Virtual Asset Hacking Damage Reaches $1.1 Billion in First Half of This Year... Over Half Attributed to North Korea

"Virtual Asset Hacking Losses Reach 1.6 Trillion Won in First Half of This Year... Over Half Attributed to North Korea"

Blockaid Publishes On-chain Security Report for H1 2026

Two Incidents with Highest Damage in First Half Estimated to be Behind North Korea's Lazarus Group

An analysis revealed that $1.1 billion (approximately 1.6 trillion won) was stolen globally due to virtual asset hacking in the first half of this year, with the majority of the damage occurring in incidents presumed to be carried out by North Korea.

Blockchain security company Blockaid announced on the 28th that this was revealed as a result of analyzing 212 virtual asset exploit (vulnerability attack) incidents after publishing its 'On-chain Security Report for H1 2026'.

The number of virtual asset hacking incidents that occurred in the first half of this year was already more than three times higher than the total number of incidents last year, setting a new record high for a half-year period.

The report estimated that both of the two hacking incidents with the largest damages in the first half were carried out by 'TraderTraitor', a sub-organization of North Korea's hacking group Lazarus.

The largest damage occurred in the hacking incident of the decentralized finance (DeFi) platform 'KelpDAO', where $292 million (approximately 426.4 billion won) was stolen.

Another DeFi platform, 'Drift', was also found to have suffered hacking damage of $285 million (approximately 416.1 billion won) in less than 12 minutes.

TraderTraitor, the group behind this incident, is also known to be behind the $1.5 billion (approximately 2.1901 trillion won) hacking incident of the virtual asset exchange Bybit that occurred in February last year.

The report explained that exploiting vulnerabilities in smart contracts (technology where transactions between parties are automatically executed if certain conditions of a transaction on the blockchain are met) remains the most common type of hacking.

However, in the first half of the year, attacks targeting various vulnerabilities such as private keys, signatures, bridge infrastructure, and backend systems occurred, with damages resulting from attacks on operating systems other than smart contracts accounting for 74% of the total.

Blockaid advised that as more institutions adopt stablecoins, asset tokenization, and on-chain payments, it has become more crucial to protect the entire infrastructure and operating systems of digital assets.

Ido Ben-Natan, CEO and co-founder of Blockaid, stated, "Attackers are no longer just breaking through code; they are attacking the systems and access points that manage virtual assets."

He added, "As digital assets have become part of a broader financial system, institutions must have security strategies that can protect the entire transaction process, from authorization to execution."