Security Firm Blockaid Says 212 Onchain Exploits Stole $1.1B as AI and Wallet Attacks Accelerate

North Korean Hackers Drive $600M successful Stolen Funds

The archetypal fractional of 2026 marked the astir progressive play for onchain information threats connected record, with information steadfast Blockaid noting a 3.4-fold summation successful high-threshold exploits implicit each of 2025. According to Blockaid’s H1 2026 Onchain Security Report, full dollar losses reached $1.1 billion, trailing the archetypal fractional of 2025 owed to the lack of a azygous multibillion-dollar mega-heist.

However, the measurement and method sophistication of attacks escalated dramatically. Study information amusement attackers carried retired 212 verified exploits during the six months, peaking successful June with 57 abstracted incidents. Just 4 large incidents accounted for $707 million, oregon 64%, of full stolen funds. North Korea’s “Trader Traitor” hacking cluster, tied to the Lazarus Group, was liable for astir $609 cardinal of wide losses, Blockaid said.

A bulk of fiscal losses were concentrated successful a fistful of high-profile information breaches driven by North Korean state-sponsored menace actors. The period’s 2 largest exploits, restaking protocol KelpDAO ($292 million) and Solana perpetual DEX Drift Protocol ($285 million), were some attributed to Trader Traitor.

Rather than relying connected astute declaration bugs, these attacks targeted quality and operational vectors. In the Drift breach, weeks of targeted societal engineering granted attackers administrative multisig control, resulting successful $285 cardinal stolen successful little than 12 minutes. In the KelpDAO exploit, attackers utilized societal engineering against a LayerZero developer to poison RPC infrastructure and forge cross-chain span attestations.

Meanwhile, the study highlighted 3 large information boundaries that emerged successful the archetypal fractional of 2026 — areas historically extracurricular modular audit scopes: EIP-7702 wallet delegation attacks, AI punctual injection, and off-chain span infrastructure. To item the menace posed by AI vulnerabilities, the study pointed to a May incidental successful which an attacker “used punctual injection to instrumentality Bankr’s AI cause into approving an unauthorized transaction, taking $216K”.

Recovery rates remained starkly divided depending connected the onslaught vector. Stolen funds stemming from cardinal compromises vanished astir instantly into mixers oregon cross-chain bridges. Conversely, protocol bugs occasionally allowed for partial oregon afloat betterment done swift white-hat coordination oregon declaration pauses.

Looking ahead, Blockaid warns that Web3 ecosystems should hole for continued unit successful the 2nd fractional of the year. Key areas of interest see persistent social engineering campaigns by sanctioned nation-state actors, scaling exploits astir EIP-7702 wallet delegation features, and a accelerated emergence successful prompt-injection attacks against autonomous AI trading agents arsenic adoption grows crossed decentralized finance.