ETH SOL Security Current Affairs

Crypto Hacks Smashed Records in H1 2026. North Korea Did Most of the Smashing.

2026-07-29

Over $1 billion in cryptocurrency losses in just six months. That's the jaw-dropping headline from Blockaid's H1 2026 report, and yes, it's a record. The math gets grimmer when you dig in: 212 separate breaches, with the threat landscape shifting sharply towards state-backed operators. North Korea's Lazarus Group accounts for the lion's share.

Ethereum and Solana bore the brunt. Ethereum saw approximately $332 million stolen, Solana roughly $326 million. The breakdown matters though. Ethereum fell to code exploits — attackers found flaws in smart contracts themselves. Solana got hit a different way: compromised keys and signing infrastructure. That's a distinction worth understanding. Ethereum hosts the crown jewels — restaking platforms, stablecoins, decentralised exchanges. Solana's problem was more operational: someone got access to the keys that mattered.

The biggest single attack tells you everything about what's changed. On April 18, 2026, the Lazarus Group hit KelpDAO's LayerZero bridge for $292 million. But here's what made it novel: it wasn't a smart contract vulnerability. This was sophisticated infrastructure compromise. Off-chain. The kind of attack that catches security teams flat-footed because they're usually watching the code.

Then came Drift Protocol on April 1. $285 million drained in twelve minutes from Solana's largest perp exchange. That sounds like a flash attack, or some elegant technical exploit. Wrong. The report reveals something worse: months of social engineering. The whole thing began in autumn 2025. Attackers created fake personas with professional backgrounds, established Telegram groups, discussed trading strategies. They looked legitimate because they were patient. This is tradecraft.

The sophistication is unsettling. These operators understand DeFi mechanics, vault integrations, how firms actually onboard. They weren't guessing. They combined long preparation, social engineering, and what appears to be physical-world access to industry insiders. State capacity plus time equals penetration.

Four incidents alone explain 64% of all H1 losses: KelpDAO, Drift Protocol, Resolv, and CowSwap totalling around $707 million. The Lazarus Group's TraderTraitor subgroup was responsible for roughly $609 million of that — about 55% of everything stolen in the first half. Concentration matters because it means systemic weaknesses, not random chance.

Solana's emergence as a major target is striking. In 2025, the network recorded roughly $127 million in losses. H1 2026 nearly matched that in six months. Solana replaced Arbitrum as the network with the second-highest losses, driven by those key compromises. Fast acceleration. The platform verified 3.4 times as many high-threshold exploits in H1 2026 as it did across all of 2025.

The report flags AI-related exploits as the next frontier. As AI advancement merges with state-actor sophistication and increasingly interconnected DeFi infrastructure, the industry's facing an escalating problem. Not just technical — institutional too. You can patch code. You can't easily patch human networks that have been compromised at source.

Source & further reading:

Sources