Nearly 90% of stolen funds are irrecoverable: In the first half of 2026, Web3 attack targets are shifting from "code" to "people"

In an era where AI-generated realities are possible, what needs to be verified is no longer a single piece of information, but the environment itself.

In the first half of 2026, the crypto industry experienced 182 publicly reported security incidents, resulting in losses of approximately $956 million. More alarming than the total losses is the destination of the funds: according to SlowMist's statistics, funds were recovered or frozen in only 18 incidents, totaling approximately $118 million, representing just 12.3% of the total losses. The remaining nearly 90% of stolen funds are considered irretrievable.

Another figure is easily misinterpreted: the $956 million loss is down nearly 60% year-over-year. However, this does not mean the industry has become safer. The decrease in losses is almost entirely attributable to the absence of a singular mega-event like last year's Bybit incident (approximately $1.5 billion). The actual number of incidents has increased by about 50% year-over-year. Attacks have not weakened; instead, they have shifted their focus—from targeting protocol contracts to targeting people.

The two most costly attacks in the first half of the year were not executed by exploiting smart contracts. Drift Protocol was drained of approximately $285 million through a six-month-long social engineering campaign, which began with a multi-signer signing a few transactions that "seemed harmless." A victim in Singapore was invited to a video conference where government officials were entirely AI-generated, resulting in a loss of approximately S$4.9 million. The most expensive vulnerability is now found in humans.

This is one of the core conclusions of the "2026 OKX Web3 Security Mid-Year Report" released by the OKX Web3 security team in collaboration with SlowMist and OtterSec. It shares a common conclusion with SlowMist's "2026 H1 Blockchain Security and Anti-Money Laundering Report" published around the same time. While one report comes from a trading platform and the other from a security firm, both point to the same conclusion: the frequency of attacks is rising, tactics are evolving, and the target is shifting from "code" to "people."

Losses Down Nearly 60% YoY, But Attack Activity Rises

Viewing the same dataset through different lenses can lead to contradictory conclusions. This is a prerequisite for understanding the security landscape of the past six months.

According to OKX's report, citing SlowMist's hacked database, there were 182 incidents in H1 2026, with losses of approximately $956 million. In comparison, H1 2025 saw 121 incidents with losses of about $2.373 billion. The number of incidents increased by approximately 50% year-over-year, while the total amount decreased by about 60% YoY. The primary reason for the decline in losses is that the Bybit incident in February 2025 (approximately $1.5 billion, where hackers compromised the developer's computer of its signing tool Safe{Wallet} and tampered with the official website script) was an extreme outlier. OKX's report assesses that excluding this anomaly, comparable losses this year have actually increased.

The OKX report further breaks down the causes of attacks from two perspectives: by number of incidents, contract and logic vulnerabilities remain the leading cause with 85 incidents. However, by loss amount, supply chain attacks top the list at approximately $298 million, followed by contract vulnerabilities (approx. $152 million) and private key leaks (approx. $130 million). SlowMist characterizes this trend in eight words: Fragmentation of Events, Concentration of Losses. The truly devastating large-scale losses are increasingly concentrated in critical areas like infrastructure, cross-chain bridges, and supply chains. A telling footnote: cross-chain bridges only accounted for 20 incidents in the entire half-year but caused approximately $346 million in losses.

Funds are no longer primarily lost through contract vulnerabilities. The OKX report summarizes the changes over the past six months into three main themes: Large-scale losses increasingly occur outside of smart contracts; ordinary users are becoming primary targets; and AI Agents have transitioned from tools to prey. In addition, there are two threads running throughout: supply chain poisoning that infiltrates the development process, and the downstream money laundering channels where all stolen funds eventually converge. These are detailed below.

For Projects: The Biggest Losses Occur Where Audits Don't Reach

Most of the projects suffering the largest losses in H1 2026 had undergone audits. The point of failure lay precisely outside the scope of an audit: signing processes, cloud keys, validator nodes, and developer devices. An audit can prove a contract's logic is sound, but it cannot prove the security of these operational links.

KelpDAO: The contract wasn't broken, the verification path was. This was the largest single loss of the half-year. According to OtterSec's post-mortem, the attacker simultaneously polluted LayerZero's internal RPC nodes and launched a DDoS attack against honest external nodes. Cross-chain messages are typically verified by multiple independent nodes. However, the bridge was using a "1-of-1" single validator node configuration. The sole verification point received only forged data and ultimately approved a withdrawal with no real asset backing. Approximately 116,500 rsETH were drained, of which about $75 million was subsequently frozen. A single validator node has long been considered a high-risk configuration, previously just a theoretical point in architecture reviews. After the KelpDAO incident, it became a tangible loss of nearly $300 million. SlowMist added detail regarding the stolen funds: LayerZero attributed the incident to the Lazarus sub-group TraderTraitor. The stolen tokens were then used as collateral on lending platforms like Aave to borrow approximately $236 million in real assets (WETH), triggering a liquidity crisis in the DeFi market.

Drift: A six-month-long signature inducement scheme. Its mechanism warrants explanation: a durable nonce is essentially a pre-signed transaction voucher that can be executed at any future point. The attacker built trust over six months by posing as a quant firm, depositing over $1 million in real funds, and inducing a signer to pre-sign these management transactions. The signatures showed no immediate effect. When the project subsequently adjusted the multisig threshold, creating a window lacking a timelock (a mechanism ensuring sensitive operations are delayed for public review before execution), the attacker broadcast the pre-signed transactions, executing 31 withdrawals in 12 minutes and draining over half of the locked assets. The core lesson from this incident is that a signature on a transaction with "no immediate impact" does not preclude it from being executed in the future. Blind signing, pre-signing, and unparseable management transactions should all be treated as high-risk actions.

A Portrait of Single Points of Failure. Resolv Labs' AWS cloud keys were stolen, allowing the attacker to mint approximately 80 million unbacked tokens. Step Finance saw an executive's device compromised, with private keys used to drain the treasury. Humanity Protocol had a developer's device infected with malware, leading to loss of private key control. SlowMist notes that on-chain analyst ZachXBT tracked the stolen funds from these incidents and found them mixed with the KelpDAO funds through coin mixing services, largely ruling out an inside job and pointing once again to Lazarus.

The SlowMist report also documents a set of more fundamental cases, probing into the engineering implementation of cryptography. The commonality among these three incidents is that the vulnerabilities were not within the typical scope of code audits.

• Taiko (June 22, ~$1.7 million): A private key used for signing was mistakenly committed to a public GitHub repository. The attacker used it to forge L2 state proofs, tricking the system into releasing funds. The TAIKO token price briefly dropped over 20%.

• SecondFi / formerly Yoroi (June 21–23, ~$2.4 million): The signature algorithm implementation was missing a necessary random blinding step, allowing a single on-chain signature to be used to reverse-engineer the full private key. 374 addresses were drained. The flaw originated from an unaudited third-party component introduced two weeks prior to the incident.

• THORChain (May 15, ~$10.7 million): The vault private key was managed by multiple nodes via threshold signatures, designed so that no single node possesses the full key. However, a malicious node gradually collected key fragments over multiple rounds of legitimate signature processes, eventually reconstructing the full private key.

From cross-chain verification and cloud keys to signature algorithms, these cases represent different forms of the same type of failure: If a critical pathway has a single node capable of independently deciding the fate of funds, it becomes the attacker's primary target.

Based on this assessment, OKX's security approach for signing not only verifies "whether the transaction was initiated by the user" but also focuses on helping users understand the consequences of a transaction before signing. Targeting high-risk scenarios like durable nonces and account ownership changes, OKX intercepted or alerted on over 4 million related high-risk operations in H1, protecting approximately $526 million. It has also parsed over 50,000 on-chain methods, translating unreadable calldata into descriptions like "which assets will be moved or which permissions will be granted by this transaction." It should be noted that such capabilities can only reduce, not eliminate, risk. Exchanges and wallet service providers are themselves the highest-value targets, as demonstrated by the 2025 Bybit incident which broke the signing tool itself. No entity can claim immunity.

User-Side: Attacks Start at the Most Familiar Entry Points

As the cost of attacking protocols rises, attackers are turning to users. According to the OKX report, today's attack entry points are often the scenarios where user vigilance is lowest: app stores, top search results, friend accounts, meeting software, and recruitment processes.

• Malicious Browser Extensions employ a "local shell, cloud poison" model. The extension itself contains no malicious logic and can pass app store static reviews. The actual phishing page is dynamically served from a remote server, allowing the domain to be changed at any time (SlowMist captured a similar extension imitating TronLink in May). Once a user enters their seed phrase on such a page, control of their assets is lost.

• Search Ad Poisoning is even more integrated into daily routines. In one case documented by OKX, a user searched for a development tool on a new computer, clicked a paid ad at the top of the search results, and followed on-screen instructions to execute an "installation command" in their terminal. The command actually deployed clipboard-hijacking malware. Later, when the user transferred approximately $20,000, the recipient address was automatically replaced. The difficulty in defending against this type of attack is that the victim performed seemingly routine actions: searching for a website, downloading a tool, and executing a command.

• Recruitment/Interview Scams follow a path of "reconnaissance, profiling, targeted attack." The attacker, posing as a technical interviewer, asks the candidate to share their screen and open their wallet to "confirm their DeFi experience." In reality, they are recording wallet addresses, holdings, and frequently used protocols. Subsequently, they forge airdrop pages or send customized phishing messages based on the specific protocols the victim uses. In one case from the OKX report, a victim lost approximately $88,000 from such a scheme.

Two other new methods warrant attention. One is the fake "2FA Security Verification": attackers send emails impersonating an official wallet provider, using a spoofed domain differing by just one character from the legitimate one, often with a countdown timer to create urgency, tricking users into entering their seed phrase to "complete verification." The other is business process fraud: attackers send malicious attachments disguised as "external audit" or "token vesting confirmation" documents (SlowMist analyzed a sample using a double extension to disguise a script as a document). Once opened, it masquerades as a system update to steal passwords, then requests permissions for the camera, screen recording, and keyboard logging. The ultimate target is often office terminals and cloud service access, not just personal wallets.

Regarding the former, both reports provide a consistent, fundamental warning:

Any website requesting the entry of seed phrases for verification, authentication, recovery, or upgrading is a scam. A seed phrase is not a verification code; it IS control over your assets. No legitimate wallet will ever request your seed phrase through a webpage.

Recognizing that many losses don't start with on-chain transactions but much earlier with malicious apps or phishing sites, OKX has pushed its protection upstream to the device and access point. Its security scanning assistant has performed over 200,000 risk checks, identifying over 60,000 high-risk apps. It has also blocked over 7 million risky website visits targeting phishing sites and malicious DApps, aiming to intercept threats before users even enter their seed phrases or connect their wallets.

Before attackers even reach users, a significant portion of risk is already embedded at a much earlier stage—the software supply chain.

Supply Chain: The Poison Isn't the Package, It's Trust Itself

The unique danger of supply chain poisoning is that the victim didn't make a mistake; they simply installed a dependency, updated a version, or visited an official domain as usual. This is the most heavily detailed chapter in the SlowMist report, with three representative cases illustrating the evolution of this attack vector in breadth, depth, and height.

• Breadth: The Shai-Hulud Worm. In mid-May, an account published 637 malicious versions across 317 package names within 22 minutes, affecting popular components like echarts-for-react (over 3.8 million monthly downloads) and size-sensor (over 4.2 million monthly downloads). The malicious package triggered obfuscated payloads during installation, systematically collecting sensitive information (AWS, GCP, Azure cloud credentials, Kubernetes cluster keys, SSH private keys, etc.) and exfiltrating it encrypted. It also included self-propagation modules for worm-like spread, and pre-installed persistent backdoors targeting Claude Code and VS Code. The theft target was no longer a single software package but the permissions of the entire development pipeline.

• Depth: Chain of Trust Transitivity. In March, the widely used Python library LiteLLM (97 million monthly downloads) was attacked. The attacker didn't directly compromise LiteLLM. Instead, they first poisoned Trivy, a security scanning tool that LiteLLM's build process depends on, using this to steal distribution keys and push a malicious version of LiteLLM. Developers trust LiteLLM, LiteLLM trusts Trivy, and Trivy was compromised. This made a supposed security tool itself a link in the attack chain. Similarly, SlowMist monitored a poisoning of Apifox's official CDN in the same month. The attacker tampered with the official script, embedding malicious code with a randomized timer that could activate 30 minutes to 3 hours after installation, making it difficult for users to link the anomaly to a specific action. This proves that "official source" is no longer synonymous with "safe."

• Height: The Attacker's "Attack Surface Mindset." SlowMist's Chief Information Security Officer, 23pds, warned in April: the Lazarus sub-group HexagonalRodent was using well-paid remote job offers as bait to lure developers into running backdoored code. According to the OKX report, this group extensively uses ChatGPT and Cursor to generate code and scripts, builds fake company websites and executive identities with AI website builders, and even uses AI for "self-auditing" its malicious code to evade detection. In just one quarter, they stole wallet data from over 2,700 developer systems. Meanwhile, AI-generated code itself is creating new risk surfaces. Citing OtterSec data, the OKX report notes that Georgia Tech attributed 35 of the 74 CVEs in March to AI-generated code. A scan of approximately 1,400 "casually generated" applications found 2,038 critical vulnerabilities and over 400 exposed keys. "Functionality works" does not equal "production-ready."

Other similar incidents include node-ipc suddenly releasing an anomalous version after 21 months of inactivity, and the TrapDoor incident involving coordinated poisoning across three major ecosystems. They all point to the same conclusion: while the past focus was on auditing code, the focus now must be on auditing the source of trust. This is especially critical for the Agent ecosystem, as Agents actively read, install, and execute external plugins. Based on this, OKX has established an access control and periodic inspection mechanism for Agentic Wallet plugin integrations, covering code security, permission scopes, and external dependencies, shifting the judgment of "is this dependency trustworthy?" to before the plugin goes live.

AI: From Forging Content to Synthesizing Entire Environments

Tying the previous sections together reveals a hidden thread: the natural trust people place in "smarter systems." The next collective misjudgment currently forming is that Agents are more reliable than humans. This perception hasn't been fully corrected by enough incidents, but the cost is already apparent.

May's Bankr incident is a textbook case of an attack that barely resembles an "invasion." The attacker didn't steal private keys, attack a contract, or hack a server. They simply asked Grok to translate Morse code. BankrBot was an AI Agent deployed on the X platform that could