theft

According to monitoring by Blockaid, Garden's HTLC is currently under attack, with approximately $450,000 USDT stolen on Ethereum, Base, Arbitrum, and BNB Chain.In response, Garden tweeted that they have detected unusual activity, temporarily shut down the application, and launched a comprehensive investigation. More information will be released later.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

Cardano ecosystem wallet SecondFi stated that approximately 16.1 million ADA were stolen due to a vulnerability in the wallet software, valued at about 2.6 million USD. The platform will gradually shut down SecondFi and Yoroi wallet services. This incident affected 374 wallets.SecondFi indicated that an independent investigation by blockchain intelligence agency Groom Lake identified the attacker as a sophisticated external actor and found indicators possibly related to North Korea's Lazarus Group, but attribution has not yet been confirmed. SecondFi is developing a recovery tool based on zero-knowledge proofs to help affected users recover their assets and limit the information that needs to be shared. The tool is still in testing and will undergo third-party auditing before its planned release in August. SecondFi is also preparing a wallet export feature that allows users to migrate their assets to other services. The platform has not announced a direct compensation plan and has not specified whether it will use its own funds to compensate users.

According to official news, PinGo announced that its reward contract was recently attacked by hackers. The hackers exploited a vulnerability in permission verification to illegally claim 840,000 PINGO tokens.PinGo officials pointed out that this security incident has been effectively controlled, the remaining assets have been successfully migrated, and the upgrade of the related contract has also been completed. The officials emphasized that the PINGO tokens and related private keys are still in a secure state, and the reward claiming function has now been reopened.

Dragonfly partner Haseeb responded on Twitter to OpenZeppelin co-founder Manuel Aráoz's previous pessimistic view on DeFi security, stating that with models like GLM 5.2, Fable, and GPT 5.6 now online and actively used by attackers, DeFi has not experienced the anticipated "hacker apocalypse."Chart data shows that based on current year-to-date figures and operating rates, the annualized amount stolen in DeFi by 2026 is approximately $1.89 billion, with a cumulative theft of about $986 million this year, which is lower than the levels of 2025 and still within historical ranges.Haseeb believes that the deeper change currently is that while the number of hacker attacks has increased, the scale of individual attacks has decreased more rapidly, with attackers increasingly targeting smaller protocols and abandoned projects, while larger protocols have completed more security enhancements, thus the overall safety of funds has not significantly worsened.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that "isolation mode" will be launched this week, allowing users to check if their wallet addresses are involved in the related incident and submit tickets; next week, they plan to introduce a secure wallet export feature to provide a safer wallet migration path for users of different technical levels.SecondFi reiterated that it will provide potential asset recovery solutions for wallets confirmed to be affected through the process, expected to use a zero-knowledge proof-based recovery tool with set qualifications and terms; the official also reminded users that they will not request private keys or mnemonic phrases, and users should only operate through official website support and designated verification tools.

BonkDAO disclosed on platform X that it suffered a malicious governance proposal attack, resulting in approximately 20 million dollars worth of BONK tokens being stolen from the BonkDAO treasury.BonkDAO stated that during the investigation, the attacker was identified using an exchange wallet to purchase BONK before the proposal was initiated, and they are currently collaborating with exchanges, cross-chain bridges, and the Solana Foundation. Additionally, the team has notified law enforcement and continues to work with relevant parties to recover funds and trace the responsible individuals.

The security company Coinspect Security posted on platform X that by analyzing cryptocurrency wallet seeds generated with insecure code since 2018, they discovered that thousands of seeds had been actually used. Just last month, it was found that the amount stolen from these wallets reached up to 3.14 million dollars, most of which went unreported.Some funds were concentrated into a single address and exhibited money laundering patterns. One affected address transferred out 2 million dollars just hours after the alert was issued, and it is uncertain whether this was theft. Coinspect warns that users who believe many assets are still at risk may be located in China.

SlowMist issued a security alert, detecting a coordinated malicious npm supply chain attack. The attackers utilized fake trading bot repositories and DeFi-themed npm packages to deploy JavaScript information stealers, targeting npm users, DeFi developers, and trading bot users.This attack involved 30 malicious npm packages, among which stake-math@3.5.4 appeared as a locked dependency in the donoaccestag/forex-mt5-trading-bot repository. This repository presented approximately 2300 highly homogeneous bulk-generated forks, mostly concentrated under the poly-stocks account, with signals being exceptionally clear. The sensitive data that attackers could steal is extensive, including cryptocurrency wallet libraries, browser cookies and saved passwords, browsing history, developer credentials, shell history, password manager libraries, private keys, mnemonic phrases, and API tokens exposed in source code.SlowMist recommends that developers immediately remove the affected npm packages, audit package.json and package-lock.json, and check CI logs for any of the 30 malicious packages; consider any system that has executed npm install as potentially compromised, rotate all exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuild the affected environment from a clean image.

Taiko officially stated on X: "We have identified the root cause of this attack and are currently developing a fix to restore the blockchain's online operation as soon as possible. At the same time, we are working closely with major exchanges and security partners to track and freeze the hacker's assets. The remaining funds in the cross-chain bridge are currently safe, and we will announce the next steps in our upcoming updates. To focus on fixing the vulnerabilities and protecting user assets, we will pause updates for a few hours."Previously, it was reported that the Taiko cross-chain bridge was attacked, with losses potentially reaching up to $1.7 million.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.

According to SlowMist's YuXian monitoring, Aztec is suspected to have been hacked again, with its Private Rollup Bridge 0x737...A2ba showing three suspicious transactions, totaling approximately $2.15 million, involving 1,158 ETH, 150,000 DAI, and 0.46963295 renBTC.

According to CryptoSlate, the U.S. Congress is pushing to rebuild the Department of Justice's cryptocurrency crime task force. Previously, the Department of Justice disbanded the National Cryptocurrency Enforcement Team in April 2025 and stopped its "law enforcement as regulation" strategy targeting the cryptocurrency industry. The new bill was proposed by Representatives Lance Gooden and Josh Gottheimer, aiming to establish a federal cryptocurrency theft task force within the Department of Justice, responsible for coordinating investigations and prosecutions of cases involving cryptocurrency theft, hacking, fraud, and more.The task force's responsibilities include developing best practices for evidence collection, digital evidence analysis, asset tracking, and victim outreach, providing technical assistance and training to state and local law enforcement agencies, and coordinating international cross-border case cooperation. The bill explicitly excludes the cryptocurrency market, financial institutions, and financial products from the task force's regulatory scope, without changing the existing regulatory framework and criminal law. An FBI report indicates that in 2025, there were 181,565 complaints involving cryptocurrency, with reported losses exceeding $11 billion. The bill has not yet clarified details regarding funding, staffing, and victim response mechanisms.

According to CoinDesk, bipartisan members of the U.S. House of Representatives introduced a bill on Thursday to establish a federal cryptocurrency theft task force led by the Attorney General, aimed at coordinating and leading investigations into cryptocurrency theft, fraud, and hacking.The bill was jointly initiated by Republican member Lance Gooden of the House Judiciary Committee and Democratic member Josh Gottheimer of the House Financial Services Committee.The task force will encompass multiple federal agencies, including the Department of Justice, the Federal Bureau of Investigation, the Department of Homeland Security, and the Department of the Treasury, aiming to address the $11 billion theft and fraud issues caused last year and provide a unified federal response mechanism for victims.

Regarding the incident of "Humanity being stolen over 31 million dollars," on-chain detective ZachXBT stated, "It's unclear whether this is a hacker theft or malicious behavior from the project team. From the K-line chart, given the concentration of supply, the H team is likely collaborating with an active market maker. However, all H tokens were sold on decentralized exchanges (on-chain), not centralized exchanges."

According to a report by Knews, on June 7, the Supreme People's Procuratorate disclosed a new type of virtual currency theft case. A man from Shandong, Zhang, had long assisted an acquaintance, Feng, in handling virtual currency transactions. After gaining Feng's trust, he proactively suggested that Feng switch to a more convenient digital wallet. The asset mnemonic (key) of this type of wallet is generated by randomly selecting 12 combinations from 2048 commonly used English words, which is the core password for storing virtual currency.Taking advantage of the moment when Feng was copying the mnemonic, Zhang memorized 11 complete words solely by sight and strong memory, and also noted the first letter of the last word. That night, relying on fragmented memory to repeatedly test and combine, he successfully unlocked Feng's digital wallet and transferred 107 bitcoins, later selling them for an illegal profit of 660,000 yuan. The court ultimately sentenced him to ten years and nine months in prison for theft and imposed a fine of 100,000 yuan.

According to the "Procuratorial Daily," Lin, Zeng, and Dai conspired to use virtual currency trading as a pretext. During the trading process, they secretly filmed the victim's digital wallet private key and, after the virtual currency was credited, secretly logged into the victim's wallet to reverse the transaction, transferring the related virtual currency back to their controlled accounts. The three committed the crime three times, causing the victim a total economic loss of 660,000 yuan.The first-instance court held that in the absence of a clear judicial interpretation regarding the valuation method of virtual currency and sentencing standards, it was inappropriate to directly determine the amount involved as particularly huge based on the victim's purchase amount of 660,000 yuan. Therefore, they sentenced the three based on "other serious circumstances," imposing prison terms ranging from eight years to five years and six months, along with fines. The Hanyang District Procuratorate of Wuhan City in Hubei Province subsequently filed an appeal, which was supported by the Wuhan City Procuratorate.The prosecution argued that the first-instance court applied the law incorrectly and imposed an excessively light sentence. Prosecutor Dai Wentao of the Wuhan City Procuratorate stated that in the case where the victim had a clear loss amount to refer to, it was contradictory and legally erroneous to claim that the value of virtual currency could not be determined. In judicial practice, using the resale price and transaction price as the basis for determining the amount of theft has become mainstream, and determining the value of virtual currency based on the actual cost paid by the victim has factual, legal, and practical basis.The Intermediate Court of Wuhan accepted the prosecution's opinion in the second instance, revoked the corresponding content of the original judgment, and changed the determination of the theft amount to particularly huge. It sentenced the principal offender Lin to ten years and six months in prison for theft, and sentenced the accomplices Zeng and Dai to eight years in prison each, along with fines.

According to Jinshi reports, Russian President Putin stated that the "theft" of Russian assets has affected the US dollar and the euro.

According to Fortune, California cryptocurrency executive Adam Iza admitted on Monday to orchestrating a failed kidnapping attempt against the parents of Veer Chetal.The case is related to the $245 million Bitcoin theft that Veer Chetal was previously involved in. 25-year-old Adam Iza, also known as Ahmed Faiq, previously ran the cryptocurrency trading company Zort and referred to himself as the "Godfather." Veer Chetal and two others involved impersonated Google and cryptocurrency exchange technical support personnel to steal 4,100 Bitcoins from a Washington resident, which was worth approximately $245 million at the time.Adam Iza and his accomplices attempted to obtain part of the stolen funds by kidnapping Veer Chetal's parents. Additionally, Adam Iza admitted to stealing over $37 million by fraudulently accessing Meta's business manager accounts and credit lines between 2020 and 2022. Federal prosecutors are seeking at least 14 years of imprisonment during his sentencing.