Security Firm Blockaid Says 212 Onchain Exploits Stole $1.1B as AI and Wallet Attacks Accelerate

The first half of 2026 was the most active period for onchain security threats on record, with Blockaid verifying 212 high-threshold exploits, a 3.4-fold increase over all of 2025.

However, the volume and technical sophistication of attacks escalated dramatically. Study data show attackers carried out 212 verified exploits during the six months, peaking in June with 57 separate incidents. Just four major incidents accounted for $707 million, or 64%, of total stolen funds. North Korea’s “Trader Traitor” hacking cluster, tied to the Lazarus Group, was responsible for approximately $609 million of overall losses, Blockaid said.

Rather than relying on smart contract bugs, these attacks targeted human and operational vectors. In the Drift breach, weeks of targeted social engineering granted attackers administrative multisig control, resulting in $285 million stolen in less than 12 minutes. In the KelpDAO exploit, attackers used social engineering against a LayerZero developer to poison RPC infrastructure and forge cross-chain bridge attestations.

Meanwhile, the report highlighted three major security boundaries that emerged in the first half of 2026 — areas historically outside standard audit scopes: EIP-7702 wallet delegation attacks, AI prompt injection, and off-chain bridge infrastructure. To highlight the threat posed by AI vulnerabilities, the report pointed to a May incident in which an attacker “used prompt injection to trick Bankr’s AI agent into approving an unauthorized transaction, taking $216K”.

Recovery rates remained starkly split depending on the attack vector. Stolen funds stemming from key compromises vanished almost immediately into mixers or cross-chain bridges. Conversely, protocol bugs occasionally allowed for partial or full recovery through swift white-hat coordination or contract pauses.