Report summary
On July 23, 2026, the OKX Web3 security team released the 2026 OKX Web3 Security Half-Year Report together with SlowMist and OtterSec. The report recorded 182 publicly disclosed blockchain security incidents in the first half of 2026, causing approximately $956 million in losses. Compared with 121 incidents and about $2.373 billion in the same period of 2025, incident count rose by roughly 50% while reported losses fell by about 60%.
After cross-checking the report against public material from SlowMist, CertiK, Blockaid, Hypernative, Nexus Mutual and official LayerZero incident reporting, the Delta & Capital research team concluded that the lower headline amount reflects the absence of a single extraordinary loss from the comparison period, rather than a narrowing of the industry's overall risk exposure. The focus of attacks has moved from smart-contract code toward signing workflows, operational keys and people, while asset-holding AI agents have appeared as a new class of target.
Core findings
Incident density increased while average loss fell.The 182 incidents corresponded to about $956 million in losses, or roughly $5.25 million per incident, well below the approximately $19.61 million average in the first half of 2025. Once the exceptional February 2025 Bybit loss of about $1.5 billion is removed, comparable year-on-year losses increased.
Supply-chain attacks became the leading cause by loss amount.They accounted for about $298 million, followed by contract vulnerabilities at about $152 million and private-key exposure at about $130 million. By count, contract and logic vulnerabilities remained first with 85 incidents.
The two largest first-half incidents did not involve contract vulnerabilities.The KelpDAO / LayerZero incident, at about $292 million, arose from a single failure point in cross-chain message validation. The Drift Protocol incident, at about $285 million, followed roughly six months of social engineering and abuse of pre-signed transactions.
Individual users became the primary surface for scalable attacks.Malicious browser extensions, poisoned search ads, recruitment-interview scams and fake meeting software all reuse familiar trust channels while remaining cheap and easy to copy.
AI now plays two roles in the attack chain: production tool and target.Prompt injection can directly trigger on-chain asset transfers, while AI-generated code is adding new vulnerability stock to open-source and newly created projects.
1. Research background and data scope
The analysis covers the 2026 OKX Web3 Security Half-Year Report and the companion 2026 OKX Web3 Risk Control Half-Year Report. The former emphasizes industry-wide incident statistics and attribution; the latter quantifies platform-side controls. Incident data primarily comes from SlowMist's hacked-incident archive, while project-loss rankings mainly use OtterSec's methodology.
Three scope limitations must be understood before interpreting the figures. These are also routine checks Delta & Capital applies when evaluating third-party statistics in on-chain forensic work.
Table 1 | Basic report information and methodology
Reports:2026 OKX Web3 Security Half-Year Report, published July 23 and updated July 24, 2026; and the 2026 OKX Web3 Risk Control Half-Year Report.
Publishers and data support:OKX Web3 security team; SlowMist and OtterSec.
Period:January 1 through June 30, 2026.
Sample:Publicly disclosed security incidents; undisclosed and undiscovered incidents are excluded.
Loss estimation:Token market prices at the time of each incident; price volatility and incomplete disclosure can affect final amounts.
Attribution:Each incident is assigned one primary cause, which can create classification differences when several controls fail in the same event.
These limits directly affect interpretation. The disclosure-dependent base means the true incident count exceeds 182; market-price estimates complicate cross-year comparison; and single-cause classification can underweight off-chain failures in compound attacks. The article therefore preserves the original report's measurement basis and marks disputed figures as ranges.
2. Volume and structure: 182 incidents and about $956 million
2.1 A lower headline amount is not evidence of lower risk
In the first half of 2026, incident count rose from 121 to 182, an increase of about 50%, while losses fell from approximately $2.373 billion to $956 million, a decline of about 60%. These measures moved in opposite directions because the first half of 2025 included the exceptional Bybit event of roughly $1.5 billion. Excluding that event leaves comparable first-half 2025 losses of about $873 million versus $956 million in 2026, an increase of approximately 10%.
With average loss per incident falling from about $19.61 million to $5.25 million, the more practical conclusion is that attacks became more distributed and frequent while total industry loss did not decline. Delta & Capital also noted a practical consequence: smaller individual losses often receive less media attention and lower investigative priority, leaving small and mid-sized victims with fewer recovery resources.
2.2 Cause structure under two measurement approaches
Cause analysis must separate incident frequency from loss amount because the two measures point to different risk priorities.
Table 2 | H1 2026 security incident causes by count and loss
Contract and logic vulnerabilities:85 incidents, ranking first by count; about $152 million, ranking second by loss. The category is frequent but more controllable per event and can be reduced through audit and formal verification.
Supply-chain attacks:A relatively small share by count; about $298 million, ranking first by loss. This category is low-frequency and high-impact, with attack surfaces outside application code.
Private-key and privilege exposure:Continued to occur frequently; about $130 million, ranking third by loss, and directly tied to device security, cloud-key management and human procedures.
Oracle and price manipulation:Multiple small and midsize events totaling tens of millions of dollars, concentrated in illiquid assets and self-operated price feeds.
Delta & Capital's assessment is that the definition of the security boundary is expanding. Projects now need to answer more than whether contract code contains a vulnerability: who holds signing authority, where keys are stored, whether critical validation depends on one node, and whether every link in the operations and collaboration chain can be trusted.
3. Project risk: Top 10 losses and two representative incidents
3.1 Project loss ranking for the first half
Table 3 | Top 10 project losses in H1 2026 (source: OtterSec / OKX report)
1. KelpDAO / LayerZero | April 18, 2026 | about $292 million | infrastructure compromise:RPC nodes were poisoned and healthy nodes were hit with DDoS traffic, forcing a single DVN to validate a forged message.
2. Drift Protocol | April 1, 2026 | about $285 million | social engineering:The victim was induced to sign a multisig authorization transaction based on a durable nonce, which was broadcast later.
3. Step Finance | January 31, 2026 | about $40 million | private-key exposure:An executive's device was compromised and the key was used to drain the treasury.
4. Humanity Protocol | June 9, 2026 | about $36 million | private-key exposure:A developer endpoint was infected with malware and the token price fell by more than 80%.
5. Truebit | January 2026 | about $26 million | contract flaw:Deployment with an old compiler lacked integer-overflow protection, allowing low-cost minting after a price wraparound.
6. Resolv Labs | March 22, 2026 | about $23 million | cloud-key exposure:An AWS KMS key was stolen and used to mint approximately 80 million unbacked tokens.
7. Rhea Finance | April 16, 2026 | about $18.4 million | price manipulation:A fake token and self-created liquidity pool distorted the price feed, inflating collateral value for excess borrowing.
8. Blend Protocol | February 2026 | about $10 million | oracle manipulation:The attacker manipulated an illiquid asset's price and borrowed beyond the legitimate collateral value.
9. SagaEVM | January 2026 | about $7 million | validation-logic flaw:A crafted payload bypassed validation and enabled unbacked minting.
10. TrustedVolumes | May 2026 | about $6.7 million | missing access control:An unrestricted contract function was abused to authorize malicious orders.
The distribution in Table 3 is notable: among the four largest losses, three failed off-chain at infrastructure, personnel, endpoint-device or cloud-key layers. A conventional contract-code defect does not appear until fifth place.
3.2 Representative incident one: KelpDAO / LayerZero
At approximately 17:35 UTC on April 18, 2026, an attacker forged a LayerZero cross-chain message purportedly sent by KelpDAO's Unichain deployment. The only configured DVN, which had been compromised, validated the message, causing the Ethereum-side OFTAdapter to release about 116,500 rsETH. At prevailing prices, the amount was worth approximately $292 million and represented close to 18% of circulating rsETH. Emergency multisig action blocked a second forged message targeting about 40,000 rsETH.
Third-party postmortems added two critical details. Hypernative found no corresponding message-sending or burn record on Unichain, whose rsETH supply was only about 49 tokens—roughly 2,300 times less than the 116,500 claimed in the forged message. Nexus Mutual and Blockaid reported that the attacker had compromised two RPC nodes used by the DVN weeks in advance, then DDoSed the remaining healthy nodes on the day of the incident. The resulting failover left the DVN reading only poisoned chain data. LayerZero's official incident report stated that the application had changed its verification configuration from 2-of-2 to 1-of-1 and attributed the attack to a North Korea-linked group.
Disclosed loss estimates vary from $291 million to $292 million. The report also mentioned that approximately $75 million had been frozen. Delta & Capital recommends treating the official incident report and actual on-chain freeze records as authoritative.
3.3 Representative incident two: Drift Protocol
On April 1, 2026, approximately $285 million in assets was transferred out of Drift Protocol, representing more than half of its total value locked. Public postmortems show that the attacker spent about six months building trust with a core team member, then induced that person to sign a management transaction using Solana's durable-nonce mechanism without any visible sign of abnormality. This mechanism allows a transaction to remain valid beyond the normal blockhash window, enabling it to be signed first and broadcast later. After the multisig threshold was changed to 2-of-5, the attacker broadcast the transaction already in hand. Administrator authority was transferred, withdrawal restrictions were removed and the assets left within a few block intervals—roughly ten seconds in total.
The common factor in both incidents is where the control failed: one in the cross-chain message-validation path, the other in the multisig signing workflow. Neither involved a logic defect in the contract code itself. This closely resembles the technical profile of the 2025 Bybit incident.
4. User risk: identifying six common attack methods
The report's analysis of attacks against individuals points to a shared starting point: attackers choose channels users already trust, including app stores, search results, friends' social accounts, meeting software, recruitment processes and customer-support channels. Delta & Capital reorganized the material around practical warning signs.
Table 4 | Six common attack methods targeting individual users
Malicious browser extensions:Impersonate well-known wallets, inflate ratings and download counts, keep the local program free of obviously malicious logic and deliver phishing pages remotely in real time. Warning signs include requests for a seed phrase or private key and frequently changing pages or domains.
Poisoned search advertising:Buy keyword ad placement so a fake official site appears first, then induce the user to execute an installation command. Warning signs include being told to copy and paste terminal commands; a clipboard stealer may later replace the payment address. The reference loss was about $20,000.
Compromised-friend social engineering:Use a hijacked friend's account to send an event invitation and insist on installing designated meeting software. Warning signs include obscure software, pressure to install quickly and refusal to use a normal channel.
Recruitment-interview scams:Pose as a technical interviewer, request screen sharing and ask the candidate to demonstrate wallet or on-chain experience, recording holdings and behavior. Warning signs include being asked to operate a wallet during an interview and receiving a highly customized airdrop page later. The reference loss was about $88,000.
Fake security verification:Use an imitation domain differing by one character and a countdown to prompt entry of a seed phrase for supposed verification. Any page requesting a seed phrase for verification, recovery or upgrading is dangerous.
Business-process fraud:Use legal-name confirmation, an external audit or token ownership as a pretext to send a malicious attachment and request system passwords or screen-recording permission. Warning signs include documents asking the user to enable macros or system updates and requests for camera or keystroke-monitoring access.
In one poisoned-search-ad case, a user clicked the top advertisement while looking for a developer tool and ran the installation command supplied by the page. When the user later made a transfer of about $20,000, the receiving address was replaced automatically. At no point had the user interacted with a high-risk protocol or unknown contract. The lesson for risk education is direct: the trigger for loss can sit entirely inside an ordinary daily workflow.
5. The AI variable: from production tool to attack target
5.1 Asset-holding agents become direct targets
The Bankr / Grok incident provides the first clear example. The attacker first sent a Bankr Club membership NFT to a Grok-associated on-chain wallet, effectively enabling transfer authority. The attacker then posted a tweet encoded in Morse code. To the model it looked like a translation request, but the decoded text matched @bankrbot's command syntax and was executed by a downstream bot as trusted input. DRB tokens on Base were transferred and sold. The report places the loss between approximately $150,000 and $200,000; specific media estimates ranged across $150,000, $174,000, $175,000 and $200,000. About 80%, or roughly $137,000, was later returned, after which Bankr cut off the relevant command authority.
One subsequent fact not included in the report is also relevant: on May 20, 2026, 14 Bankr user wallets were attacked again, losing more than $440,000. SlowMist founder Yu Xian confirmed a connection to the Grok incident earlier that month.
5.2 Industrialized attack operations
The report's account of the Lazarus subgroup HexagonalRodent shows how AI amplifies attack capacity. The group approached developers with high-paying remote-job offers and induced them to run backdoored code. Investigators found extensive use of ChatGPT and Cursor to generate attack code and social-engineering scripts, AI website builders to forge company sites and executive identities, and AI tools to test the group's own malware against detection. In the first quarter of 2026 alone, the group stole wallet-related data from more than 2,700 developer systems.
AI-generated code is also creating a new stock of vulnerabilities. Cited data says Georgia Tech attributed 35 of 74 CVEs in March 2026 to AI-generated code. A scan of approximately 1,400 AI-assisted applications found 2,038 critical vulnerabilities, more than 400 exposed keys and 175 instances of personal-information exposure.
5.3 Synthetic reality: the whole environment is forged
In the “Truman Show” operation disclosed by Check Point, victims were brought into a private investment group where both the investment expert and numerous active investors were AI personas. They continuously published analysis, displayed profit screenshots and interacted in each victim's language. A case disclosed by Singapore police showed a more complete form: scammers impersonating senior officials staged a video conference featuring AI-generated representations of the prime minister, president and Monetary Authority of Singapore representatives. Coupled with nondisclosure and fund-arrangement narratives, the scheme caused a loss of about SGD 4.9 million.
Delta & Capital's assessment is that when the environment itself can be synthesized at scale, defenses centered on “spotting suspicious information” will keep failing. Effective safeguards must move upstream to independent verification of identity, entry channel and process. Verification must use an out-of-band channel, not a link, number or meeting invitation provided by the other party.
6. Defensive progress: measurable platform risk controls
The 2026 OKX Web3 Risk Control Half-Year Report and contemporaneous public disclosures contain quantitative data that helps show how far pre-transaction intervention has been implemented.
Table 5 | Platform risk-control disclosures for H1 2026
High-risk transaction blocking:More than 5.7 million transactions in total, including about 2.41 million related to hacking and theft, 1.48 million to phishing and 990,000 to scams.
High-risk signature blocking and alerts:More than 4 million instances, protecting approximately $526 million.
Risky-site access blocking:More than 7 million instances.
Device-risk detection:More than 200,000 checks, identifying high-risk applications more than 60,000 times.
Transaction semantic parsing:Coverage of more than 50,000 on-chain methods.
On-chain intelligence labels:More than 1.1 billion labels across over 420 chains.
The figures support an important conclusion: among risks that can be blocked, most already display identifiable characteristics before a signature or transfer occurs. This provides quantitative support for Delta & Capital's long-standing emphasis on pre-incident controls.
7. Delta & Capital's assessment and forensic methodology
7.1 Three practical changes
Drawing on its long-term work in on-chain data analysis and fund-flow forensics, Delta & Capital identified three changes with direct implications for incident response.
The forensic starting point has moved off-chain.When major losses arise from compromised devices, stolen cloud keys and induced signatures, the chain record shows only the result. Evidence secured immediately must expand beyond addresses and transaction hashes to include signature records, device logs, communications and the timeline of permission changes.
Attribution is harder, but off-ramp endpoints remain central.Attackers are using cross-chain bridges, mixers and multi-asset splitting more often, raising the cost of path reconstruction. Cash-out still requires interaction with centralized nodes that apply identity requirements, so identifying endpoints and preparing cooperation materials remains a core response task.
Recovery rates remain low.Multiple datasets indicate that most stolen funds are not recovered. This supports a clear priority judgment: the marginal benefit of pre-incident protection is substantially greater than that of post-incident pursuit.
7.2 A five-step on-chain forensic framework
Table 6 | Delta & Capital's five-step asset tracing and forensic framework
1. Rapid containment:Preserve implicated addresses, transaction hashes, timestamps, signature records and device traces to prevent evidence loss and protect the intervention window.
2. End-to-end tracing:Reconstruct cross-chain and cross-asset fund flows, identify consolidation and exchange nodes, and produce a complete fund-flow graph.
3. Address-cluster consolidation:Use behavioral characteristics and common-spend heuristics to group addresses under a common controller and isolate suspect clusters.
4. Endpoint identification:Locate centralized exchanges, OTC channels and other reachable nodes receiving illicit funds to support freeze requests and cooperation.
5. Compliance-grade evidence report:Produce on-chain evidence and technical explanations suitable for police reports and judicial cooperation, supporting formal legal procedures.
A technical limit must be stated plainly: privacy coins, mixers and some cross-chain bridges substantially increase tracing difficulty, and not every fund flow can be penetrated on-chain. Any promise of guaranteed recovery lacks a technical basis.
8. Conclusions and recommendations
The first-half 2026 data supports an overall conclusion: Web3 security governance is shifting from code audit alone toward integrated control of signing authority, key custody, validation redundancy, human procedures and the AI toolchain. Based on the distribution of incident causes, Delta & Capital offers the following recommendations.
For projects and institutions
- Place durable-nonce transactions, pre-signed transactions, multisig authorizations, contract upgrades and changes to Owner, Minter or Delegate privileges in the highest risk tier, requiring parsing, simulation and independent review.
- Remove single points of dependency from fund-outflow paths, including any single RPC node, validator, price source, cloud key or administrator address.
- Apply time locks, rate limits, secondary confirmation and anomaly alerts to large withdrawals, permission changes and threshold adjustments.
- Verify every request involving funds, permissions or deployment through an out-of-band channel. A video-conference image or familiar account is not proof of identity.
- Classify cloud keys, CI/CD credentials, MPC nodes and hot wallets by the level of fund-control authority and manage them inside the asset-security system.
For individual users
- Stop any signature request whose asset transfer or permission grant cannot be clearly identified.
- Separate long-term storage from daily-interaction wallets, revoke historical approvals regularly, and pay particular attention to unlimited allowances, blanket NFT approvals and delegated signatures such as Permit and Permit2.
- Any page asking for a seed phrase is fraudulent; seed phrases have no verification function.
- If a request involves remote control, screen sharing, unfamiliar meeting software or terminal commands, stop and verify it through an independent channel.
- Beware of secondary scams offered as recovery assistance. Anyone demanding upfront payment while promising recovery presents an extreme risk.
Appendix A | Key terms
Supply-chain attack:Instead of directly attacking the target system, the attacker compromises a development tool, third-party component, signing tool or infrastructure node on which it depends. This category ranked first by loss in H1 2026 at about $298 million.
DVN (Decentralized Verifier Network):The verifier network responsible for authenticating cross-chain messages in LayerZero's architecture. With a single DVN configuration, one validation signature can release a message, creating a classic single point of failure.
Durable nonce:Solana supports transactions using a durable nonce, which is not constrained by the normal blockhash validity window and can therefore be signed first and broadcast later. If abused, a transaction that looked harmless when signed can take effect at any future time.
Prompt injection:Disguising a malicious instruction as normal input to induce a model or agent to take an unintended action. When the agent has transfer authority, this can become a direct on-chain asset loss.
Synthetic reality:Using AI to fabricate people, communities, meetings and an information environment at scale, creating a self-consistent false setting that can be operated continuously. The victim is deceived not only about one message but about the authenticity of the whole environment.
KYT (Know Your Transaction):Transaction-level anti-money-laundering controls that form a basis for recovery work and institutional cooperation after illicit funds reach an endpoint.
Appendix B | Frequently asked questions
Q: How much was stolen in publicly disclosed blockchain incidents during H1 2026?
A: According to incomplete statistics in SlowMist's hacked-incident archive as cited by the OKX report, 182 public security incidents caused approximately $956 million in losses.
Q: Does the roughly 60% year-on-year decline in losses mean industry security improved?
A: No. The decline mainly reflects the single exceptional Bybit loss of about $1.5 billion in the first half of 2025, with no equally large event in the current period. Incident count rose by about 50%, and comparable losses after removing the outlier increased by about 10%.
Q: Which attack type caused the largest losses in the first half?
A: Supply-chain attacks at approximately $298 million, followed by contract vulnerabilities at about $152 million and private-key exposure at about $130 million. By count, contract and logic vulnerabilities ranked first with 85 incidents.
Q: What were the two largest incidents?
A: KelpDAO / LayerZero on April 18 at about $292 million, where a single DVN validated a forged cross-chain message; and Drift Protocol on April 1 at about $285 million, where long-running social engineering induced the signing of a durable-nonce management transaction.
Q: Does a contract audit guarantee fund safety?
A: No. The largest first-half losses occurred outside contracts in signing workflows, validation paths and key management. An audit covers code implementation, not allocation of signing authority, key storage or validation redundancy.
Q: What new risks arise when an AI agent holds assets?
A: Key risks include prompt injection, context poisoning, malicious plugins, unauthorized tool calls and supply-chain poisoning. The Bankr / Grok incident shows that one encoded malicious input can cause an agent to execute a real on-chain transfer.
Q: Can stolen crypto assets still be recovered?
A: It depends on whether the funds remain traceable, whether they reach a platform with identity requirements, and whether platforms and law-enforcement agencies cooperate. Multiple datasets show that most stolen funds are not recovered, so any guarantee of recovery should be treated with caution.
Q: How reliable are the figures cited here?
A: Core data comes from public reports by OKX, SlowMist and OtterSec and was cross-checked against CertiK, Blockaid, Hypernative, Nexus Mutual and official LayerZero incident reporting. Some figures vary by methodology, including $291–292 million for KelpDAO and $150,000–200,000 for Bankr; the ranges are marked in the article, and original reports should be treated as authoritative.
Disclaimer and compliance notice
This article is industry research and security education. It does not constitute investment advice, legal advice or any promise of profit, recovery or account unfreezing. Platforms, protocols and projects are cited only as security-incident examples and are not recommended or endorsed. Loss estimates use asset prices at the time of each incident and may differ from actual losses because of incomplete disclosure. Compliance requirements for virtual-asset activities remain subject to applicable laws and regulations. Victims of theft or fraud should report the matter promptly to law enforcement and seek redress through lawful channels, while remaining alert to secondary scams offered as recovery or unfreezing assistance.