Global Digital Asset Threat Report, Q2 2026

Social engineering

UNC4736, a North Korean state-affiliated group, spent months building relationships with Drift contributors while posing as a quantitative trading firm— depositing over $1M into a Drift vault, participating in product discussions, and attending crypto conferences in person. On March 12, they deployed a fake asset and traded it between their own wallets to create the appearance of genuine market demand and a stable price, giving the oracle something convincing to report. Between March 23 and 30, they used Solana’s durable nonce feature to obtain pre-signatures from Security Council members on transactions that appeared routine but carried instructions to transfer admin control to an attacker-controlled address. On March 26, Drift migrated to a new 2/5 multisig with zero timelock, and the attackers obtained the necessary signatures on the new configuration.

On April 1, the pre-signed transactions were executed in two steps, one second apart, transferring admin control to an attacker-controlled address. With full admin access, the attacker drained $295M in real assets across at least 18 token types over approximately 2.5 hours. The drain and laundering ran in parallel.

Blind signing succeeds when approvers cannot see what a transaction actually does. Fireblocks decodes raw transaction data into human-readable actions, simulates the outcome before approval, and renders those details on independent, hardware-secured devices. Policy rules are enforced before signing, so privileged actions like transferring admin control require explicit, policy-verified approval rather than opaque pre-signatures.

Fraudulent Ledger app listed on the Apple App Store, harvesting seed phrases entered by users under the guise of wallet synchronization.

A malicious actor published a convincing Ledger Live clone to the Apple App Store and kept it active for approximately one week before removal. The app replicated Ledger Live’s branding and interface. The campaign harvested seed phrases from 50+ users, resulting in ~$9.5M in losses.

Seed phrase harvesting works because a recovery phrase is a complete, portable copy of a wallet’s private key, and anyone who convinces a user to type it in gains full control of the funds. On Fireblocks, no such phrase exists at any point in a wallet’s lifecycle. Keys are generated and stored as separate MPC shares across hardware-isolated environments and are never combined into a whole key, so there is no recovery phrase for a user to write down, back up, or be tricked into “synchronizing.”

Social engineering

Zerion, a self-custodial wallet and DeFi infrastructure provider, was targeted by a planned, well-resourced DPRK operation using AI-generated personas and interaction techniques to build trust with a team member. Upon compromise, the attacker extracted session credentials and private keys to internal testing and operational hot wallets, draining approximately $100,000. The self-custodial model protected user funds entirely, as the attack surface was the company’s own internal infrastructure. Zerion took the web app offline on April 11 upon detecting anomalous activity, preventing potential malicious code deployment to production.

Fireblocks wallets are built on MPC, so private keys exist only as distributed shares protected in hardware-isolated environments. With policy engine controls, multi-party approval, and scoped API permissions in place, a compromised credential or session alone is not enough to move funds. And against this class of social engineering, Fireblocks’ support verification gives customers a way to confirm they’re interacting with legitimate Fireblocks personnel, helping counter deepfake and impersonation-based approaches.

DNS hijacking via social engineering

An attacker hijacked CoW Swap’s cow.fi domain by social engineering the .fi TLD registry with a fraudulent documentation package that included forged identity documents, fabricated AWS support transcripts, and AI-generated financial records. This triggered a formal transfer request that ultimately moved the domain to attacker-controlled infrastructure, where a convincing phishing site was deployed with a valid SSL certificate, giving users no browser warning. The phishing page initially harvested wallet approvals before escalating to seed phrase theft. CoW Protocol’s smart contracts, backend, and signing infrastructure were unaffected throughout. The team recovered the domain within approximately 26 hours.

Fireblocks combines its own threat intelligence with external security vendors to scan dApp connections and transactions in real time, alerting users to known drainer infrastructure and web3 phishing activity before a signature is made. Policy controls add another layer: dApp access policies restrict connections to pre-approved applications, and typed message policies limit who can initiate and sign offchain signature requests, such as the wallet approvals harvested in this attack. Since Fireblocks wallets are built on MPC, private keys exist only as distributed shares, so there is no seed phrase to steal.

Infrastructure compromise of a sanctioned exchange, assessed by the research community as a possible insider-coordinated exit scam.

Grinex, a sanctioned exchange registered in Kyrgyzstan and identified as the operational successor to Garantex, suffered from sanctions following the Russian-Ukrainian war, was drained of ~$13.74M across 54 wallets, with funds quickly converted via SunSwap on TRON. Grinex blamed “hostile Western states” and halted all operations. Some research firms publicly suggested the event may be an exit scam coordinated by insiders, which would make it the latest in a pattern of Russian-affiliated exchange collapses following sanctions pressure.

Compliance screening integrations flag transactions involving sanctioned entities and labeled addresses, such as those tied to the Grinex drain, so institutions can avoid touching associated funds and addresses. Additionally, institutions on Fireblocks hold funds in wallets under their own control rather than on an exchange’s books. Fireblocks Off Exchange extends this model to trading, keeping assets under the organization’s own custody while connected to exchange liquidity.

Oracle and collateral validation manipulation

Rhea Finance was exploited via a coordinated oracle manipulation attack. The protocol’s slippage protection contained a flaw in how it calculated minimum acceptable output across multi-step trades. When a trade passes through several swap steps in sequence, the protocol sums the minimum output requirements for each step individually. It fails to account for cases where the output token of one step becomes the input of the next, causing the same token to be counted twice. The attacker deliberately constructed a trade route that exploited this double-counting, making the protocol believe slippage protection was satisfied when in reality far less value was being returned. This allowed the attacker to redirect the shortfall into pools they controlled. The attacker spent approximately two days deploying fake tokens and seeding pools to create convincing collateral signals before executing the drain. Tether froze $3.29M of the stolen USDT. Approximately $4M in ZEC was routed into Zcash’s shielded pool and is cryptographically unrecoverable.

Transaction simulation displays the exact expected outcome of a trade before it is approved, so a route engineered to return far less value than intended is visible before signing rather than after execution. Smart contract analysis and anomaly detection add independent checks on suspicious contract behavior and unusual value flows beyond the protocol’s own validation logic.

Compromise of internal RPC nodes feeding the bridge’s sole verifier (DVN, Decentralized Verifier Network), combined with a DDoS of external RPC fallbacks, causing the verifier to confirm a forged cross-chain message with no corresponding source-chain burn.

Lazarus Group (UNC4899) stole approximately $292M from the KelpDAO rsETH LayerZero bridge. By compromising internal RPC nodes and disrupting external fallback nodes, the attacker caused the bridge’s 1-of-1 DVN, a configuration in which a single entity verifies cross-chain messages, to read exclusively from attacker-controlled infrastructure. With the verification path poisoned, the Ethereum bridge contract released funds against a token burn on the source chain that never occurred.

KelpDAO paused contracts in time to block a second attempted drain of approximately $95M, and the Arbitrum Security Council, coordinating with law enforcement, froze over 30,000 ETH of the attacker’s downstream funds. Subsequent analysis traced the origin of the attack to a social engineering campaign that began roughly six weeks earlier, delivering macOS backdoors (FLATROOF and ROOFDECK) via a malicious repository to the computer of a LayerZero developer.

This incident highlights the importance of verifier architecture: a single-verifier configuration concentrates risk, especially when that verifier is a third-party dependency whose threat surface an organization cannot fully see.

Fireblocks is architected on the assumption that any single component, internal or external, can be compromised. Transaction data is cryptographically signed and independently verified by multiple co-signers across the entire flow, and policy checks are enforced at initiation, validation, and signing. The architecture is designed so that no single verifier, node, or infrastructure provider can unilaterally authorize the movement of funds, containing the blast radius when a dependency is breached.

Supply chain compromise via a third-party AI tool (Context.ai) used by a Vercel employee, enabling attacker access to internal environment variables.

Vercel, host to a significant portion of web3 frontend infrastructure, disclosed unauthorized access to certain internal systems originating from a supply chain compromise of Context.ai, a third-party AI productivity tool used by a Vercel employee. Context.ai had suffered a breach of its Google Workspace OAuth application, which had been granted broad permissions by users during onboarding. The attacker used compromised OAuth access to pivot through a Vercel employee’s accounts and ultimately decrypt environment variables containing crypto project API keys.

Fireblocks API authentication uses asymmetric cryptography, so the secret key is held by the customer and never transmitted or stored by Fireblocks. Even if a hosting or CI/CD environment is compromised, an exposed credential is not sufficient to move funds on its own. Transactions must still satisfy policy rules and approval quorums enforced independently of the credential. Several layers work to contain and detect this class of compromise:

• Granular API user roles: API users are scoped to defined roles (viewer, editor, signer, admin), so a single compromised credential is limited to its assigned permissions rather than granting full account control.
• IP whitelisting: API access can be restricted to pre-approved IP ranges, blocking use of a stolen credential from unauthorized network locations.
• Threat intelligence detection: Fireblocks threat intelligence detects malicious activity based on known indicators of compromise (IOCs).
• Visibility and monitoring: Fireblocks Security Posture Management (FSPM) and the Security Center help teams configure access and policies correctly, monitor for vulnerabilities, and maintain visibility into API user activity, including geolocation, IPs, and permissions.

Missing access control on NEP-141 token contract callback.

The SWEAT token contract on NEAR suffered an exploit rooted in a missing access control guard on its ft_resolve_transfer callback, a function responsible for issuing refunds when a receiving contract fails to consume transferred tokens. Without enforcement that only the token contract itself can invoke this function, it was left publicly accessible. An attacker exploited this by deploying a malicious contract that returned empty bytes from a no-operation call, then called the function directly on victim wallets. The contract interpreted the empty return as “zero tokens consumed” and refunded the victim’s entire balance to the attacker, with no phishing, no compromised keys, and no user interaction required. Fireblocks detected the live exploit through blockchain monitoring and identified the root cause within approximately 20 minutes via automated decompilation and receipt graph analysis. Applying the same method proactively, Fireblocks identified the same unguarded callback in the HOT token contract (22M+ holders) and reported it to maintainers, who patched it the same day.

Continuous blockchain monitoring and automated contract analysis, including decompilation and receipt graph analysis, allow Fireblocks to detect live exploits and trace root causes in minutes rather than days, as this incident demonstrated. The same tooling is applied proactively to surface vulnerable contracts before attackers find them, as with the identical flaw identified and patched in the HOT token contract. For customers, smart contract policies restrict interactions to vetted, whitelisted contracts, limiting exposure to unaudited token implementations.

Prompt injection via Morse code relayed through a multi-agent AI system (Grok + Bankrbot) triggered an unauthorized onchain transfer without human oversight.

Bankr, an AI-powered trading assistant on the Base chain, was exploited. The attacker first transferred a “Bankr Club Membership NFT” to Grok’s wallet, which elevated Grok’s permissions within the Bankr ecosystem and removed standard transfer caps. The attacker then posted a public message on X encoding a transfer instruction in Morse code, directed at @grok with a translation request. Grok decoded the message into plaintext and tagged @bankrbot with the result. Bankrbot executed the decoded instruction as a financial authorization, transferring approximately 3 billion DRB tokens to the attacker’s wallet without source validation or human confirmation. Fourteen user wallets were affected. Approximately 80–88% of stolen value was recovered through negotiation; Bankr committed to reimbursing all remaining user losses. Bankr experienced an additional breach on May 19, rooted in private key compromise, resulting in ~$386K stolen.

Policy controls are enforced at the infrastructure layer, outside any agent’s context, so transactions must satisfy predefined rules before signing regardless of what an AI system is instructed to do. An injected prompt can manipulate an agent’s behavior, but it has no path to rewrite the policies or approval quorums that govern whether a transfer is signed. This reflects a core principle of agentic security: guardrails belong in the infrastructure, not in the agent. When permissions, spending limits, and approval requirements are enforced at the transaction layer rather than left to the agent’s judgment, a compromised or manipulated agent is contained by controls it cannot alter. Fireblocks outlines this approach to building secure agentic infrastructure in more detail here, and the broader agentic finance threat landscape and security models are covered in the Agentic Finance and Stablecoins report.

Unprotected authorized order signer registration function in TrustedVolumes’ custom RFQ swap proxy contract allowed any address to add itself to the approved signer allowlist.

TrustedVolumes, a liquidity provider and resolver for 1inch Fusion and other DeFi aggregators, was exploited on May 7. The attacker registered themselves as an authorized order signer on TrustedVolumes’ RFQ proxy contract and issued forged trade orders that the protocol accepted as legitimate. The resolver contract was drained of approximately $6.7M across roughly 85 transactions. All assets were converted to 2,513 ETH and split across three attacker-controlled wallets. 1inch confirmed its own protocol and user funds were unaffected.

The attacker was identified as the same operator behind the March 2025 1inch Fusion V1 exploit ($5M).

Fireblocks enforces strict controls over who can authorize transactions, with signer permissions governed by policy rather than by a contract function any address could call. Least-privilege access and policy-verified approvals help prevent an attacker from registering themselves as an authorized signer. Changes to signer permissions and configurations require multi-administrator approval.

Progressive key material leakage inherent to the GG20 TSS protocol.

THORChain experienced an exploit carried out by a malicious validator node that had joined the network two days prior. The protocol uses GG20, a class of MPC protocol that does not incorporate zero-knowledge proofs, which can allow information related to the private key to be leaked during signing. The node participated in routine GG20 signing ceremonies and used each round to progressively reconstruct the full private key of one of the protocol’s five vaults. Once the key was reconstructed, the attacker bypassed the signing ceremony entirely and broadcast unauthorized outbound transactions directly, draining approximately $10.7M across multiple chains. THORChain’s automatic solvency checker detected the vault imbalance within minutes and halted signing and trading across six chains, and the remaining four vaults were unaffected.

Fireblocks’ MPC-CMP protocol incorporates zero-knowledge proofs and additional verification checks at every signing round, addressing the class of progressive key-material leakage inherent to the older GG protocol family. Fireblocks researchers have publicly documented vulnerabilities of this kind, including the BitForge zero-days affecting GG-18, GG-20, and Lindell17 implementations. Key shares are also protected in hardware-isolated environments and can be automatically refreshed, so partial material an attacker collects goes stale.

Missing source-amount validation: the bridge verified a transaction exists, but not its amount.

An attacker exploited a missing input validation in the Verus-Ethereum Bridge by submitting a cross-chain transaction with empty source-side economic values. The bridge’s notary validators signed the transaction and the Ethereum contract paid out full reserves, as neither verified that the source-side values actually backed the requested payout. The Verus team reached a settlement with the exploiter on May 22 and closed the investigation.

For institutions moving assets across chains, Fireblocks’ smart contract policies restrict interactions to vetted, whitelisted bridges, and transaction simulation and anomaly detection add independent checks on expected value flows. This reduces reliance on any single contract’s validation logic to catch a malformed or unbacked transaction.

Private key compromise of one signer in a 1-of-3 minting multisig.

StablR’s USDR and EURR stablecoin contracts on Ethereum were exploited on May 24. An attacker compromised a private key belonging to one of three authorized signers on the protocol’s self-managed minting multisig. That multisig required only a single signature to execute administrative actions. The attacker added their own address as contract owner, removed the two legitimate signers, and minted 8.35M USDR and 4.5M EURR. The minted tokens were swapped on decentralized exchanges for 1,115 ETH.

Fireblocks enforces multi-party approval and policy controls on administrative actions like minting, so a single compromised key is not sufficient to add an owner, remove signers, or mint supply. Governance is enforced structurally rather than left to a single-signature configuration.

Unencrypted private key backups on a single corporate laptop, compromised via DPRK spear-phishing malware.

On June 8, attackers breached Humanity Protocol via three concurrent vectors using keys extracted from a single compromised device: the bridge contract was upgraded via Gnosis Safe to drain 141.2M $H, and the BSC token contract was used to mint over 200M $H. The $H token crashed approximately 89%. Forensic investigation traced initial access to a Bithumb phishing email sent on June 5, which delivered Hancom-signed remote-access malware to a company director’s device. The tooling and operational patterns were assessed as characteristic of DPRK-linked intrusions; no specific sub-group was named.

This vector depends on complete private keys, or their backups, existing on a single endpoint. On Fireblocks, keys are generated and stored as distributed MPC shares in hardware-isolated environments and are never assembled into a whole key, so there is no key file or backup on a laptop for malware to extract. Privileged actions such as contract upgrades and minting are additionally governed by policy rules and multi-party approval on independent devices, so compromising one employee’s machine is not sufficient to move funds or alter contracts.

Through a “infinite mint” contract vulnerability.

An attacker drained $4.67 million in wrapped assets from Secret Network’s Axelar bridge by exploiting a modified contract that accepted IBC* deposits from any channel without validating the source. The attacker created a single-validator Cosmos blockchain and opened a new IBC channel to the Secret Network bridge contract, then self-relayed forged deposit packets carrying token denominations that matched the contract’s allowlist. This minted unbacked wrapped tokens on Secret Network, which the attacker later redeemed through the legitimate Axelar IBC channel, withdrawing real assets from Axelar’s escrow. The theft went undetected for seven days because Secret Network’s privacy-by-default architecture encrypts all onchain data. The shortfall surfaced June 17 when a routine cross-chain transfer failed because the Axelar escrow had been emptied.

*Inter-Blockchain Communication, a protocol allowing Cosmos chains to exchange messages and tokens

Transaction and dApp scanning alert against exploited contracts and malicious dApps in real time, flagging risky interactions before a signature is made. Independent transaction monitoring and cross-chain policy controls add a further layer, helping detect unbacked mints and anomalous escrow activity that a protocol’s own source validation may miss.