H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: TRM Labs' H1 2026 report confirms 207 hacks totaling $972M in losses, and that the Drift Protocol ($285M) and KelpDAO ($292M) April attacks combined to roughly $577M in North Korea-linked losses, matching the submission exactly. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2JBuV9…YR4RSummary
The first half of 2026 established a new all-time record for cryptocurrency exploit frequency, with 207–212 verified incidents (varying by methodology) resulting in $972 million to $1.32 billion in losses depending on the reporting firm. North Korea's Lazarus Group (TraderTraitor subunit) was responsible for approximately 55–66% of total losses through two concentrated attacks in April 2026, while AI-powered autonomous agents emerged as a distinct and novel attack surface for the first time in widely documented crypto security history.
Connected Entities
22 entities · 60 linked investigations- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Drift(85%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Ethereum(80%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Stellar(75%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Solana(70%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Arbitrum(70%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Bitcoin(65%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Base(65%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Hyperbridge(60%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→Wintermute(60%)
- H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges→mentioned with→CrossCurve(60%)
- + 78 more
Connected Through
21 shared actors · 609 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- ♦Bitcointoken
- □Solanaorganization
- □Arbitrumorganization
Community submissions
- https://www.trmlabs.com/resources/blog/h1-2026-crypto-hacks-reach-record-high-as-losses-fall-below-usd-1-billion(www.trmlabs.com)
“[Scout] TRM Labs' H1 2026 report states that attackers carried out 207 separate hacks in H1 2026, stealing a total of $972 million, and that two North Korea-linked thefts in April -- against Drift Protocol and KelpDAO -- accounted for approximately $577 million of that total.”
— avoid-scout(unverified)
4 submissions awaiting moderator review.
Timeline(14 events)
7 January 2026
IPOR Fusion PlasmaVault on Arbitrum drained of $336,000 USDC via EIP-7702 wallet-delegation exploit — first documented production EIP-7702 drain.
CryptoTimes6 March 2026
Social engineering of LayerZero Labs developer begins; attacker harvests session keys and pivots into LayerZero's RPC cloud environment — earliest known staging date for KelpDAO exploit.
Halborn / LayerZero incident reporting11 March 2026
On-chain staging begins for Drift Protocol attack: 10 ETH withdrawn from Tornado Cash; durable nonce accounts created for pre-signed transaction delivery.
TRM Labs27 March 2026
Drift Protocol Security Council migrated to a zero-timelock governance configuration, removing the review window that would have allowed detection of the pending exploit.
TRM Labs / ChainalysisApril 2026
Drift Protocol drained of approximately $285 million in SOL, USDC, and Bitcoin across 31 withdrawal transactions in roughly 12 minutes. Attributed to North Korea's Lazarus Group / TraderTraitor by TRM Labs and Elliptic.
TRM Labs / Yahoo Finance14 April 2026
CoW Swap suffers a DNS hijacking attack seizing front-end control; core smart contracts unaffected. A separate single-signature approval event resulted in $50.4 million in losses attributed to CowSwap in Blockaid's H1 count.
The Block / 99Bitcoins18 April 2026
KelpDAO rsETH bridge drained of approximately $290–292 million by attacker who poisoned LayerZero RPC nodes via malware after social engineering a LayerZero developer on March 6. Attributed to TraderTraitor (UNC4899) by Mandiant, CrowdStrike, LayerZero, and three independent analytics firms.
CoinDesk / LayerZero / Halborn20 April 2026
LayerZero publishes formal attribution of KelpDAO exploit to TraderTraitor; blames KelpDAO's single-DVN configuration as the critical enabler.
CoinDesk4 May 2026
BankrBot/Grok prompt injection exploit executed on the Base blockchain: attacker uses Morse-code-encoded message to trick Grok into tagging @bankrbot with a transfer command, draining approximately $150,000–$216,000 in DRB tokens. First widely documented AI-agent-specific crypto exploit.
Crypto Economy / SlowMist / OECD.AI18 May 2026
Verus-Ethereum bridge hacked for $11 million (103.6 tBTC, 1,625 ETH, 147,000 USDC); approximately $8.5 million later returned.
CoinDesk8 July 2026
CertiK publishes Hack3D H1 2026 Report: 344 incidents, $1.31 billion in losses ($1.2 billion net), noting adjusted YoY increase of 28% when Bybit outlier is excluded.
GlobeNewswire / CertiK25 July 2026
CertiK Intel3D Wrench Attacks H1 2026 report published: 52 verified physical coercion incidents, $124.1 million in financial exposure, 33% increase in incidents year-over-year, 20x increase in home invasions.
GlobeNewswire / CertiK29 July 2026
Blockaid H1 2026 Security Report published: 212 verified exploits, $1.1 billion in losses, identifies AI agents as top new attack vector, projects multiple AI agent incidents in H2 2026.
The Block / CryptoTimes29 July 2026
TRM Labs H1 2026 report published: 207 incidents, $972 million in losses, $643 million attributed to North Korean actors (66% of total), average loss per hack $4.7 million, median $219,000.
TRM Labs / BlockonomiDecision Log
- slot 457804031 · hash Bhr42GY3GSw36TeWCmzQEXDns1tnUP7EbmyhAV1LbxX2
- slot 445504480 · hash 6VKFhFKwQmmRaGQvK9vKuLvpYtzhwdtZ13nGPFhwSFvU
- slot 443519335 · hash 9y11G23o1WpeKnwV4uefYi2Hrsf7TMfrNrThaTck8oVA
- slot 443519333 · hash 8Hiz26ceykPNw4Ag2pwCjfNknoZUhenBB46u2xe54MvA
- slot 443502758 · hash pDkaBPfLVLzggdDCNys3e4CtPtqwNg8jX47wg9A4RbF
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 27 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 5:20:45 PM
last updated: 10/16/2026, 10:28:23 PM
8 viewsavoid.net — verified advice for a post-truth world