Security

Blockchain intelligence firm TRM Labs reports that North Korean state-backed hackers stole approximately $577 million in 2026 — 76% of all crypto hack losses — across just two attacks: the Drift Protocol and Kelp DAO exploits.

Wasabi Protocol's deployer EOA held the only ADMIN_ROLE for the entire permission system, and an attacker drained roughly $4.55 million from perp vaults across four chains. The vulnerability was governance, not code.

Grinex, the sanctioned successor to Garantex, has suspended operations after attackers drained approximately $15 million from its systems. The exchange blamed 'foreign intelligence agencies' — a claim blockchain forensics firms have not corroborated.

Two incidents of internal staff accessing and leaking client data have armed a criminal group with KYC documentation and transaction records. Kraken says it will not pay and is working with law enforcement.

A week-long international enforcement campaign led by the US Secret Service and the UK's National Crime Agency traced $45 million in crypto fraud, froze $12 million, and disrupted over 120 scam domains.

The second-largest crypto exchange by volume says its internal controls caught a batch-transaction exploit modelled on the techniques that took down Mt. Gox, preventing what would have been one of the largest attempted thefts from a centralised venue.

America's largest bitcoin ATM operator revealed that attackers stole 50.9 BTC from its corporate settlement wallets in late March after compromising internal credentials, prompting an FBI investigation and a material event filing with the SEC.

Five days after North Korean hackers drained $270 million from Drift Protocol using social engineering and durable nonces, the Solana Foundation has unveiled STRIDE and the Solana Incident Response Network to overhaul ecosystem security.

Hackers compromise Curve's nameserver and redirect users to a cloned site, stealing $575K in approvals before the team regains control and directs users to curve.finance.

Badger DAO lost $120 million when attackers compromised its web interface, injecting malicious code that redirected user approvals to attacker-controlled addresses during fund transfers.

Upbit, a South Korean cryptocurrency exchange, lost approximately 342,000 ethereum worth $49 million in an abnormal transaction that transferred funds from the exchange's hot wallet to an unknown address on November 26.

Hackers stole approximately 7,000 bitcoin worth $40.7 million from Binance, the world's largest cryptocurrency exchange by trading volume, in a coordinated attack that exploited API keys and two-factor authentication codes.

QuadrigaCX discovered after its founder Gerald Cotten died that approximately $190 million in cryptocurrency held in cold storage wallets remained inaccessible because Cotten alone possessed the passwords and recovery keys required to unlock the encrypted systems.

Bitfinex introduced BFX tokens as a creative compensation mechanism for users whose bitcoin were stolen in the August 2016 hack, converting customer losses into equity-like claims.

The Bitfinex cryptocurrency exchange suffered a major security breach resulting in the theft of approximately 120,000 bitcoin, valued at around $72 million at the time.

An unknown attacker exploited a vulnerability in The DAO's smart contract code, draining approximately $60 million worth of ether tokens in a matter of hours.

ShapeShift, a cryptocurrency exchange platform, recovered from a security breach involving approximately $230,000 in stolen cryptocurrency, implementing new security measures.