hacking

The Securities and Exchange Commission (SEC) of Thailand has filed a criminal complaint against the cryptocurrency exchange Bitkub Online and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, accusing them of submitting false financial reports between May and October 2021. The case has been handed over to the Economic Crime Suppression Division (ECD) of Thailand for investigation, and the prosecution will decide whether to formally charge them.The SEC stated that Bitkub suffered a cyber attack in May 2021, resulting in the theft of 16 types of digital assets, with losses exceeding $50 million. Regulatory investigations revealed that Bitkub did not reflect the relevant losses in its daily net capital report Form DA 1 from May 10 to October 30, 2021. The SEC alleged that the relevant executives made false statements in the company's official documents, leading regulators to believe that customer assets were intact and that the company had not suffered financial losses. Bitkub subsequently completed the acquisition of alternative assets in late October 2021, but the SEC believes that the reports during this period constituted false statements.In a statement on July 23, Bitkub asserted that existing customer holdings are secure and accounts are complete. Bitkub stated that its co-founders purchased alternative assets in the same quantity and currency to cover the losses and claimed that the cyber theft incident was reported to law enforcement on May 10, 2021.

According to South Korean media Daily NK, North Korean authorities arrested an elite hacker group on July 12, which is suspected of infiltrating the internal networks of the North Korean central bank and foreign trade bank, stealing national trade funds and laundering money through cryptocurrency. Sources say the group's leader is a veteran from the cyber warfare unit under the North Korean Reconnaissance General Bureau, who recruited talented IT graduates from Kim Chaek University of Technology and Pyongyang University of Science and Technology, using encrypted communications and wireless devices to commit crimes.They split the stolen funds into small amounts and transferred them to overseas cryptocurrency wallets, exchanged them for cash through intermediaries, and then converted them into dollars and other currencies in border areas. Pyongyang officials launched an investigation after discovering anomalies in foreign currency payment approvals and records of overseas IP access, ultimately raiding a safe house and arresting suspects who were laundering money, seizing equipment worth hundreds of thousands of dollars. This case has caused a stir among the elite and military circles in Pyongyang, with senior officials in the Reconnaissance General Bureau and the science and education sector worried about being implicated. North Korea has long been accused of stealing billions of dollars in cryptocurrency assets through hacker organizations like the Lazarus Group, but this incident rarely shows that its own financial system has also become a target of internal attacks.

Onchain Lens stated on the X platform that in the first half of 2026, 224 publicly disclosed crypto hacking incidents resulted in approximately $1.32 billion in losses. The largest losses came from access control failures, phishing attacks, and oracle issues.In terms of attack type breakdown, access control failures involved compromised permissions and privileged access, driving several of the largest attacks, including Kelp DAO with a loss of $292 million, Drift Protocol with a loss of $280 million, Humanity Protocol with a loss of $31 million, Step Finance with a loss of $30 million, Truebit with a loss of $26.5 million, Resolv Labs with a loss of $25 million, AFX with a loss of $24.15 million, and BonkDAO with a loss of $21 million. In terms of phishing and social engineering attacks, social engineering attacks caused $282 million in losses. Regarding oracle issues, Ostium lost $24 million, Blend Protocol lost $10.86 million, and Bonzo lost $9 million. A small number of incidents accounted for the majority of the losses, with compromised permissions and privileged access driving several of the largest attacks.

According to The Block, a report from Immunefi shows that in the first half of 2026, cryptocurrency projects suffered cumulative losses of approximately $972 million due to 207 hacking incidents. Although the number of attacks reached a historic high, the total losses remained below $1 billion and were less than half of the losses in the first half of 2025.The report pointed out that losses from attacks in the DeFi sector have decreased by 74% from the peak of $2.62 billion in 2022, dropping to about $680.3 million, with the median single loss decreasing by 75% during the same period. Immunefi believes that this decline is related to ongoing security coverage, bug bounty programs, audit competitions, and more researchers discovering vulnerabilities early.In addition, the sources of risk are shifting from purely smart contract vulnerabilities to infrastructure failures, private key leaks, cross-chain configuration errors, and weak points in privileged access.

According to official news, the stablecoin protocol Reflect, supported by a16z, announced the launch of an independent voluntary recovery plan for USDC+ position holders affected by the Drift (now Velocity) April hacking incident: a 180-day window is now open, during which holders can voluntarily sell their positions to Palindrome Engineering at a price of 0.2 USDC + 80 Reflect Credit (RC) per unit, with complete on-chain settlement.The plan is funded in advance by Palindrome and is completely independent of the Drift recovery process. Participation means waiving the right to pursue claims against Drift in exchange for immediate certainty of liquidity; those who do not participate can still support Drift's DFX recovery channel.

According to monitoring by PeckShield, there were a total of 40 major hacking incidents in the cryptocurrency sector in June 2026, with total losses reaching 75.87 million USD, a decrease of 7.13% compared to May's 81.70 million USD.Among them, Humanity Protocol suffered an attack of 31 million USD, ranking first; Syscoin Bridge and JaredFromSubway.eth MEV bot lost 10 million USD and 7.5 million USD respectively.It is worth noting that the attackers of Humanity Protocol are laundering money through multiple chains such as BTC, Solana, Hyperliquid, and BNB Chain, and the funds are mixed with the earnings of the KelpDAO attackers, suggesting a possible connection. In addition, Aztec Bridge and Aztec Connect were attacked in the same month, with total losses of approximately 4 million USD.

According to on-chain data monitoring, the Humanity Protocol ($H) Foundation's related addresses have completed the planned token transfers, involving a "3:10" structured hedging profit-taking plan aimed at early investors, with a token scale exceeding 540 million. According to the previously announced schedule, the related tokens will officially enter the unlocking process on June 25, marking that the plan has completed the preparatory work for payment and has entered the formal performance stage.Previously, Humanity Protocol underwent a series of ecological recovery processes due to a hacking incident, including promoting a 1:1 exchange of new and old tokens for real holding users on exchanges, and implementing KYC and AML compliance verification for the abnormal on-chain issuance chips generated after the attack to reduce market circulation risks. The timely advancement of this unlocking plan is seen as an important progress node for the project in fulfilling commitments to investors and restoring ecological order after the security incident.Humanity Protocol mainly focuses on AI identity verification and Web3 identity infrastructure. As the demand for AI agents, real-person verification, anti-witch attacks, and on-chain identity applications continues to grow, this sector still has long-term development potential. If Humanity Protocol can continue to promote product and application implementation after completing token migration and ecological recovery, its subsequent performance will still attract market attention.

According to the Korea Herald, the five major virtual asset trading platforms in South Korea (Upbit, Bithumb, Coinone, Korbit, Gopax) have experienced a total of 57 hacking and system failure incidents over the past six years (from 2020 to April 2026), with a total compensation amount of approximately 7 billion Korean won (about 5.1 million USD). By exchange, the number of incidents is as follows: Upbit 26 incidents, Bithumb 14 incidents, Gopax 8 incidents, Coinone 6 incidents, Korbit 3 incidents.Among them, Bithumb compensated approximately 2.5 billion Korean won (about 1.8 million USD) for the BTC misissue incident in February this year, Upbit compensated approximately 790 million Korean won (about 570,000 USD) for a hacking incident in November 2025, and compensated approximately 3.2 billion Korean won (about 2.3 million USD) for a system incident on December 3, 2024. It is worth noting that the standards for compiling incident reports by exchanges and the scale and form of compensation vary. For example, Gopax counts errors that occur when viewing the asset list as system failures, while Bithumb only counts situations where all customers encounter difficulties using core services for more than 10 minutes as system failures.In addition, Bithumb also provided some applicants who suffered losses due to system failures with free fee vouchers instead of cash compensation. The compensation amounts for system failures are as follows: Upbit approximately 3.21 billion Korean won, Bithumb approximately 3.2 billion Korean won, Coinone approximately 49 million Korean won. Korbit and Gopax did not provide any compensation.

According to monitoring by PeckShield, there were a total of 40 major hacking incidents in the cryptocurrency sector in May, with total losses of approximately $81.7 million, a decrease of 87.4% compared to $647 million in April. Among them, cross-chain protocols remain the main target of attacks, with 8 major cross-chain attacks causing losses of $33.28 million, accounting for 41% of the total losses for the month.Significant loss events include SUPERFORTUNE AI (approximately $15.18 million), Verus-Ethereum Bridge (approximately $11.58 million, already refunded), and THORChain (approximately $10 million), among others.

The Echo Protocol encountered a vulnerability attack on the Monad network, where the attacker minted 1,000 eBTC (worth approximately $76.64 million). According to PeckShield's tracking, the attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed 11.29 WBTC, and then bridged it to Ethereum to exchange for ETH, of which 384 ETH were transferred to Tornado Cash. Curvance has suspended the affected market, stating that the smart contract was not compromised and other markets were unaffected.The Echo Protocol has suspended all cross-chain transactions. Monad CEO Keone Hon clarified that the vulnerability did not affect the Monad network, and security researchers assessed that approximately $816,000 was actually stolen.This incident raises the total number of crypto hacking events in May to 14, with three significant DeFi attacks occurring in just the past five days: THORChain suffered a treasury vulnerability loss of over $10 million on May 15, and the Verus Ethereum cross-chain bridge was attacked three days later, resulting in a loss of about $11.58 million. The series of security incidents highlights the systemic security risks that the DeFi sector continues to face.

On-chain analyst Tom Wan posted on the X platform, stating that the current ETH utilization rate has fallen below 90%, and the lending APY has dropped to 1.9%. Since the rsETH LayerZero cross-chain bridge was attacked, the deposit scales of wstETH and weETH have decreased by approximately $1.2 billion and $1.76 billion, respectively.As the wstETH/weETH circular leverage strategy returns to profitability, the market's focus shifts to whether the demand for ETH circular leverage will return or if funds will continue to observe or flow to protocols like Spark and Morpho.

According to Bits.media, anonymous blockchain researcher Specter revealed that a hacker group has promoted its tokens and engaged in cross-chain money laundering by hacking X platform accounts, with total revenue exceeding $140 million.The group is involved in attacks on investors Keith Gill, Pepe the Frog creator Matt Furie, and the WinRAR project's X account, with fund flows involving five networks: Solana, BNB Chain, Ethereum, Tron, and Hyperliquid.The group is also suspected of participating in a phishing attack in 2024 that resulted in victims losing $2.45 million in wstETH.Researchers analyzed that the token issuance platform bnbshare.fun on BNB Chain may be a key tool in this scam scheme, as the fee flows of the platform's creator SHARE token are linked to the hacker's wallet.

According to on-chain analyst PeckShield (@PeckShieldAlert), Transit Finance is suspected to have been hacked, resulting in a loss of approximately $1.88 million. The stolen funds are currently stored in DAI form at address 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5.

U.S. Manhattan Federal Court Judge Margaret Garnett approved Aave's asset recovery plan following the rsETH attack incident, allowing approximately $71 million in ETH that had previously been frozen on Arbitrum to be transferred to a wallet controlled by Aave.Court documents show that this decision modifies a prior injunction against the Arbitrum DAO, allowing the community to complete the ETH transfer through on-chain governance voting, while exempting participants in the voting and execution of the transfer from related legal liabilities. This incident stems from the rsETH attack that occurred in April, which has been widely attributed to the Lazarus Group, linked to North Korea. Previously, lawyers representing the families of North Korean terrorism victims had sought to freeze the related assets and attempted to include them in the compensation for an outstanding judgment of approximately $877 million.The Arbitrum community has shown strong support in a Snapshot temperature check vote for returning the frozen ETH to Aave's recovery plan, but the actual transfer still requires formal approval through on-chain governance. Reports indicate that this case is also part of the U.S. plaintiffs' efforts to recover crypto assets associated with North Korea. In addition to Arbitrum, the plaintiffs had previously sued the privacy protocol Railgun DAO and listed Digital Currency Group (DCG) as one of the defendants, accusing it of participating in related governance and economic activities.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to a Bloomberg report citing Jefferies, a hacker attack on small crypto projects over the weekend, involving nearly $300 million, and the subsequent $10 billion fund run at the largest decentralized lending platform (the KelpDAO and Aave incident), may weaken Wall Street's interest in blockchain technology.Andrew Moss, an analyst at Jefferies' digital asset research team, pointed out that over the past year, banks, asset management companies, and payment institutions have been developing blockchain products similar to the technology system exploited by North Korean hackers. The report suggests that while such incidents are unlikely to directly impact traditional financial markets, it warns that traditional financial institutions may pause related processes and reassess risks before further advancing blockchain business.

Bloomberg cited a report from Jefferies LLC stating that a hacker attack over the weekend that siphoned nearly $300 million from a small crypto project, along with the resulting $10 billion fund run at the largest decentralized lending platform, may slow Wall Street's interest in blockchain technology.Andrew Moss, an analyst at Jefferies' digital asset research team, pointed out that banks, asset management companies, and payment institutions have been developing blockchain products similar to the technology systems exploited by North Korean hackers over the past year.While the report believes this incident is unlikely to impact traditional financial markets, it warns that traditional financial institutions may pause and reassess the associated risks before further advancing their blockchain initiatives.

According to Cointelegraph, DefiLlama data shows that there have been 518 hacking incidents in the crypto space over the past 10 years, with total losses exceeding $17 billion, a significant portion of which is related to private key leaks, phishing, and other credential-based attacks.As smart contract security continues to improve, attackers are increasingly turning to wallet security, signature infrastructure, development tools, and user operations. Recently, the rsETH cross-chain bridge of Kelp DAO was attacked, resulting in approximately 116,500 rsETH being stolen, valued at about $290 million to $293 million at the time.

Defillama founder 0xngmi posted on the X platform that the KelpDAO hacking incident triggered a chain reaction of panic withdrawals from DeFi lending protocols, even those on Solana that were not directly affected were not spared. The specific data is as follows: Aave net outflow of $6.2 billion (-23%), Morpho net outflow of $716 million (-9%), Sky net outflow of $272 million (-4%), JupLend net outflow of $76 million (-8%).0xngmi added that the entire DeFi TVL directly evaporated by nearly $10 billion as a result. In such events, no one is a winner; it only shrinks the "cake" of the entire industry, and everyone suffers.