Q1 2026 saw $450M stolen in 145 crypto incidents despite a 89% drop in smart contract exploits. Social engineering accounted for two-thirds of losses, including a 6-month DPRK operation against Drift Protocol.
The U.S. Treasury recommended a digital-asset-specific law allowing exchanges to temporarily freeze funds linked to suspected illegal activity without a court order, as part of a March 2026 report under the GENIUS Act. It also urged clearer DeFi AML rules and addressed mixer risks.
The Ethereum Foundation's ETH Rangers program concluded after 6 months: 17 researchers recovered or froze over $5.8M, documented 785 bugs, and identified roughly 100 North Korean IT workers infiltrating Web3 projects.
A Zerion team member's device was compromised in a North Korean AI-assisted social engineering attack, resulting in a $100K hot wallet loss. User funds remain safe due to self-custody architecture.
On-chain sleuth ZachXBT exposed a DPRK fake IT worker network making $1M monthly, after a leaked internal payment server with default password '123456'.
Elliptic said multiple on-chain indicators in the $286 million Drift Protocol exploit point to North Korean hackers, citing structured fund movement, cross-chain laundering patterns, and Solana tracing challenges.
Drift Protocol revealed the $270 million exploit was a six-month intelligence operation by North Korean state-affiliated group UNC4736. Attackers posed as a quant trading firm, used social engineering, VSCode flaws and TestFlight malware to execute the heist.
A security probe backed by ETH Rangers said about 100 suspected North Korea-linked individuals entered crypto firms using fake identities, shifting attention from external hacks to insider access and hiring risks.
