{"id":122636,"date":"2026-07-29T11:02:12","date_gmt":"2026-07-29T11:02:12","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/122636\/"},"modified":"2026-07-29T11:02:12","modified_gmt":"2026-07-29T11:02:12","slug":"crypto-hacks-hit-all-time-high-as-north-korea-drains-over-600m-and-ai-agents-become-new-target","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/122636\/","title":{"rendered":"Crypto Hacks Hit All-Time High as North Korea Drains Over $600M and AI Agents Become New Target"},"content":{"rendered":"

Cryptocurrency projects recorded more verified hacks in the first six months of 2026 than in any previous full year, with 212 separate exploit incidents generating over $1.1 billion in losses \u2014 and North Korea’s state-sponsored hacking apparatus responsible for roughly 55% of every dollar stolen, with most of that total taken in a 17-day window in April. That figure comes from Blockaid’s H1 2026 Security Report<\/a>, published Tuesday, which confirmed the six-month incident count was 3.4 times<\/a> what the firm recorded across all of 2025. Exchange rate note: all figures are denominated in USD; no currency conversions required.<\/p>\n

The numbers are not a blip. Three independent security firms \u2014 Immunefi, Quill Audits, and TRM Labs \u2014 each published corroborating analyses<\/a> using different methodologies, and all three reached the same conclusion: the first half of 2026 set the highest-ever six-month incident count on record. The firms’ dollar estimates vary (Blockaid at $1.1 billion, Immunefi at $972 million, Quill Audits at $935.3 million) because they apply different thresholds for what constitutes a verified incident \u2014 but all three agree on the direction.<\/p>\n

What Blockaid’s report reveals is that the nature of successful attacks has fundamentally changed. Code vulnerabilities in smart contracts \u2014 the failure mode that drove most earlier DeFi losses \u2014 are no longer the primary vector. Instead, attackers are exploiting the humans who control protocols, the infrastructure that bridges trust between blockchains, and now the artificial intelligence agents given authority to move money on behalf of users.<\/p>\n

North Korea Stole Over $600M in 17 Days \u2014 Without Finding a Single Bug<\/p>\n

North Korea’s Lazarus Group and its subunits took roughly 55% of all H1 losses<\/a> \u2014 approximately $609 million \u2014 through attacks that occurred in a concentrated 17-day window in April 2026. The two largest individual attacks, Drift Protocol ($285 million) and KelpDAO ($292 million), together account for $577 million of that total. Neither attack required finding a vulnerability in any smart contract. Both required finding the humans who could authorize the transactions \u2014 and then systematically deceiving them.<\/p>\n

TRM Labs, analyzing the first four months of 2026, found that North Korean state-sponsored hackers were responsible for 76% of all cryptocurrency hack value<\/a> in that period. The group’s documented history of crypto theft now exceeds more than $6 billion since 2017, including the $1.5 billion Bybit breach<\/a> in February 2025 that remains the largest single cryptocurrency theft in history.<\/p>\n

Drift Protocol: How a Six-Month Con Emptied $285 Million in 12 Minutes<\/p>\n

The Drift Protocol attack, which drained approximately $285 million from the Solana-based perpetual futures exchange on April 1, 2026, began in the autumn of 2025<\/a> \u2014 six months before a single dollar was moved.<\/p>\n

Threat actors affiliated with the DPRK subunit UNC4736 (also tracked under the names AppleJeus, Citrine Sleet, and Golden Chollima) posed as representatives of a legitimate quantitative trading firm. They met Drift contributors at an industry conference, built credibility over months through Telegram conversations and live vault integration sessions, and deposited more than $1 million of their own capital<\/a> into the protocol to demonstrate seriousness.<\/p>\n

The technical mechanism that made the April 1 execution possible was Solana’s durable nonce feature<\/a>. Unlike standard Solana transactions, which must reference a recent block hash and expire within roughly two minutes, durable nonce transactions can be created and stored indefinitely before execution. The attackers used this feature to pre-authorize administrative transactions months before acting on them \u2014 transactions that appeared cryptographically legitimate because they were.<\/p>\n

By March 2026, the group had socially engineered at least two of five Drift Security Council multisig signers into pre-signing malicious transactions using that mechanism. When April 1 arrived, the attackers used those stored authorizations to seize Security Council administrative powers in approximately 12 minutes<\/a>, draining more than $285 million across multiple tokens before the protocol could respond. They then deposited a worthless fabricated token as collateral, withdrew real assets including USDC, SOL, and ETH, and bridged most funds to Ethereum within hours. The vaults were largely empty before any alarm was raised.<\/p>\n

As of July 23, 2026 \u2014 three months after the exploit \u2014 a wallet linked to the Drift attacker moved 23,095.1 ETH (worth approximately $44.4 million at the time of transfer)<\/a> through Tornado Cash, the crypto mixer, over a two-day window. The bulk of the stolen funds remain unrecovered.<\/p>\n

KelpDAO: When One Verifier Is All North Korea Needs<\/p>\n

Seventeen days after the Drift attack, on April 18, 2026, Lazarus Group’s TraderTraitor subunit struck KelpDAO’s rsETH bridge on the LayerZero protocol, draining approximately $292 million \u2014 116,500 rsETH \u2014 in under 46 minutes<\/a>.<\/p>\n

This attack required no social engineering. It required only that a single verifier stand between an attacker and $292 million \u2014 and it did.<\/p>\n

LayerZero’s cross-chain messaging protocol allows applications to configure how many independent Decentralized Verifier Networks (DVNs) must confirm a transaction before the destination chain accepts it. KelpDAO’s rsETH bridge was configured to require confirmation from just one DVN: LayerZero Labs itself. With no second verifier to catch a forged message, attackers needed only to compromise LayerZero Labs’ verification infrastructure<\/a> \u2014 and they did, by gaining access to two RPC nodes the LayerZero Labs DVN used to read source-chain state, replacing the software with malicious versions that reported fabricated data.<\/p>\n

A simultaneous distributed denial-of-service attack against external backup nodes forced LayerZero’s verifier to rely on the compromised infrastructure. The forged data convinced the Ethereum contract that a legitimate token burn had occurred on the source chain \u2014 releasing 116,500 rsETH to an attacker-controlled address. The rsETH smart contract was never exploited. No cryptographic primitive was broken. As OpenZeppelin’s post-mortem headline put it: “zero bugs found<\/a>.”<\/p>\n

What the Blockaid report and subsequent forensic analyses revealed about the aftermath is as important as the attack itself: LayerZero’s own investigation found that 47% of active OApp contracts on its protocol were running the same 1-of-1 DVN configuration<\/a> at the time of the KelpDAO exploit. In a May 9 statement, LayerZero acknowledged that it had “made a mistake by allowing our DVN to act as a 1\/1 DVN for high-value transactions”<\/a> \u2014 reversing three weeks of statements that had assigned the configuration choice entirely to KelpDAO. LayerZero has since announced it will refuse to sign messages for any application still running a 1-of-1 configuration, and has raised its protocol default to at least 3-of-3 verifiers<\/a>.<\/p>\n

KelpDAO, for its part, has migrated rsETH bridging from LayerZero’s OFT standard to Chainlink’s Cross-Chain Interoperability Protocol<\/a>, which requires consensus from at least 16 independent verifiers before any cross-chain message is accepted.<\/p>\n

Ethereum and Solana: Where the Money Went<\/p>\n

Tracking losses by blockchain, Blockaid found Ethereum projects absorbed the largest aggregate losses in H1 2026 at $332 million, while Solana \u2014 driven almost entirely by the Drift attack \u2014 took $326 million<\/a>. Solana’s figure represents a dramatic escalation from the approximately $127 million the network sustained across all of 2025<\/a>.<\/p>\n

Ethereum’s losses reflected the density of high-value protocols on its network: restaking platforms, stablecoins, and DEX aggregators. Code exploits dominated by count, with key compromises at Humanity Protocol and StablR driving some of the largest individual losses. Blockaid also identified novel attack vectors during the period, including the first production exploit of Ethereum’s EIP-7702 wallet-delegation standard on Arbitrum and two zero-knowledge proof boundary exploits on the Aztec network<\/a>.<\/p>\n

On-chain protocols were the largest overall loss category at $524 million. Cross-chain bridges were second at $372 million<\/a> \u2014 a figure that includes the KelpDAO incident and code exploits at Verus, Taiko, Alephium, Secret, Axelar, Swapnet, and Syscoin.<\/p>\n

How Attackers Are Using AI \u2014 and a Milestone No One Wanted<\/p>\n

The most structurally novel finding in Blockaid’s report is not a number. It is a single incident from May 2026 that Blockaid described as “the first ever” AI agent exploit in the cryptocurrency space \u2014 a title no one would want \u2014 and its implications extend well beyond the $175,000 that changed hands.<\/p>\n

In early May 2026, an attacker targeted Bankr, an AI-powered crypto trading assistant that automatically generates crypto wallets for users on X who interact with its bot and executes transactions through natural language commands. The attack operated in two stages. First, the attacker gifted the target Bankr wallet a “Bankr Club Membership” NFT, which activated a high-privilege permission set including transfer authorization. Then, the attacker sent a message to xAI’s Grok chatbot encoded in Morse code \u2014 a format that bypassed Grok’s safety filters<\/a>, which screen for obvious financial instructions in plain text.<\/p>\n

Grok decoded the Morse code, as it was designed to do, and tagged @bankrbot in its public reply. Bankr’s system treated Grok’s public output as a trusted executable command \u2014 with no verification that the reply represented Grok’s own intent rather than the output of an adversarial input. The system autonomously transferred approximately 3 billion DRB tokens, worth approximately $175,000 at the time<\/a>, to the attacker’s wallet.<\/p>\n

SlowMist formally classified the incident as an “AI agent permission chain abuse”<\/a> attack \u2014 a category in which one AI system’s output is treated as trusted financial authorization by a second AI system, with no independent verification of intent or source. SlowMist’s recommendations were direct: natural language outputs from AI systems must be “strictly decoupled”<\/a> from financial execution; high-value operations require multi-factor verification and anomaly detection; inter-agent interactions should use structured, verifiable protocols rather than plain text.<\/p>\n

Blockaid projected in its H1 report that AI agent deployments are growing roughly ten times per year<\/a>, and that the industry should expect multiple AI agent incidents in H2 2026, with prompt injection attacks leading and tool-use abuse and unauthorized signing following.<\/p>\n

What Blocks Traditional Security Tools From Catching These Attacks<\/p>\n

Each of the three major attack categories documented in Blockaid’s H1 report shares a single defining characteristic: every transaction looked completely valid to on-chain monitoring tools.<\/p>\n

In the Drift exploit, the malicious administrative transactions were pre-authorized by legitimate keyholders using legitimate Solana cryptography. No blockchain monitor could detect the authorization was obtained through six months of social engineering rather than genuine governance. In the KelpDAO attack, the forged cross-chain message passed through verification infrastructure that LayerZero’s own DVN had already been manipulated into treating as authentic \u2014 meaning the on-chain record showed a valid attestation. In the Bankr exploit, Grok decoded a real Morse code message, produced a real output, and tagged a real bot. Bankr executed a real transaction. Every individual step in the chain was authentic; only the chain as a whole was adversarial.<\/p>\n

Blockaid warned that the multisig signer compromise pattern \u2014 “LinkedIn social engineering leading to multisig signer compromise” \u2014 produced two of the four largest H1 incidents and that there is “no structural reason for it to stop.”<\/a> SlowMist separately confirmed that attackers across the crypto space have begun deploying AI tools including ChatGPT and Cursor<\/a> to write exploit code, craft more convincing social engineering narratives, and optimize attack sequencing.<\/p>\n

What H2 2026 Looks Like<\/p>\n

Blockaid’s forward outlook for the second half of 2026 identifies three primary threat categories: the continuation of DPRK-linked social engineering campaigns targeting multisig signers and bridge verification infrastructure; the proliferation of AI agent exploits as autonomous financial agents become more common and more capable; and the exploitation of novel Ethereum primitives \u2014 EIP-7702 wallet delegation, ZK proof boundary conditions \u2014 that were introduced in production in H1 and whose attack surface is not yet fully understood.<\/p>\n

Recovery prospects for H1 losses are uneven. Incidents involving code bugs or operator error \u2014 rather than state-sponsored theft \u2014 sometimes see partial or full recovery. The $8.5 million Verus exploit resulted in significant fund recovery, and IPOR Fusion experienced a complete white-hat recovery. Blockaid itself participated in recovering approximately $7.3 million (73%) from the Stellar Blend oracle manipulation incident<\/a> through real-time wallet clustering and cross-chain tracing.<\/p>\n

For the DPRK-linked losses, the prognosis is bleak. Lazarus Group has a documented track record of successfully laundering even large hauls \u2014 the Drift attacker’s July movement of $44.4 million through Tornado Cash confirmed that laundering operations are active and ongoing. For DeFi users, protocol developers, and anyone building AI agents with on-chain financial capabilities, the H1 2026 record is less a historical data point than a threat model for the months ahead.<\/p>\n

Frequently Asked QuestionsWhy does Blockaid’s $1.1 billion figure differ from other security firms’ estimates?<\/p>\n

Three major security firms \u2014 Blockaid, Immunefi, and Quill Audits \u2014 all analyzed H1 2026 crypto losses and reached figures ranging from $935 million to $1.1 billion. The variation is methodological, not factual: each firm applies different thresholds for what qualifies as a “verified” incident, and each covers a different scope of protocols and blockchains. All three independently confirmed that H1 2026 set the highest-ever six-month incident count on record.<\/p>\n

How did the Bankr AI agent get hacked without anyone breaking into a wallet or smart contract?<\/p>\n

The Bankr exploit worked by manipulating the trust relationship between two AI systems rather than breaking into either one. The attacker sent Grok a Morse-code encoded financial instruction; Grok decoded it and posted the result publicly; Bankr’s system treated Grok’s public output as a valid command and executed a token transfer. No private key was compromised and no smart contract was exploited \u2014 the only failure was that Bankr was designed to treat another AI’s output as trusted financial authorization without verifying that the output represented genuine intent rather than adversarial manipulation. SlowMist classifies this as “AI agent permission chain abuse,” and recommends that AI agents with financial capabilities require multi-factor verification and human approval for all high-value transfers.<\/p>\n

How did North Korea steal hundreds of millions without finding any code vulnerabilities?<\/p>\n

Both major DPRK-linked April attacks exploited trust rather than code. In the Drift attack, threat actors spent six months building personal relationships with protocol governance participants, ultimately inducing multisig signers to pre-authorize malicious transactions using a legitimate Solana feature. In the KelpDAO attack, they compromised the off-chain server infrastructure that LayerZero’s verification layer relied on to confirm cross-chain transactions \u2014 manipulating the verifier rather than the protocol’s own code. When a bridge relies on a single verifier, compromising that one verifier is sufficient to authorize arbitrary cross-chain transfers. No smart contract audit would have caught either attack.<\/p>\n

What should DeFi users and developers do differently after H1 2026?<\/p>\n

Developers building on cross-chain bridges should require multi-verifier configurations \u2014 post-KelpDAO, LayerZero now mandates a minimum of three independent verifiers. Protocols using multisig governance should treat all new contributors who request signing access with extended verification periods and compartmentalized access. AI agents with any on-chain financial capability should require explicit human confirmation before executing transfers above a defined threshold, and should not treat the output of third-party AI systems as trusted financial instructions. Users investing in DeFi protocols should verify their bridge architecture and whether a protocol’s governance has recently onboarded new multisig signers with limited track records.<\/p>\n","protected":false},"excerpt":{"rendered":"Cryptocurrency projects recorded more verified hacks in the first six months of 2026 than in any previous full…\n","protected":false},"author":2,"featured_media":122637,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61903,405,7537,38747,56136,61901,3277,61904,61902,6296],"class_list":["post-122636","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-ai-agent-exploit","tag-ai-agents","tag-artificial-intelligence-agents","tag-blockaid","tag-blockchain-security","tag-crypto-hack-2026","tag-cryptocurrency","tag-defi-security","tag-lazarus-group","tag-north-korea"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/122636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=122636"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/122636\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/122637"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=122636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=122636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=122636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}