The crypto industry recorded 182 publicly disclosed security incidents in the first half of 2026, with losses of about $956 million. Yet the number drawing the sharpest warning in two new industry reports was not the top-line loss figure. According to SlowMist, only 18 incidents led to any recovery or freezing of stolen funds, totaling about $118 million, or 12.3% of all losses. Nearly 90% of the money taken in H1 is no longer recoverable.
That comes from one of the central conclusions in the 2026 OKX Web3 Security Mid-Year Report, jointly released by the OKX Web3 security team, SlowMist and OtterSec, alongside SlowMist’s 2026 H1 Blockchain Security and Anti-Money Laundering Report. Though produced by a trading platform and security firms, the reports reach the same view: attacks are happening more often, methods are changing, and targets are moving away from code and toward people.
Losses fell, but attacks did not
By one measure, the first half looked less severe than a year earlier. OKX, citing SlowMist’s hacked-incident archive, said H1 2026 saw 182 incidents and roughly $956 million in losses, compared with 121 incidents and about $2.373 billion in H1 2025. That means incident count rose about 50% year over year while losses fell around 60%.
The reports argue that this decline in losses can be misleading. The main reason is the absence of another outlier on the scale of the February 2025 Bybit case, which cost around $1.5 billion after attackers compromised the computer of a Safe{Wallet} developer tied to Bybit’s signing tooling and tampered with scripts on the official site. Strip that event out, OKX said, and comparable losses in 2026 actually increased.
Breaking the data down by cause produces two very different pictures. By number of incidents, contract and logic flaws remained the biggest category, with 85 cases. By dollar loss, supply-chain attacks ranked first at about $298 million, followed by contract flaws at about $152 million and private key leaks at about $130 million. SlowMist summarized the pattern in eight Chinese characters that translate roughly to this: incidents are more dispersed, losses are more concentrated.
The concentration is especially visible in infrastructure, cross-chain systems and supply chains. Cross-chain bridges accounted for just 20 incidents in the half, but those incidents caused about $346 million in losses.
OKX grouped the shift into three lines: large losses are increasingly happening outside contracts, ordinary users have become a primary target, and AI agents are no longer just tools but targets. Running through all of this are two other threads: supply-chain poisoning in development workflows and the laundering networks where stolen funds ultimately go.
Projects were hit hardest outside the audit perimeter
The reports say many of the worst project-side losses did not come from unaudited smart contracts. They came from the places audits rarely cover: signing procedures, cloud-hosted keys, validator paths and developer devices. An audit can show that a contract’s logic is correct. It cannot show that the operating environment around that contract is safe.
KelpDAO: the validation path, not the contract, broke
This was the largest single loss of the half. OtterSec said attackers poisoned internal LayerZero RPC nodes while launching DDoS attacks against honest external nodes. Cross-chain messages were supposed to be checked across multiple independent nodes, but the bridge was using a “1-of-1” single-validator configuration at the time. The sole validation point received forged data and approved a withdrawal that had no real assets behind it.
About 116,500 rsETH were moved out, and around $75 million was later frozen. SlowMist added that LayerZero attributed the incident to TraderTraitor, a Lazarus sub-group. The stolen tokens were then used as collateral to borrow about $236 million in real assets, WETH, on lending protocols including Aave, at one point raising liquidity concerns across DeFi markets.
Drift: a six-month campaign built on signatures
The biggest lesson in the reports may be that the most expensive flaw was human. Drift Protocol lost about $285 million in an attack that did not rely on breaking a smart contract. Instead, it was a six-month social engineering operation. Attackers posed as a quantitative trading firm, built trust with real deposits of more than $1 million, and induced a multisig signer to pre-sign management transactions using durable nonce.
At the time of signing, the transactions appeared harmless. Later, after the project adjusted its multisig threshold and a window opened without timelock protection, the attackers broadcast the signatures they had collected earlier. In 12 minutes, they executed 31 withdrawals and took more than half of the protocol’s locked assets.
The reports’ point is direct: a transaction that appears to have no effect when signed may still be cashable later. Blind signing, pre-signing and management transactions that cannot be clearly decoded should all be treated as high risk.
Single points of failure kept appearing
Other examples followed the same pattern. Resolv Labs lost control after its AWS cloud keys were stolen, allowing attackers to mint about 80 million unbacked tokens. Step Finance was drained after an executive’s device was compromised and private keys were used to empty the treasury. Humanity Protocol lost control of private keys after a developer machine was infected with malware.
SlowMist said on-chain investigator ZachXBT tracked mixed-fund activity linking proceeds from some of these incidents with the KelpDAO theft, which largely ruled out insider involvement and again pointed toward Lazarus.
The report also listed three lower-level cases where the weakness sat outside what standard code audits usually cover:
- Taiko: On June 22, the project lost about $1.7 million after a signing private key was mistakenly committed to a public GitHub repository. Attackers used it to forge Layer 2 state proofs and trigger fund releases. TAIKO fell more than 20% in the short term.
- SecondFi / former Yoroi: Between June 21 and June 23, attackers stole about $2.4 million after a signing implementation omitted a required random blinding step. A single on-chain signature could reveal a full private key. A total of 374 addresses were compromised. The flaw came from an unaudited third-party component introduced two weeks before the incident.
- THORChain: On May 15, the network lost about $10.7 million. Treasury keys were controlled via threshold signing, intended to stop any one node from ever holding the complete key. A malicious node gradually collected fragments across multiple legitimate signing rounds and eventually reconstructed the full key.
Across cross-chain validation, cloud keys and signature algorithms, the failures looked different but shared the same shape: if a single element on a critical path can independently decide where funds go, attackers will aim there first.
OKX said that principle has shaped its own signing controls. Rather than only checking whether a transaction was initiated by the user, the platform says it focuses on whether the user understands the consequences before signing. Around durable nonce and account ownership change scenarios, OKX said it blocked or warned on more than 4 million high-risk operations in H1, protecting about $526 million in value. It also said it has decoded more than 50,000 on-chain methods to translate raw calldata into plain explanations of what assets and permissions a transaction would change.
Still, the report adds a limit. Such tools can reduce risk, not eliminate it. Wallet providers and trading platforms are themselves among the most valuable targets. Bybit’s 2025 case, after all, was tied to compromised signing tools.
Users became the easier entry point
As attacking protocols directly became more costly, attackers shifted toward users, according to OKX. The entry points were the places where caution is usually lowest: app stores, the top result in search, a friend’s account, meeting software and hiring processes.
Malicious browser extensions and poisoned search ads
One common pattern was a browser extension that stayed clean locally but pulled phishing content from the cloud. The extension package itself contained no obvious malicious logic and could pass static review in an app store. The actual phishing page was served in real time from a remote server and could swap domains at will. SlowMist said it captured one such extension in May that impersonated TronLink. Once users entered a seed phrase, control of funds was effectively gone.
Search-ad poisoning looked even more routine. In one case cited by OKX, a user bought a new computer, searched for a development tool, clicked the paid result at the top of the page and ran an “install command” shown on the site. The command actually deployed clipboard hijacking malware. When the user later sent about $20,000, the recipient address was silently replaced.
What made this type hard to catch is that the victim only did ordinary things: search for the official site, download a tool, copy a command.
Job interview scams and business-process fraud
Recruitment scams followed a reconnaissance-to-profiling-to-targeting sequence. Attackers used a technical interview as cover, asked candidates to share screens and open a wallet to “verify DeFi experience,” then collected wallet addresses, balances and commonly used protocols. Later they forged airdrop pages or tailored phishing messages around protocols the victim had actually used. One case in the report ended with a loss of about $88,000.
Another category was business-process fraud. Attackers used pretexts such as “external audit” or “token vesting confirmation” to send malicious attachments. SlowMist analyzed one sample that used a double extension to disguise a script as a document. Once opened, it posed as a system update, stole passwords and requested access to the camera, screen recording and keystroke monitoring. The goal in those cases was often not a personal wallet but access to office endpoints and cloud services.
Any page asking for a seed phrase is a scam
Both reports delivered the same bottom-line message: any page that asks users to enter a seed phrase for verification, authentication, recovery or upgrade is fraudulent. A seed phrase is not a code. It is the asset control itself. Legitimate wallets do not ask for seed phrases on web pages.
Because many losses begin before any on-chain transaction takes place, OKX said it has moved defenses upstream to devices and access points. Its security scanning assistant completed more than 200,000 risk checks and found more than 60,000 high-risk apps, according to the report. It also blocked more than 7 million visits to risky sites tied to phishing pages and malicious dApps, with the aim of stopping users before they enter a seed phrase or connect a wallet.
Supply-chain attacks poisoned trust itself
The defining feature of supply-chain poisoning is that victims may make no visible mistake at all. They simply install a dependency, update a version or visit an official domain. SlowMist devoted its heaviest coverage to this chapter and laid out three dimensions of change: breadth, depth and elevation.
Breadth: the Shai-Hulud worm
In mid-May, one account published 637 malicious versions spanning 317 package names in just 22 minutes. The blast radius included popular components such as echarts-for-react, with more than 3.8 million monthly downloads, and size-sensor, with more than 4.2 million monthly downloads.
The malicious packages triggered obfuscated payloads at install time, systematically collected AWS, GCP and Azure credentials, Kubernetes cluster keys and SSH private keys, encrypted the data and sent it out. They also included self-propagation features and persistence mechanisms aimed at Claude Code and VS Code. The target was no longer one software package. It was the permissions around an entire development pipeline.
Depth: trust chains passed compromise forward
In March, the Python library LiteLLM, which logs 97 million monthly downloads, was hit. Attackers did not break into LiteLLM directly. They first poisoned Trivy, the security scanning tool used in its build process, stole release keys and then pushed malicious versions. Developers trusted LiteLLM. LiteLLM trusted Trivy. Trivy had already been compromised. A tool meant to defend the supply chain became part of the attack chain.
SlowMist said an Apifox official CDN poisoning case detected in the same month followed a similar path. Attackers tampered with official scripts and inserted malicious code with randomized timers that triggered 30 minutes to three hours after installation, making it difficult for users to connect abnormal behavior back to a specific action. The implication is plain: “official source” no longer guarantees safety.
Elevation: attackers now think in attack surfaces, with AI help
SlowMist Chief Information Security Officer 23pds warned in April that the Lazarus subgroup HexagonalRodent was using high-paying remote job offers to lure developers into running backdoored code. According to the OKX report, the group relied heavily on ChatGPT and Cursor to generate code and scripts, used AI website-building tools to fabricate company sites and executive identities, and even used AI to review its own malware to avoid detection. In one quarter alone, it stole wallet data from more than 2,700 developer systems.
At the same time, AI-generated code has become a risk source of its own. Citing OtterSec data, OKX said Georgia Tech attributed 35 of 74 CVEs in March to AI-generated code. A separate scan of about 1,400 casually generated applications found 2,038 severe vulnerabilities and more than 400 exposed keys. Functional code, the report says, is not the same as production-ready code.
Other incidents in the same mold included an abnormal version of node-ipc that appeared after 21 months without updates, and TrapDoor, which coordinated poisoning across three ecosystems. The reports’ shared conclusion is that security teams once focused on auditing code. Now they also have to audit the source of trust. That is especially true in agent ecosystems, where software actively reads, installs and executes external plugins. OKX said its Agentic Wallet plugin onboarding process now includes admission review and periodic inspection across code safety, permission scope and external dependencies.
AI expanded phishing from fake content to fake environments
Threaded through all of this is a broader shift: trust in systems that appear more intelligent. The next collective mistake, the reports suggest, is the assumption that agents are more reliable than people.
The Bankr incident in May illustrated that risk in an unusual way. Attackers did not steal a private key, exploit a contract or breach a server. They simply asked Grok to translate a Morse code message. BankrBot, deployed on X, was an AI agent able to execute on-chain trades based on natural-language instructions.
SlowMist said the attackers first airdropped a membership NFT into a connected wallet to trigger a high-privilege mode. They then sent a Morse code message and asked Grok to translate it. Grok decoded the message and posted the hidden transfer instruction in plain text while tagging BankrBot. The bot treated the message as trusted input and executed it, transferring about 3 billion DRB tokens. The loss was estimated at about $150,000 to $200,000, with SlowMist recording about $175,000. Around 80% was later recovered.
There was no classic vulnerability in either Grok or BankrBot. The failure sat in an unverified trust boundary between two automated systems. Once an agent can sign and move funds, a malicious instruction disguised as normal input can become a real asset loss.
SlowMist divided attacks on agents into four layers, each backed by real cases:
- Input layer: indirect prompt injection, where malicious instructions are embedded in external content an agent is designed to read. Bankr fell into this category.
- Memory layer: memory poisoning. Palo Alto Networks Unit 42 showed that a malicious rule can be written into an agent’s long-term memory, such as labeling the attacker’s address as a “frequently used recipient,” and continue to shape future sessions.
- Tool layer: privilege penetration. In the OpenClaw “Claw Chain” incident disclosed in May, security firm Cyera found four chainable vulnerabilities, the highest rated at CVSS 9.6, that could escalate into full control of the execution environment.
- Supply-chain layer: OpenClaw’s plugin hub lacked review. Malicious skills were disguised as functional documentation, used encoded commands and employed a two-stage model to pull the true payload remotely.
AI also changed phishing at a deeper level by turning scams from single fake messages into fully managed synthetic realities. Citing Check Point, the OKX report described an operation called “The Truman World,” where attackers drew victims into a private investment group. The “experts” and “investors” in the group were all AI personas posting analysis, showing profits and interacting in real time. The victim was not facing one scammer. The victim was facing an entire fabricated social environment.
The Singapore video-conference case mentioned at the outset is an extreme version of the same playbook. A victim was invited into a meeting where the prime minister, the president and representatives of the Monetary Authority of Singapore all appeared on screen through AI-generated video. The loss totaled about S$4.9 million.
That changes what must be defended. The target is no longer just a user’s judgment of one suspicious message. It is the user’s belief that the broader environment is real. And once machines begin making decisions for people, the risk boundary extends beyond humans to every default trust link, including machine-to-machine trust.
On mitigation, the reports converge again. Agents can organize transactions more intelligently, but execution must be bound by stricter controls. SlowMist said its MistEye Security Gate gives coding agents such as Claude Code and Cursor a hard “detect first, execute later” block. MistTrack Skills, it said, screens anti-money-laundering risks before transfers using more than 400 million labeled on-chain addresses across 19 major public chains. OKX said it follows a similar rule: no matter how a transaction is generated, it goes through an independent risk check before signing and broadcasting, with risky activity either requiring an extra confirmation or being blocked outright.
Only about 12% was recoverable as laundering grew industrialized
The anti-money-laundering and regulatory chapter, mainly drawn from SlowMist’s tracking, returns to the same headline number. Only 18 incidents in H1 resulted in funds being recovered or frozen. Those incidents involved about $389 million in stolen assets, of which roughly $118 million was recovered or frozen. That is 12.3% of total losses.
The reason most stolen funds vanish quickly, the report argues, is that laundering has become highly industrialized. Using Lazarus as an example, the laundering path is layered and deliberate. Funds are first routed through privacy protocols such as Umbra to break on-chain traces, then swapped into bitcoin through no-KYC cross-chain channels such as THORChain, then dispersed across thousands of fresh addresses and processed through mixers including Sinbad, YoMix and Wasabi. The end point is offshore fiat conversion through Chinese OTC desks or Russian exchange networks such as Garantex and its successor Grinex. If the stolen asset is a token like rsETH, the path may start with borrowing real assets against it on DeFi protocols before any swap takes place, as in the KelpDAO case.
Once funds enter cross-chain and mixing channels, the recovery window is largely closed.
Flows into privacy protocols offer another signal. Based on Dune data, SlowMist said major privacy protocols received about $974 million in inflows in H1. Tornado Cash accounted for roughly 71%, while Railgun accounted for about 23%, with nearly 90% of Railgun’s inflows coming in stablecoins.
Criminal tooling has also become service-based. SlowMist said Rublevka Team, a drain-as-a-service platform it tracks, has stolen more than $10 million since 2023, completed at least 240,000 successful thefts and offered affiliates revenue shares as high as 80%. StepDrainer openly priced a full phishing toolkit, with complete source code selling for about $750. The barrier to obtaining attack tools has become very low.
Regulators are tightening around key laundering channels
SlowMist’s policy review showed several moves directly aimed at those laundering routes. The European Union’s 20th sanctions package against Russia included a first full ban on dealing with crypto service providers located in Russia, directly affecting off-ramp channels such as Garantex and Grinex. Dubai DIFC fully banned privacy-coin trading, targeting the mixing stage. In China, a February rule issued by eight departments said that stablecoins pegged to the renminbi cannot be issued overseas without approval.
Other measures moved in the same direction. Hong Kong granted its first batch of stablecoin issuer licenses. South Korea is considering fines on hacked exchanges of up to 10% of the amount stolen. The U.S. GENIUS Act put in place its first stablecoin rule set.
OKX added that its KYS risk controls continuously identify suspicious addresses, malicious tokens and dangerous approvals in an effort to flag risk before funds enter mixers or cross-chain channels.
The line of defense is moving to the moment before confirmation
The reports close with a simple observation: by the time a signer hits confirm, most defenses may already be irrelevant. Many of the first-half lessons happened before that click. Someone signed a transaction they did not understand. A system granted too much privilege. A team trusted the wrong data source. A user believed a disguise that was realistic enough.
Whether framed as OKX’s “understand before you sign, avoid single points of failure, verify before trusting” or SlowMist’s “verify first, trust later,” the direction is the same. Judgment has to move upstream, before action.
For projects, the reports say it is no longer enough to check who signed. Teams also have to check whether the signer understood what the signature would do. Multisig changes, contract upgrades, owner changes and cross-chain configuration should all be decodable, simulatable and reviewable. Large fund movements and permission changes should carry timelocks and anomaly alerts. No single RPC endpoint, validator, cloud key or admin address should be able to determine fund flow on its own. Dependency scanning should be routine, and any request touching funds, permissions or deployment should not be verified through one channel alone. A video call or a familiar social account is not identity proof.
For ordinary users, the reports draw a blunt line: do not sign what you do not understand. Separate wallets that hold large assets from wallets used for everyday interaction. Revoke unused approvals regularly. Treat unlimited approvals and actions such as Permit and Permit2 with special caution. Many attacks, the reports note, do not move assets immediately; they first obtain permission and wait. Any page asking for a seed phrase is a scam. Any request for remote control, screen sharing, unfamiliar meeting software or terminal commands should be verified first.
For agent users and developers, the reports say input filtering, sandboxed tool use, permission tiers, secondary confirmation for sensitive actions and pre-execution verification are baseline requirements for any agent that can hold funds. System prompts should not be treated as the security control. Agents can generate plans, but authorization should come from rigid rule systems that do not bend.
The bottom line in both reports is that H1 2026 was not a broad improvement in crypto security. It was a systemic migration in attack style, away from contract code and toward people, infrastructure and trust itself. In an environment where AI can fabricate not just content but context, what needs verification is no longer one message. It is the environment around it.