Nearly 90% of Stolen Funds Cannot Be Recovered: Web3 Attack Targets Shifting from "Code" to "People" in the First Half of 2026

In the first half of 2026, the crypto industry experienced a total of 182 public security incidents, with losses of approximately $956 million. More alarming than the total loss amount is the destination of the funds: according to SlowMist statistics, stolen funds were recovered or frozen in only 18 incidents in the first half, totaling about $118 million, accounting for 12.3% of total losses. The remaining nearly 90% of stolen funds are irrecoverable.

Another figure is easily misread: $956 million represents a nearly 60% decrease compared to the same period last year, but this does not mean the industry has become safer. The decline in losses almost entirely stems from the non-recurrence of last year's single massive Bybit incident (approximately $1.5 billion); the number of incidents actually increased by about 50% year-over-year. Attacks have not weakened but have changed direction—from targeting protocol contracts to targeting people.

The two largest attacks in terms of losses in the first half did not succeed by breaching smart contracts: Drift Protocol lost about $285 million due to a six-month social engineering infiltration, starting with a few "uninfluential" transactions signed by a multi-sig signer; a victim in Singapore was invited to a video conference where all government officials were AI-generated, losing about 4.9 million SGD. The most expensive vulnerability appeared in people.

This is one of the core judgments of the "2026 OKX Web3 Security Semi-Annual Report" released jointly by the OKX Web3 Security Team, SlowMist, and OtterSec, sharing the same conclusion as the "2026 First Half Blockchain Security and Anti-Money Laundering Report" released by SlowMist during the same period. The two reports come from a trading platform and a security company respectively, but point to the same judgment: the frequency of attacks is rising, methods are evolving, and targets are shifting from "code" to "people".

Losses Down Nearly 60% YoY, Attack Activities Rise Instead of Fall

The same set of data, split by different calibers, yields opposite conclusions; this is the premise for understanding the security posture of this half-year.

According to OKX report citing SlowMist's Hacked Archive statistics, there were 182 incidents in the first half with losses of about $956 million; for the same period in 2025, it was 121 incidents and about $2.373 billion. The number of incidents increased by about 50% YoY, while the amount decreased by about 60% YoY. The main reason for the decline in amount is that the February 2025 Bybit incident (approximately $1.5 billion, hackers compromised the computer of Safe{Wallet} developer for its signing tool and tampered with official website scripts) was an extreme case. OKX report's judgment on this is: excluding this outlier, comparable losses this year have risen instead of fallen.

OKX report further split by attack cause using dual calibers: by number of incidents, contract and logic vulnerabilities remain the top cause, totaling 85 incidents; but by loss amount, supply chain attacks rank first with about $298 million, followed by contract vulnerabilities (about $152 million) and private key leaks (about $130 million). SlowMist summarizes this characteristic in eight characters: Decentralized incidents, concentrated losses. Among these, truly fatal large losses are concentrating on key links such as infrastructure, cross-chain, and supply chains. An unbalanced footnote is: cross-chain bridges experienced only 20 incidents in the half-year, yet caused about $346 million in losses.

Funds are no longer primarily lost from contract vulnerabilities. OKX report summarizes the changes in this half-year into three main lines: Large losses increasingly occur outside contracts; ordinary users become primary attack targets; AI Agents shift from tools to prey. Additionally, there are two threads running throughout: supply chain poisoning penetrating development links, and the money laundering downstream where all stolen funds eventually flow. These are expanded upon below.

Project Teams: The Largest Losses Occur Where Audits Cannot Reach

Projects with the most severe losses in the first half were mostly not unaudited; the points of failure were precisely outside the audit scope: signing processes, cloud keys, validation nodes, developer devices. Audits can prove contract logic is correct, but cannot prove these operational links are secure.

KelpDAO: It Was Not the Contract That Was Breached, But the Verification Path. This was the largest single loss in the first half. According to OtterSec's review, attackers polluted LayerZero internal RPC nodes on one side while launching DDoS against honest external nodes on the other. Cross-chain messages should have been cross-validated by multiple independent nodes, but the bridge当时 adopted a "1-of-1" single validation node configuration. The only validation point received forged data, ultimately approving a withdrawal without real asset backing; about 116,500 rsETH were transferred out, of which about $75 million was frozen afterwards. Single validation nodes have long been considered a high-risk configuration; in the past, this was just a theoretical hint in architecture reviews, but after the KelpDAO incident, it became a realistic loss of nearly $300 million. SlowMist added details on the whereabouts of the stolen funds: LayerZero attributed the incident to Lazarus subgroup TraderTraitor; the stolen tokens were subsequently used as collateral to borrow about $236 million in real assets (WETH) on lending platforms like Aave, once triggering a liquidity crisis in the DeFi market.

Drift: A Six-Month-Long Signature Inducement. Its mechanism is worth explaining: durable nonce is equivalent to a transaction credential "pre-signed and redeemable at any future time". Attackers operated trust for half a year disguised as a quantitative institution with over $1 million in real deposits, inducing signers to pre-sign such management transactions. There was no visible impact at the time of signing; when the project team subsequently adjusted the multi-sig threshold, creating a window lacking timelock (timelock: sensitive operations must be publicly disclosed and delayed before taking effect) protection, attackers broadcast the pre-obtained signed transactions, completing 31 withdrawals in 12 minutes and making off with over half of the locked assets. The core lesson of this incident is: transactions that have "no impact" at the time of signing do not mean they won't be redeemed in the future; blind signing, pre-signing, and unparseable management transactions should all be treated as high-risk operations.

Portrait of Single Point Failures. Resolv Labs' AWS cloud keys were stolen, attackers used this to mint about 80 million unpegged tokens; Step Finance was due to executive devices being compromised, private keys used to empty treasuries; Humanity Protocol was due to developer devices infected with malware, private keys lost control. SlowMist mentioned that on-chain analyst ZachXBT tracked and found mixing behavior between its stolen funds and KelpDAO stolen funds, basically ruling out internal作案 (internal crime), pointing again to Lazarus.

SlowMist report also recorded a set of more underlying cases, pushing attacks down to the cryptography engineering implementation level. The common point of the three incidents is: vulnerabilities were not within the regular coverage scope of code audits.

• Taiko (June 22, about $1.7 million): A signing private key was mistakenly submitted to a public GitHub repository, attackers used this to forge Layer 2 network state proofs and trick funds release, TAIKO token fell over 20% in the short term.
• SecondFi / formerly Yoroi (June 21–23, about $2.4 million): Signature algorithm implementation lacked a necessary random masking step, resulting in complete private keys being deduced from a single on-chain signature, 374 addresses were stolen. The defect originated from an unaudited third-party component introduced two weeks before the incident.
• THORChain (May 15, about $10.7 million): Treasury private keys were co-managed by multiple nodes (threshold signing), intending that no single node holds the complete private key; but a malicious node gradually collected key fragments during multiple normal signing processes, ultimately reconstructing the complete private key.

From cross-chain verification, cloud keys to signature algorithms, these cases present different forms of the same failure: As long as there is a node on the critical path that can independently decide the destination of funds, it will become the attacker's preferred target.

Based on the same judgment, OKX not only verifies "whether the transaction was initiated by the user himself" in signature risk control, but focuses more on letting users understand transaction consequences before signing.围绕着 durable nonce, account ownership changes and other high-risk scenarios, OKX intercepted or warned related high-risk operations over 4 million times cumulatively in the first half, protecting amounts totaling about $526 million, and has parsed over 50,000 types of on-chain methods, translating hard-to-read calldata into "which assets this transaction will change, what permissions will be granted". It needs to be pointed out that such capabilities can only reduce rather than eliminate risk; trading platforms and wallet service providers themselves are the highest value attack targets, the 2025 Bybit incident was precisely due to breaching signing tools, no party can claim immunity.

User Side: Attacks Start at the Most Familiar Entry Points

When the cost of attacking protocols rises, attackers turn to users. According to OKX report, attack entry points nowadays are mostly scenarios where users are least guarded: app stores, top search results, friend accounts, meeting software, recruitment processes.

• Malicious Browser Extensions adopt a "local shell holding, cloud poisoning" model: the extension body contains no malicious logic and can pass static review by app stores; the real phishing pages are issued in real-time by remote servers and can change domains at any time (SlowMist captured a similar extension impersonating TronLink in May). Once users enter mnemonic phrases on such pages, asset control rights are handed over.
• Search Ad Poisoning is closer to daily operations. In a case recorded by OKX report, a user searched for development tools after purchasing a new computer, clicked the paid ad at the top of search results, and executed an "installation command" in the terminal as prompted by the page, but the command actually deployed a clipboard hijacking trojan; afterwards when the user transferred about $20,000, the recipient address was automatically replaced. The difficulty in defending against such attacks lies in: victims only performed routine operations throughout like "searching official website, downloading tools, copying commands".
• Recruitment Interview Scams follow a "reconnaissance—profiling—targeted strike" path: attackers use technical interviews as a name, requiring applicants to share screens and open wallets to "confirm DeFi usage experience", actually recording their wallet addresses, holdings, and commonly used protocols; subsequently forging airdrop pages targeting protocols actually used by victims and deploying customized phishing information. In a case recorded by OKX report, victims lost about $88,000 due to this.

Two other new methods deserve attention. One is fake "2FA Security Verification": attackers send emails in the name of wallet officials, using impersonating domains differing from the official by only one character, supplemented by countdowns to create urgency, inducing users to enter mnemonic phrases to "complete verification". The other is business process fraud: delivering malicious attachments using business scenarios like "external audit", "token vesting confirmation" as bait (a sample analyzed by SlowMist disguised scripts as documents with double extensions), after opening 伪装 (disguising) as system updates to steal passwords, then applying for camera, screen recording and keyboard listening permissions, their ultimate target is often office terminals and cloud service permissions, rather than personal wallets.

Regarding the former, both reports give a consistent bottom-line warning:

Any page requiring input of mnemonic phrases for verification, authentication, recovery, or upgrade is a scam. Mnemonic phrases are not verification codes, but asset control rights themselves; no legitimate wallet will request mnemonic phrases via a webpage.

Since many losses do not start with on-chain transactions, but start with earlier malicious applications or phishing websites, OKX has moved protection forward to devices and access entry points: its security scanning assistant cumulatively completed over 200,000 risk detections, discovering over 60,000 high-risk applications; targeting phishing websites and malicious DApps, cumulatively intercepted over 7 million risky website accesses, striving to complete interception before users enter mnemonic phrases or connect wallets.

And before attackers contact users, a significant portion of risks are already buried in upstream links—software supply chains.

Supply Chain: It Is Not the Software Package That Is Poisoned, But Trust Itself

The specificity of supply chain poisoning lies in: victims make no mistakes, just normally installing a dependency, updating a version, or visiting an official domain. This is the chapter SlowMist report focused on most heavily, three representative cases respectively reflect the evolution of such attacks in breadth, depth, and height.

• Breadth: Shai-Hulud Worm. Mid-May, an account released 637 malicious versions involving 317 package names within 22 minutes, affecting popular components like echarts-for-react (monthly downloads over 3.8 million), size-sensor (monthly downloads over 4.2 million). Malicious packages trigger obfuscated payloads during installation, systematically collecting AWS, GCP, Azure cloud credentials, Kubernetes cluster keys, SSH private keys and other sensitive information and encrypting for exfiltration, simultaneously building-in self-propagation modules to achieve worm-like diffusion, and pre-setting persistence mechanisms targeting Claude Code, VS Code. Its theft target is no longer a single software package, but permissions for the entire development pipeline.
• Depth: Layered Transmission of Trust Chains. In March, Python library LiteLLM with monthly downloads reaching 97 million was attacked. Attackers did not directly invade the library, but first polluted Trivy, a security scanning tool relied upon by its build process, using this to steal release keys and push malicious versions. Developers trust LiteLLM, LiteLLM trusts Trivy, and Trivy has been compromised, letting security tools that should bear protection responsibilities instead become a link in the attack chain. Apifox official CDN poisoning monitored by SlowMist in the same month also belongs to the same category: attackers tampered with official scripts, implanted malicious code with random timers, triggering half an hour to three hours after installation, making it difficult for users to associate anomalies with specific operations. This indicates that "official source" is no longer fully equivalent to "secure".
• Height: Attackers' "Attack Surface Thinking". SlowMist Chief Information Security Officer 23pds warned in April: Lazarus subgroup HexagonalRodent used high-salary remote positions as bait, inducing developers to run code containing backdoors. According to OKX report, the organization heavily leveraged ChatGPT, Cursor to generate code and scripts, used AI website building tools to forge company official websites and executive identities, even utilized AI to "self-check" its own malicious code to evade detection; stealing wallet data from over 2,700 developer systems in just one quarter. Meanwhile, AI-generated code itself is also creating new risk surfaces, according to OKX report citing OtterSec data: Georgia Tech attributed 35 of 74 CVEs in March to AI-generated code, a scan targeting about 1,400 "casually generated" applications discovered 2,038 severe vulnerabilities and over 400 exposed keys. "Functionally usable" is not equivalent to "ready for production environment".

Similar incidents include node-ipc which suddenly appeared with abnormal versions after 21 months of discontinuation, TrapDoor coordinating poisoning across three major ecosystems, etc. They all point to one conclusion: in the past the focus of protection was auditing code, now it must audit the source of trust. This point is especially critical for the Agent ecosystem, Agents will actively read, install and execute external plugins. Based on this, OKX established admission audits and regular inspection mechanisms covering code security, permission scope and external dependencies for plugin access in Agentic Wallet, moving the judgment of "whether dependencies are trustworthy" forward to before plugins go live.

AI: From Forging Single Content to Synthesizing Entire Environments

Connecting the previous content, we can see an implicit main line: there is natural trust in "smarter systems". And the next collective misjudgment forming is: Agents are more reliable than humans. This cognition has not been corrected by enough accidents yet, but the cost has already appeared.

The Bankr incident in May is a case almost unlike an "intrusion": attackers did not steal private keys, did not attack contracts, did not invade servers, just asked Grok to translate a piece of Morse code. BankrBot is an AI Agent deployed on X platform capable of automatically executing on-chain transactions based on natural language instructions. According to SlowMist's review, attackers first airdropped a member NFT to the associated wallet, triggering its high-permission mode, then sent a Morse code message asking Grok to translate; after Grok completed decoding it @BankrBot, outputting the hidden transfer instruction (about 3 billion DRB tokens) within in plaintext, BankrBot treated it as a trusted instruction and executed it directly. Losses of about $150,000 to $200,000 (SlowMist recorded as about $175,000), about 80% recovered afterwards. Grok and BankrBot had no vulnerabilities in the traditional sense, what truly failed was the unverified trust boundary between two automated systems. When Agents possess signing and transfer capabilities, a malicious instruction disguised as normal input can convert into a real asset loss.

SlowMist divides attacks against Agents by their chain from cognition to execution into four layers, each layer has real cases corresponding:

• Input Layer: Indirect Prompt Injection. Embedding malicious instructions into external content Agents will actively read, the Bankr incident belongs to this category.
• Memory Layer: Memory Poisoning. Palo Alto Networks Unit 42 verification shows, malicious rules can be written into Agent's long-term memory (such as marking attacker addresses as "common收款 (collection) addresses"), and continue to take effect in subsequent sessions.
• Tool Layer: Permission Penetration. In the OpenClaw "Claw Chain" incident disclosed in May, security company Cyera discovered four vulnerabilities that could be chained (highest risk rating CVSS 9.6), which could be gradually chained into complete control over the execution environment.
• Supply Chain Layer: OpenClaw plugin center lacks audits, malicious skills disguised as function description documents, hiding commands with encoding, and adopting "two-stage" to dynamically pull real malicious payloads from remote.

AI's deeper change to phishing scenarios is upgrading fraud from "forging single content" to operating a whole set of "synthetic reality". According to OKX report recounting Check Point's disclosed "Truman Show" operation, attackers lured victims into a private investment group, "experts" and "investors" within the group were all played by AI, continuously publishing analysis, showing returns and interacting in real-time; what victims faced was not a single liar, but a forged environment with complete social and trust structures. The Singapore video conference case mentioned at the beginning of this article (AI-generated Prime Minister, President and Monetary Authority representatives present simultaneously, losses of about 4.9 million SGD) is an extreme form of the same technique.

Thus, attack targets have fundamentally shifted: what needs to be deceived is no longer users' judgment on single pieces of information, but their cognition of overall environment authenticity. The judgment "vulnerabilities appear in people" should also be further extended, when machines start making judgments instead of people, risk boundaries expand from "people" to all links defaulted as trusted, including trust boundaries between machines. Traditional "identify suspicious information" style defense is failing.

In terms of response, the industry has formed a consensus: Agents can organize transactions more intelligently, but their execution links must be subject to stricter constraints. SlowMist embeds security capabilities into Agent operation processes, its MistEye Security Gate provides "detect first, execute later" hard blocking mechanisms for coding agents like Claude Code, Cursor, MistTrack Skills relies on over 400 million on-chain address labels, covering 19 mainstream public chains, completing anti-money laundering risk screening before transfers. OKX's thinking is similarly not entrusting security completely to Agent's own judgment: regardless of how transactions are generated, an independent risk detection will be performed before signing and broadcasting, once judged to exist risk requiring secondary confirmation or direct interception.

VI. Fund Flow: Only About 12% Recoverable, Money Laundering Highly Industrialized

Returning to the opening figures. The anti-money laundering and regulatory data in this chapter mainly come from SlowMist report's tracking: incidents where funds could be recovered or frozen in the first half were only 18, involving stolen about $389 million, recovered or frozen about $118 million, accounting for 12.3% of total losses. The vast majority of stolen funds are difficult to recover once transferred out, the fundamental reason lies in its downstream money laundering links having become highly industrialized.

Taking Lazarus as an example, its money laundering links are interlocked: first cutting off on-chain associations through privacy protocols like Umbra, then exchanging into Bitcoin via non-KYC cross-chain protocols like THORChain (liquidity is abundant and easy to split), subsequently dispersing funds to thousands of new addresses, processing through mixing services like Sinbad, YoMix, Wasabi, finally exchanging offshore into fiat via Chinese OTC counters or Russian exchange networks (like Garantex and its successor Grinex). If stolen assets are tokens like rsETH, they will first be mortgaged in DeFi protocols to borrow real assets before exchanging, KelpDAO stolen funds followed this path precisely. Once funds enter cross-chain and mixing links, the recovery window basically closes.

Fund inflows into privacy protocols constitute side confirmation: according to SlowMist's statistics based on Dune, major privacy protocols cumulatively inflowed about $974 million in the first half, of which Tornado Cash accounted for about 71%, Railgun accounted for about 23% and nearly 90% of its inflows were stablecoins. The other end of black industry reflects as tool "servitization": in Drain-as-a-Service platforms tracked by SlowMist, Rublevka Team cumulatively stole over $10 million since 2023, completing at least 240,000 successful thefts, and providing up to 80% sharing to downlines; StepDrainer prices the whole set of phishing tools clearly, complete source code about $750. The acquisition threshold for attack tools has dropped to extremely low levels.

Regulatory constraints are also tightening, and beginning to precisely point at key nodes of money laundering channels. In the dynamics sorted out by SlowMist, there are three most directly acting on the above links: EU's 20th round of sanctions on Russia首次 (for the first time) comprehensively prohibited transactions with crypto service providers within Russia, directly pointing at cash-out channels like Garantex, Grinex; Dubai DIFC comprehensively prohibited privacy coin trading, targeting the mixing link; China's eight departments February new regulations首次 (for the first time) clearly stated stablecoins pegged to RMB shall not be issued offshore without approval. Other measures also advance in the same direction, Hong Kong issued first batch of stablecoin issuer licenses, South Korea plans to fine exchanges hacked up to 10% of stolen amount, US GENIUS Act landed first stablecoin rules. The starting point of money laundering links is often a malicious address or a high-risk authorization, OKX report also emphasizes, its KYS risk capabilities will continuously identify abnormal addresses, malicious tokens and high-risk authorizations, striving to complete risk marking before funds enter mixing and cross-chain channels.

VII. Conclusion: Move the Defense Line Forward Before Confirmation

At the moment the Drift signer pressed the confirm button, all defenses had lost meaning. Most lessons in the first half of 2026 occurred before the "confirm" action: someone signed transactions they did not understand, some systems granted excessive permissions, some teams trusted wrong data sources, some users believed a sufficiently realistic disguise.

Whether it is OKX's proposal of "understand before signing, avoid single point risks, verify before trusting", or SlowMist's throughout the article "verify first, trust later" thinking, ultimately point to the same direction: move judgment forward before actions occur. Based on this can be summarized into three lists.

For Project Teams: Critical transactions should not only confirm "who signed", but must confirm "whether the signer understands the consequences". Multi-sig, contract upgrades, Owner changes, cross-chain configurations and other operations should have parseable, simulatable, reviewable processes; large fund outflows and permission changes should set timelocks and anomaly alerts. No single link should independently decide the destination of funds, such as an RPC, a validation node, a cloud key or an admin address. Dependency scanning should be incorporated into normalized processes; requests involving funds, permissions and deployment should not be confirmed via only a single channel, video conferences and friend accounts do not constitute identity proof.

For Ordinary Users: Transactions that cannot be understood should not be signed. Large assets and daily interaction wallets should be stored separately, unused authorizations should be revoked regularly, especially cautious regarding infinite quota authorizations, Permit/Permit2 and other operations, most attacks do not immediately transfer assets, but first obtain authorization, then wait for opportunities. Any page requesting mnemonic phrases is a scam; any request requiring remote control, screen sharing, installing unfamiliar meeting software or executing terminal commands should be verified first.

For Agent Users and Developers: Input filtering, tool call sandboxes, permission grading, secondary confirmation for sensitive operations and pre-execution verification are basic configurations for any Agent capable of holding funds, not options. System prompts should not be treated as security control means; Agents should be responsible for generating schemes, while non-negotiable rule systems are responsible for authorization.

The first half of 2026 was not an overall improvement in security situation, but a systemic migration of attack paradigms, from contract code, to people, infrastructure and trust itself outside code. In an era where synthetic reality becomes possible, what needs verifying is no longer a single piece of information, but the environment itself. The goal of security is never to require every participant to become an expert, but to intercept risks before confirmation at their most error-prone links.

What needs repairing most in the first half of 2026 is not a certain contract, but people and processes themselves.