (time lock: sensitive operations must be public for a delay before they can take effect) protection, the attacker broadcast the pre-obtained signed transactions, completing 31 withdrawals within 12 minutes, taking over half of the locked assets. The core lesson from this incident is: signing transactions that "have no impact" at the moment does not mean they won't be executed in the future; blind signing, pre-signing, and incomprehensible management transactions should all be considered high-risk operations.
Snapshots of single point failures. Resolv Labs' AWS cloud key was stolen, allowing attackers to issue about 80 million unbacked tokens; Step Finance faced a breach of executive devices, and private keys were used to empty the treasury; Humanity Protocol saw developer devices infected with malware, leading to private key loss of control. SlowMist noted that blockchain analyst ZachXBT tracked and discovered mixing between its stolen funds and those from KelpDAO, essentially ruling out internal collusion and pointing again to Lazarus.
The SlowMist report also recorded a set of more fundamental cases, drilling down to the level of cryptographic engineering implementation. The commonality among the three incidents is that the vulnerabilities were not within the regular coverage of code audits.
• Taiko (June 22, approximately $1.7 million): A signing private key was mistakenly submitted to a public GitHub repository, allowing attackers to forge layer two network state proofs and deceive funds release, causing TAIKO tokens to drop over 20% in the short term.
• SecondFi / former Yoroi (June 21-23, approximately $2.4 million): A missing necessary random masking step in the signing algorithm implementation allowed a single on-chain signature to reverse-engineer the complete private key, resulting in 374 addresses being compromised. The flaw originated from an unaudited third-party component introduced two weeks prior to the incident.
• THORChain (May 15, approximately $10.7 million): Treasury private keys were jointly managed by multiple nodes (threshold signing), where the intention was that no single node would have complete private key access; however, a malicious node gradually collected key fragments during multiple normal signing sessions, eventually reconstructing the complete private key.
From cross-chain verification, cloud keys to signing algorithms, these cases reflect different forms of the same failure: As long as there exists a node that can independently determine the direction of funds on the critical path, it will become the attacker's preferred target.
Based on this same judgment, OKX has not only validated "whether transactions were initiated by the person" in signature risk control but also emphasized understanding the consequences of transactions before users sign. Over the first half of the year, OKX intercepted or issued alerts for over 4 million high-risk operations related to durable nonce, account ownership changes, and other risky scenarios, protecting a cumulative sum of approximately $526 million, and has analyzed over 50,000 on-chain methods, translating incomprehensible calldata into "which assets this transaction will affect and what permissions it will grant." It should be noted that such capabilities can only reduce rather than eliminate risk, and trading platforms and wallet service providers themselves are the highest-value attack targets; the 2025 Bybit incident stemmed from breaching a signature tool, and neither party can claim immunity.
User side: Attacks start at the most familiar entry points
As the costs of attacking protocols have risen, attackers have turned their sights on users. According to the OKX report, today’s attack entry points are often in scenarios with the least user vigilance: app stores, top search results, friend accounts, conferencing software, recruitment processes.
• Malicious browser extensions use a "local shell, cloud poisoning" model: the extension itself does not contain malicious logic and can pass static reviews in app stores; the real phishing pages are delivered in real-time from remote servers and can change domain names at any time (SlowMist captured a similar extension mimicking TronLink in May). Once users enter their mnemonic phrase on such pages, control of their assets shifts.
• Search advertisement poisoning is closer to everyday operations. In a case recorded by the OKX report, a user searched for development tools after purchasing a new computer, clicked on the paid ad at the top of the search results, and executed an "installation command" prompted by the page, which in reality deployed a clipboard hijacker; subsequently, when this user transferred about $20,000, the receiving address was automatically replaced. The difficulty in defending against such attacks lies in the fact that the victim only performed routine operations like "searching for the official website, downloading the tool, copying commands."
• Recruitment interview scams follow a path of “reconnaissance—profiling—targeted attacks”: attackers pose as technical interviewers, asking candidates to share their screens and open wallets to "confirm DeFi experience," effectively recording their wallet addresses, holdings, and commonly used protocols; subsequently, they counterfeit airdrop pages for protocols that the victim has actually used, delivering customized phishing information. In an instance recorded by the OKX report, a victim lost approximately $88,000 as a result.
Two other new tactics are noteworthy. One is the fake "2FA security verification": attackers send emails under the guise of the wallet's official identity, using an impersonated domain name that differs from the official by only one character, coupled with a countdown to create urgency, inducing users to input their mnemonic phrase to "complete verification." The other is business process fraud: using “external audits,” “token ownership confirmation,” and other business scenarios as bait to deliver malicious attachments (one sample analyzed by SlowMist disguised a script as a document with a double file extension), which when opened pretends to be a system update that steals passwords and subsequently requests permissions for camera, screen recording, and keyboard monitoring, with the ultimate goal often being office terminals and cloud service permissions rather than personal wallets.
For the former, both reports provide a consistent baseline warning:
Any page that requests input of mnemonic phrases for verification, authentication, recovery, or upgrades is a scam. The mnemonic phrase is not a verification code, but the very control of assets; no legitimate wallet would request mnemonic phrases through a webpage.
Since a significant amount of losses do not start from on-chain transactions but rather from earlier malicious applications or phishing websites, OKX has advanced protections to device and access entry points: its security scanning assistant has completed over 200,000 risk assessments, identifying over 60,000 high-risk applications; for phishing sites and malicious DApps, over 7 million risky website access attempts have been intercepted, striving to complete interception before users input their mnemonic phrases or connect wallets.
Moreover, a considerable portion of risks has already been embedded upstream, before attackers contact users—namely, the software supply chain.
Supply chain: It is not the software package that is poisoned, but the trust itself
The peculiarity of supply chain poisoning is that the victims have made no errors; they simply installed a dependency, updated a version, or accessed an official domain as usual. This is the chapter where SlowMist emphasizes the most, with three representative cases evidencing the evolution of such attacks in breadth, depth, and height.
• Breadth: Shai-Hulud worm. In mid-May, an account released 637 malicious versions involving 317 package names within 22 minutes, affecting popular components such as echarts-for-react (over 3.8 million downloads per month) and size-sensor (over 4.2 million downloads per month). The malicious packages triggered obfuscation payloads during the installation phase, systematically collecting various sensitive information like AWS, GCP, Azure cloud credentials, Kubernetes cluster keys, and SSH private keys while encrypting and exfiltrating them, while also possessing self-propagation modules for worm-like distribution, additionally pre-setting persistence mechanisms targeting Claude Code and VS Code. The target of theft is no longer a single software package but the entire development pipeline's permissions.
• Depth: Layered transmission of the trust chain. In March, the Python library LiteLLM, with a monthly download count of 97 million, was attacked. The attackers did not directly infiltrate the library but first poisoned the security scanning tool Trivy that LiteLLM’s build process relied on, thereby stealing release keys and pushing malicious versions. Developers trust LiteLLM, LiteLLM trusts Trivy, while Trivy has been compromised, turning the security tool that should bear protective responsibilities into part of the attack chain. Similarly, SlowMist monitored an official CDN poisoning of Apifox in that month: attackers altered official scripts, implanting malicious code with random timers, activating them half an hour to three hours after installation, making it difficult for users to associate anomalies with specific operations. This indicates that “official sources” can no longer be fully equated with “security.”
• Height: "Attack surface thinking" by attackers. SlowMist's Chief Information Security Officer 23pds issued a warning in April: the Lazarus subgroup HexagonalRodent lured developers to run code containing backdoors by offering high-paying remote positions. According to the OKX report, this organization heavily leveraged ChatGPT and Cursor to generate code and scripts, using AI building tools to forge official websites and executive identities, and even utilizing AI for “self-checks” on their malicious codes to evade detection; within just one quarter, wallet data was stolen from over 2,700 developer systems. Meanwhile, AI-generated code itself is producing new risk surfaces; as cited by the OKX report referencing OtterSec data: Georgia Tech attributed 35 of the 74 CVEs from March to AI-generated code, while a scan targeting approximately 1,400 "hastily generated" applications discovered 2,038 severe vulnerabilities and over 400 exposed keys. “Functionality” does not equate to “production readiness.”
Similar incidents include the sudden emergence of anomalous versions of node-ipc after 21 months of no updates, and TrapDoor, which poisoned across three major ecosystems. They all point to a conclusion: the focus of past defenses has been on auditing code, whereas now it is essential to audit the sources of trust. This is particularly critical for the Agent ecosystem, as Agents actively read, install, and execute external plugins. Based on this understanding, OKX has established access review and regular inspection mechanisms for plugin integration on its Agentic Wallet, covering code security, permission scopes, and external dependencies, moving the judgment of “whether a dependency is trustworthy” before plugin launch.
AI: From forgery of a single piece of content to the synthesis of an entire environment
Connecting the preceding content, we can see an implied mainline: the external world possesses an innate trust in “smarter systems.” The next collective misjudgment forming is: Agents are more reliable than humans. This perception has not yet been sufficiently rectified by a considerable number of incidents, but the costs are already manifesting.
The Bankr incident in May is a case that hardly seems like an “intrusion”: the attacker did not steal private keys, did not attack contracts, and did not breach servers, but simply requested Grok to translate a piece of Morse code. BankrBot is an AI Agent deployed on the X platform that can automatically execute on-chain transactions based on natural language instructions. According to SlowMist's review, the attacker first airdropped a membership NFT to an associated wallet, triggering its high-privilege mode, and then sent a Morse code message requesting Grok to translate; after Grok completed the decoding, it @BankrBot with the hidden transfer instruction (approximately 3 billion DRB tokens) output as plaintext, which BankrBot executed as trusted instructions. The loss was approximately $150,000 to $200,000 (SlowMist recorded it as about $175,000), with around 80% later recoverable. Neither Grok nor BankrBot had traditional vulnerabilities; the genuine failure was the unverified trust boundary between the two automated systems. When an Agent possesses signing and transfer capabilities, a malicious instruction disguised as normal input can translate into a real asset loss.
SlowMist categorizes attacks on Agents into four layers according to their cognitive to execution chains, each layer corresponding to real case examples:
• Input layer: indirect prompt injection. Embedding malicious instructions into external content that Agents actively read, as exemplified by the Bankr incident.
• Memory layer: memory contamination. Verification from Palo Alto Networks Unit 42 shows that malicious rules can be written into an Agent's long-term memory (e.g., marking the attacker's address as a "frequent payment address") and continue to take effect in subsequent sessions.
• Tool layer: permission penetration. In May’s disclosed OpenClaw “Claw Chain” incident, the security company Cyera discovered four interconnected vulnerabilities (highest danger rating CVSS 9.6), which could be progressively linked for complete control over the execution environment.
• Supply chain layer: OpenClaw's plugin center lacked audits, with malicious skills disguising as functional documentation, hiding commands in the code, and employing a “two-stage” method to dynamically pull the true malicious payload from remote sources.
AI profoundly alters phishing scenarios by upgrading fraud from “forging a single piece of content” to operating an entire set of “synthesized realities.” According to the OKX report relaying Check Point’s disclosure of the "Truman Show" operation, attackers guide victims into a private investment group where the "experts" and "investors" are all played by AI, continually releasing analyses, showcasing profits, and interacting in real time; the victim faces not a single fraudster but a counterfeit environment possessing a complete social and trust structure. The Singapore video conference case mentioned at the beginning of this article (with AI-generated prime ministers, presidents, and financial authority representatives present, resulting in a loss of approximately 4.9 million Singapore dollars) is an extreme form of this same tactic.
Thus, the attack targets have fundamentally shifted: it is no longer the user's judgment on a single piece of information that needs to be deceived, but their perception of the overall environment’s authenticity. The judgment that “vulnerabilities appear in people” should also be extended; as machines begin to replace humans in making judgments, the boundary of risk expands from “people” to all links that are taken for granted as trustworthy, including trust boundaries between machines. Traditional defenses based on “recognizing suspicious information” are failing.
In terms of response, the industry has reached a consensus: while Agents can organize transactions more intelligently, their execution phases must be subject to stricter constraints. SlowMist has embedded security capabilities into Agent operational processes, equipping its MistEye Security Gate for coding agents like Claude Code, Cursor, with a “scan before execution” hard-blocking mechanism, while MistTrack Skills, relying on over 400 million on-chain address labels covering 19 major public chains, completes anti-money laundering risk screenings before transfers. OKX's approach also refrains from fully relying on the Agent's own judgment for security: no matter how transactions are generated, an independent risk assessment occurs prior to signing and broadcasting; should risks be identified, a secondary confirmation or direct interception is required.
Flow of funds: Only about 12% can be recovered, money laundering has become highly industrialized
Returning to the figures from the beginning. The anti-money laundering and regulatory data in this chapter primarily come from SlowMist's tracking: in the first half of the year, only 18 incidents enabled the recovery or freezing of funds, involving approximately $389 million in stolen assets, and about $118 million was recovered or frozen, accounting for 12.3% of total losses. The vast majority of stolen funds become irretrievable once transferred, primarily because the downstream money laundering processes have become highly industrialized.
Taking Lazarus as an example, its money laundering chain is interconnected: first, it cuts off on-chain associations through privacy protocols like Umbra, then exchanges funds into Bitcoin through real-name-free cross-chain protocols like THORChain (which is liquid and easy to split), afterwards dispersing the funds to thousands of new addresses and then processing them through mixing services like Sinbad, YoMix, Wasabi, ultimately exchanging them offshore into fiat currency through OTC platforms in China or networks of Russian exchanges (like Garantex and its successors Grinex). If the stolen assets are tokens like rsETH, they would first be mortgaged in DeFi protocols to borrow real assets before conversion; the KelpDAO stolen funds followed this path. Once funds enter the cross-chain and mixing stages, the window for recovery is essentially closed.
The inflow of funds into privacy protocols serves as indirect confirmation: according to SlowMist's Dune-based statistics, major privacy protocols received about $974 million in inflows during the first half of the year, with Tornado Cash accounting for about 71%, Railgun for about 23%, with nearly ninety percent of that inflow being stablecoins. The other end of the illicit industry reflects the "serviceization" of tools: on the drain-as-a-service platform tracked by SlowMist, the Rublevka Team has stolen over $10 million since 2023, completing at least 240,000 successful thefts while providing downstream personnel with a share of up to 80%; StepDrainer offers a full suite of phishing tools at a set price, with the complete source code priced at about $750. The accessibility of attack tools has dropped to a very low level.
Regulatory constraints are also tightening and starting to target key nodes of money laundering channels precisely. In the dynamic summarized by SlowMist, the three most directly impacting the aforementioned linkages are: the EU's 20th round of sanctions against Russia comprehensively bans transactions with cryptocurrency service providers within Russia, directly targeting channels like Garantex and Grinex; Dubai's DIFC fully prohibits privacy coin transactions, aimed at the mixing phase; and in February, eight departments in China issued regulations clearly stating that stablecoins pegged to the yuan cannot be issued overseas without approval. Other measures are also progressing in similar directions, such as Hong Kong issuing the first batch of stablecoin issuer licenses, South Korea proposing fines of up to 10% of the amount stolen against attacked exchanges, and the U.S. GENIUS Act introducing the first rules for stablecoins. The starting point of the money laundering chain is often a malicious address or a high-risk authorization; the OKX report also emphasizes that its KYS risk capability will continuously identify abnormal addresses, malicious tokens, and high-risk authorizations, striving to mark risks before funds enter the mixing and cross-chain channels.
Conclusion: Moving the defensive line forward to before confirmation
At the moment the signer of Drift presses the confirmation key, all defenses lose their meaning. Most lessons from the first half of 2026 occurred prior to the action of "confirmation": someone signed a transaction they couldn't understand, a system granted excessive permissions, a team trusted incorrect data sources, and a user believed in a sufficiently realistic disguise.
Whether it's OKX's proposal to “understand before signing, avoid single point risks, and verify before trusting,” or SlowMist's throughout approach of "verify before trusting," they ultimately point in the same direction: moving judgment before actions occur. This can be summarized into three lists.
For project parties: key transactions should not only confirm “who signed” but also confirm “whether the signer understands the consequences.” Multi-signatures, contract upgrades, owner changes, cross-chain configurations, and similar operations should have parseable, simulatable, and reviewable processes; large fund outflows and permission changes should be equipped with timelocks and abnormal alerts. No single link should independently decide the direction of funds, such as an RPC, a validation node, a cloud key, or an administrator address. Reliance scanning should be normalized; requests involving funds, permissions, and deployments should not be confirmed through a single channel, and video conferences and friend accounts do not constitute valid identification.
For ordinary users: transactions that are not understandable should not be signed. Large assets and daily interaction wallets should be kept separate; rarely used authorizations should be regularly revoked, being especially cautious regarding unlimited authorizations, Permit/Permit2 operations, etc.; most attacks do not immediately transfer assets but first obtain authorization and then act opportunistically. Any page requesting mnemonic phrases is a scam; any requests for remote control, screen sharing, installing unfamiliar conferencing software, or executing terminal commands should be verified beforehand.
For Agent users and developers: input filtering, tool invocation sandboxes, permission grading, double confirmation for sensitive operations, and pre-execution verification are foundational configurations for any Agent that can hold funds, rather than optional features. System prompts should not be treated as security control measures; agents should be responsible for generating solutions, while an inflexible rule system should be responsible for authorization.
The first half of 2026 does not represent an overall improvement in security conditions, but rather a systematic shift in the attack paradigm, moving from contract code to people, infrastructure, and trust itself beyond the code. In an era where synthesized reality is possible, what needs to be verified is no longer a specific piece of information, but the environment itself. The goal of security has never been to require every participant to become an expert, but to intercept risks at the most error-prone points before confirmation.
In the first half of 2026, what needs to be patched is not a specific contract but the very interaction between people and processes.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
