H1 2026 Crypto Hack Landscape — AI Agent Attack Vector Emerges

2026-01-07

IPOR Fusion PlasmaVault on Arbitrum drained of $336,000 USDC via EIP-7702 wallet-delegation exploit — first documented production EIP-7702 drain.

2026-03-06

Social engineering of LayerZero Labs developer begins; attacker harvests session keys and pivots into LayerZero's RPC cloud environment — earliest known staging date for KelpDAO exploit.

2026-03-11

On-chain staging begins for Drift Protocol attack: 10 ETH withdrawn from Tornado Cash; durable nonce accounts created for pre-signed transaction delivery.

2026-03-27

Drift Protocol Security Council migrated to a zero-timelock governance configuration, removing the review window that would have allowed detection of the pending exploit.

2026-04-01

Drift Protocol drained of approximately $285 million in SOL, USDC, and Bitcoin across 31 withdrawal transactions in roughly 12 minutes. Attributed to North Korea's Lazarus Group / TraderTraitor by TRM Labs and Elliptic.

2026-04-14

CoW Swap suffers a DNS hijacking attack seizing front-end control; core smart contracts unaffected. A separate single-signature approval event resulted in $50.4 million in losses attributed to CowSwap in Blockaid's H1 count.

2026-04-18

KelpDAO rsETH bridge drained of approximately $290–292 million by attacker who poisoned LayerZero RPC nodes via malware after social engineering a LayerZero developer on March 6. Attributed to TraderTraitor (UNC4899) by Mandiant, CrowdStrike, LayerZero, and three independent analytics firms.

2026-04-20

LayerZero publishes formal attribution of KelpDAO exploit to TraderTraitor; blames KelpDAO's single-DVN configuration as the critical enabler.

2026-05-04

BankrBot/Grok prompt injection exploit executed on the Base blockchain: attacker uses Morse-code-encoded message to trick Grok into tagging @bankrbot with a transfer command, draining approximately $150,000–$216,000 in DRB tokens. First widely documented AI-agent-specific crypto exploit.

2026-05-18

Verus-Ethereum bridge hacked for $11 million (103.6 tBTC, 1,625 ETH, 147,000 USDC); approximately $8.5 million later returned.

2026-07-08

CertiK publishes Hack3D H1 2026 Report: 344 incidents, $1.31 billion in losses ($1.2 billion net), noting adjusted YoY increase of 28% when Bybit outlier is excluded.

2026-07-25

CertiK Intel3D Wrench Attacks H1 2026 report published: 52 verified physical coercion incidents, $124.1 million in financial exposure, 33% increase in incidents year-over-year, 20x increase in home invasions.

2026-07-29

Blockaid H1 2026 Security Report published: 212 verified exploits, $1.1 billion in losses, identifies AI agents as top new attack vector, projects multiple AI agent incidents in H2 2026.

2026-07-29

TRM Labs H1 2026 report published: 207 incidents, $972 million in losses, $643 million attributed to North Korean actors (66% of total), average loss per hack $4.7 million, median $219,000.