Crypto’s Weakest Link

Last Friday, reports started surfacing of a multimillion-dollar hack where wallets were seemingly drained out of the blue across Tron, EVM, and Bitcoin. Over time, it became clear that the root cause of these hacks was a supply chain attack on Southeast Asian Ledger hardware wallet reseller, CryptoBilis. The reseller, which allegedly saw a change in ownership earlier this year, was distributing modified wallets with a CPU chip able to read a user’s seed phrase off its screen and transmit this data wirelessly using an embedded eSIM. While the issue seemed contained regionally initially, reports started surfacing of similar modifications on wallets purchased from resellers in the EU and in Singapore, suggesting the supply chain attack may be more widespread.

While most of the industry’s security spending over the past few years has gone toward auditing smart contracts, the Ledger incident, which is estimated to have drained just under $100M, is a clear example of attackers increasingly finding exploits that bypass smart contracts entirely. In late July and early August of this year, numerous Coldcard wallets were exploited due to weak randomness associated with generated seed phrases. This attack, which also targeted hardware wallets, led to just over $100M in stolen funds. 

Social engineering attacks, which have been a dominant attack vector for North Korean entities, have produced some of the year’s largest hacks. Drift, a perps protocol on Solana, was hacked in April of this year for close to $300M by North Korea-linked groups, following close to half a year of rapport building with the team. Posing as a trading firm, attackers were able to compromise key permissions to the protocol that allowed them to eventually drain user vaults using a worthless token as collateral. Resolv, a stablecoin protocol, experienced an exploit following a similar logic a few weeks earlier. A third-party breach led to the compromise of a contractor’s GitHub credentials, allowing attackers to mint unbacked stablecoins and drain close to $25M from the platform. In both cases, the associated smart contracts behaved as designed and the exploit itself happened at a level above, through social engineering of team members or third-party exploits.

Taken together, hacks across the industry have seen a rise in frequency while these exploits have increasingly clustered around smaller losses. Q2 and Q3 2026 have seen a sharp rise in the number of hacks to 114 and 122, respectively, a large jump from the historical baseline of around 35 to 60 hacks per quarter. The first three quarters of this year have seen roughly 287 hacks, compared to 111 over the same stretch of 2025. 

Most of that growth has come from the small end of hacks, with exploits causing under $1M in losses more than tripling over the first three quarters of the year, compared to the same period last year. As a result, the median hack size over that period has fallen from $1.2M in 2025 to $500k this year. 

Although total losses from hacks this year are slightly lower than last year ($2.24B versus $2.48B), a majority of 2025’s losses came from the $1.4B Bybit hack in February 2025. Excluding Bybit, 2026 has seen roughly a doubling in losses compared to the year prior.

As smart contract security continues to improve, attackers have shifted their attention to the two extremities of exploits: sophisticated social engineering exploits and a long tail of small exploits, many in forgotten or deprecated contracts. Part of the reason is that every smart contract exploit indirectly hardens the security of remaining protocols, which can address attack vectors proactively. On the other hand, social engineering, which targets the human links in the chain, and forgotten protocols, which do not receive active maintenance and patching, do not benefit from such hardening.

While it is difficult to remain optimistic in the face of these threats, the same forces driving the increase in these attacks are also strengthening the defense. With AI models lowering the cost of finding and executing exploits to near-zero and state-sponsored actors remaining an active threat, the frequency of hacks will no doubt continue to increase. However, these same tools are increasingly being turned toward defense and continuously harden the remaining set of protocols, which may leave the industry facing more hacks but smaller losses.

 — Toma