hacking

According to the Korea Herald, the five major virtual asset trading platforms in South Korea (Upbit, Bithumb, Coinone, Korbit, Gopax) have experienced a total of 57 hacking and system failure incidents over the past six years (from 2020 to April 2026), with a total compensation amount of approximately 7 billion Korean won (about 5.1 million USD). By exchange, the number of incidents is as follows: Upbit 26 incidents, Bithumb 14 incidents, Gopax 8 incidents, Coinone 6 incidents, Korbit 3 incidents.Among them, Bithumb compensated approximately 2.5 billion Korean won (about 1.8 million USD) for the BTC misissue incident in February this year, Upbit compensated approximately 790 million Korean won (about 570,000 USD) for a hacking incident in November 2025, and compensated approximately 3.2 billion Korean won (about 2.3 million USD) for a system incident on December 3, 2024. It is worth noting that the standards for compiling incident reports by exchanges and the scale and form of compensation vary. For example, Gopax counts errors that occur when viewing the asset list as system failures, while Bithumb only counts situations where all customers encounter difficulties using core services for more than 10 minutes as system failures.In addition, Bithumb also provided some applicants who suffered losses due to system failures with free fee vouchers instead of cash compensation. The compensation amounts for system failures are as follows: Upbit approximately 3.21 billion Korean won, Bithumb approximately 3.2 billion Korean won, Coinone approximately 49 million Korean won. Korbit and Gopax did not provide any compensation.

According to monitoring by PeckShield, there were a total of 40 major hacking incidents in the cryptocurrency sector in May, with total losses of approximately $81.7 million, a decrease of 87.4% compared to $647 million in April. Among them, cross-chain protocols remain the main target of attacks, with 8 major cross-chain attacks causing losses of $33.28 million, accounting for 41% of the total losses for the month.Significant loss events include SUPERFORTUNE AI (approximately $15.18 million), Verus-Ethereum Bridge (approximately $11.58 million, already refunded), and THORChain (approximately $10 million), among others.

The Echo Protocol encountered a vulnerability attack on the Monad network, where the attacker minted 1,000 eBTC (worth approximately $76.64 million). According to PeckShield's tracking, the attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed 11.29 WBTC, and then bridged it to Ethereum to exchange for ETH, of which 384 ETH were transferred to Tornado Cash. Curvance has suspended the affected market, stating that the smart contract was not compromised and other markets were unaffected.The Echo Protocol has suspended all cross-chain transactions. Monad CEO Keone Hon clarified that the vulnerability did not affect the Monad network, and security researchers assessed that approximately $816,000 was actually stolen.This incident raises the total number of crypto hacking events in May to 14, with three significant DeFi attacks occurring in just the past five days: THORChain suffered a treasury vulnerability loss of over $10 million on May 15, and the Verus Ethereum cross-chain bridge was attacked three days later, resulting in a loss of about $11.58 million. The series of security incidents highlights the systemic security risks that the DeFi sector continues to face.

On-chain analyst Tom Wan posted on the X platform, stating that the current ETH utilization rate has fallen below 90%, and the lending APY has dropped to 1.9%. Since the rsETH LayerZero cross-chain bridge was attacked, the deposit scales of wstETH and weETH have decreased by approximately $1.2 billion and $1.76 billion, respectively.As the wstETH/weETH circular leverage strategy returns to profitability, the market's focus shifts to whether the demand for ETH circular leverage will return or if funds will continue to observe or flow to protocols like Spark and Morpho.

According to Bits.media, anonymous blockchain researcher Specter revealed that a hacker group has promoted its tokens and engaged in cross-chain money laundering by hacking X platform accounts, with total revenue exceeding $140 million.The group is involved in attacks on investors Keith Gill, Pepe the Frog creator Matt Furie, and the WinRAR project's X account, with fund flows involving five networks: Solana, BNB Chain, Ethereum, Tron, and Hyperliquid.The group is also suspected of participating in a phishing attack in 2024 that resulted in victims losing $2.45 million in wstETH.Researchers analyzed that the token issuance platform bnbshare.fun on BNB Chain may be a key tool in this scam scheme, as the fee flows of the platform's creator SHARE token are linked to the hacker's wallet.

According to on-chain analyst PeckShield (@PeckShieldAlert), Transit Finance is suspected to have been hacked, resulting in a loss of approximately $1.88 million. The stolen funds are currently stored in DAI form at address 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5.

U.S. Manhattan Federal Court Judge Margaret Garnett approved Aave's asset recovery plan following the rsETH attack incident, allowing approximately $71 million in ETH that had previously been frozen on Arbitrum to be transferred to a wallet controlled by Aave.Court documents show that this decision modifies a prior injunction against the Arbitrum DAO, allowing the community to complete the ETH transfer through on-chain governance voting, while exempting participants in the voting and execution of the transfer from related legal liabilities. This incident stems from the rsETH attack that occurred in April, which has been widely attributed to the Lazarus Group, linked to North Korea. Previously, lawyers representing the families of North Korean terrorism victims had sought to freeze the related assets and attempted to include them in the compensation for an outstanding judgment of approximately $877 million.The Arbitrum community has shown strong support in a Snapshot temperature check vote for returning the frozen ETH to Aave's recovery plan, but the actual transfer still requires formal approval through on-chain governance. Reports indicate that this case is also part of the U.S. plaintiffs' efforts to recover crypto assets associated with North Korea. In addition to Arbitrum, the plaintiffs had previously sued the privacy protocol Railgun DAO and listed Digital Currency Group (DCG) as one of the defendants, accusing it of participating in related governance and economic activities.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to a Bloomberg report citing Jefferies, a hacker attack on small crypto projects over the weekend, involving nearly $300 million, and the subsequent $10 billion fund run at the largest decentralized lending platform (the KelpDAO and Aave incident), may weaken Wall Street's interest in blockchain technology.Andrew Moss, an analyst at Jefferies' digital asset research team, pointed out that over the past year, banks, asset management companies, and payment institutions have been developing blockchain products similar to the technology system exploited by North Korean hackers. The report suggests that while such incidents are unlikely to directly impact traditional financial markets, it warns that traditional financial institutions may pause related processes and reassess risks before further advancing blockchain business.

Bloomberg cited a report from Jefferies LLC stating that a hacker attack over the weekend that siphoned nearly $300 million from a small crypto project, along with the resulting $10 billion fund run at the largest decentralized lending platform, may slow Wall Street's interest in blockchain technology.Andrew Moss, an analyst at Jefferies' digital asset research team, pointed out that banks, asset management companies, and payment institutions have been developing blockchain products similar to the technology systems exploited by North Korean hackers over the past year.While the report believes this incident is unlikely to impact traditional financial markets, it warns that traditional financial institutions may pause and reassess the associated risks before further advancing their blockchain initiatives.

According to Cointelegraph, DefiLlama data shows that there have been 518 hacking incidents in the crypto space over the past 10 years, with total losses exceeding $17 billion, a significant portion of which is related to private key leaks, phishing, and other credential-based attacks.As smart contract security continues to improve, attackers are increasingly turning to wallet security, signature infrastructure, development tools, and user operations. Recently, the rsETH cross-chain bridge of Kelp DAO was attacked, resulting in approximately 116,500 rsETH being stolen, valued at about $290 million to $293 million at the time.

Defillama founder 0xngmi posted on the X platform that the KelpDAO hacking incident triggered a chain reaction of panic withdrawals from DeFi lending protocols, even those on Solana that were not directly affected were not spared. The specific data is as follows: Aave net outflow of $6.2 billion (-23%), Morpho net outflow of $716 million (-9%), Sky net outflow of $272 million (-4%), JupLend net outflow of $76 million (-8%).0xngmi added that the entire DeFi TVL directly evaporated by nearly $10 billion as a result. In such events, no one is a winner; it only shrinks the "cake" of the entire industry, and everyone suffers.

According to The Block, Circle CEO Jeremy Allaire stated that Circle will not freeze USDC wallets unrelated to legal proceedings.At a press conference in Seoul, South Korea, on Monday, Allaire responded to ongoing online criticism regarding whether the company should freeze USDC funds in light of hacking and vulnerability incidents. The controversy became more pronounced earlier this month when the decentralized finance protocol Drift suffered an attack of approximately $280 million, which is believed to be related to a six-month-long attack carried out through complex social engineering techniques, possibly involving a North Korean-affiliated hacking group.Prominent on-chain analysts, including on-chain investigator ZachXBT, publicly criticized Circle for not freezing approximately $230 million in USDC funds. These funds were reportedly transferred from Solana to Ethereum via Circle's cross-chain transfer protocol.

According to data from DefiLlama, in the first quarter of 2026, hackers stole over $168.6 million in crypto assets from 34 decentralized finance (DeFi) protocols, a significant decrease from $1.58 billion during the same period in 2025, when the high losses were mainly due to the $1.4 billion theft incident from Bybit.The largest single attack this quarter was the private key leak incident at Step Finance in January, resulting in a loss of approximately $40 million; followed by the attack on Truebit due to a smart contract vulnerability on January 8, resulting in a loss of $26.4 million in Ethereum; and third was the private key theft incident at stablecoin issuer Resolv Labs on March 21.

Ledger's Chief Technology Officer Charles Guillemet stated that the attack method used in the Drift Protocol exploit is similar to the 2025 Bybit hacking incident, which is widely believed to be linked to North Korean hackers.Guillemet pointed out that this attack did not target any smart contracts; instead, the attackers infiltrated the devices of multi-signature signers over a long period, tricking them into approving malicious transactions. The signers may have always thought they were authorizing legitimate operations. He emphasized that the root of the problem lies in the lack of security at the personnel and operational levels, rather than in the code itself.

According to Lookonchain monitoring, trader HXiRSK bought 91,891 SOL at an average price of $175 seven months ago (totaling $16.04 million). After the Drift hacking incident, he sold 47,401 SOL (totaling $3.98 million) to reduce losses. His total losses have now exceeded $4 million.

Renowned on-chain detective ZachXBT has once again criticized Circle, stating that the Drift hacking incident occurred during U.S. trading hours, with millions of USDC transferred from Solana to Ethereum via CCTP (Circle's cross-chain protocol), while Circle remained inactive and took no action.A few days ago, Circle casually froze at least 16 corporate hot wallets, which are still slowly being unfrozen. ZachXBT concluded, "Circle is the bad actor in this industry."