6 Things Blockchain Attacks Tell Us to Double Check
Inhaltsübersicht
Blockchain attacks are rarely attacks on the blockchain. In 2026 the money has gone missing through stolen keys, hijacked signing systems, and developers talking to the wrong recruiter, while the chains kept running exactly as designed. Decrypt notes that the Binance attack targeted the exchange’s own infrastructure, not the blockchains themselves, and TRM Labs found that infrastructure and operational compromise caused about 76% of first-half 2026 losses from only about 15% of incidents. Here are six things to double check.
1. Who holds the pen?
Most losses come from whoever can sign a transaction, not from broken cryptography. TRM counted a record 207 hacks and $972 million stolen in the first half of 2026, and the biggest share came from infrastructure and operational compromise, chiefly private-key and seed-phrase theft. In the Binance case, Binance found no evidence of a leaked wallet key. The attackers reached the signing service itself. Double check who and what can trigger a signature, and from where.
2. Does your approval flow see everything?
Binance had overlapping controls that raised alerts on large transfers. Dark Reading reports that the attackers got around them with an EIP-7702 sweeper: 50 pre-signed authorizations that turned a hot wallet into an account only they could operate. Co-CEO Richard Teng said the delegation did not pass through the exchange’s normal approval controls. Secure.com puts it neatly: the feature supplied the mechanism, not the access. Double check that every route that can move value, including new account features, goes through the same approval path.
3. Is that recruiter real?
The way in was a job offer. Binance’s post-mortem describes a tampered Homebrew install in June and a fake recruiter’s coding assignment in September, and TRM attributes about $643 million, roughly 66% of first-half 2026 stolen funds, to North Korea-linked activity. Treat developer laptops like production and run unsolicited code in isolation. Our DarkBlinders breakdown shows the same lure used elsewhere.
4. Can you act in 40 minutes?
Tether and Circle froze funds within about 40 minutes of the main Ethereum sweep, according to CryptoTimes. ETH and BTC have no such control. Elliptic counted about $3.11 billion still with the attackers on November 6, while Binance says about $2.85 billion was frozen or intercepted. Speed decides how much stays reachable, so double check who you would call, who can freeze what, and whether you have ever practiced it.
5. Don’t let the 60% distract you from the 76%
About 60% of first-half 2026 hacks were smart-contract exploits, but they took a small share of the money. Code bugs are common and worth auditing. Keys and infrastructure are rarer and take most of the dollars. Double check the boring parts of your stack as hard as the clever ones, and test the attack paths, not only the policies.
6. Who is pretending to be you?
Attackers copy trusted names. Binance says it detected and prevented 57 suspected North Korea-linked cases in 2026, including fake job interviews, malicious developer tools, and fake video-conferencing apps. Lookalike domains, fake recruiter profiles, and stolen credentials feed all of it. Schutz der Marke detects and takes down malicious domains, fake social media accounts, and fraudulent mobile apps, Credential Intelligence flags leaked credentials before attackers use them, and Überwachung des Dark Web watches the places they trade.
That is the whole list. Our October 26 roundup und 2026 cyber crime investigations post cover the Binance case in more detail.
FAQs
A blockchain attack is an attack on the systems, keys, or code around a blockchain: wallets, signing infrastructure, smart contracts, bridges, and the endpoints of the people who run them. The chain itself is rarely what breaks. TRM found that infrastructure and operational compromise caused about 76% of first-half 2026 losses.
In theory, yes. In 2026’s record, nearly all the damage came from around the chain, not through it. Smart-contract exploits made up about 60% of first-half 2026 incidents but a small share of the value, and the largest crypto theft on record, Binance, targeted the exchange’s own infrastructure and used an Ethereum feature working as designed.
EIP-7702 is an Ethereum feature added in 2025 that lets a normal account temporarily behave like a smart contract. The attackers used 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper that only they could operate. Binance says the delegation did not pass through its normal approval controls.
Sometimes. Stablecoins such as USDT and USDC have admin controls that let issuers freeze them, and Tether and Circle did so within about 40 minutes of the main Binance sweep. ETH and BTC have no such control. Binance says about $2.85 billion was frozen or intercepted, and Elliptic counted about $3.11 billion still with the attackers on November 6.
A hot wallet is connected to the internet so it can process transactions quickly. A cold wallet is kept offline. Exchanges keep operating balances in hot wallets for speed, which also makes them the target. TRM described the Binance attack as a compromise of its hot-wallet signing infrastructure.
Work through the six checks: who can sign, whether approvals see every route, whether developers are vetted against fake recruiters, how fast you can freeze and respond, whether you test beyond smart-contract code, and who is impersonating you. Then test the attack path, not just the policy, because the controls that matter are the ones configured to allow or block each step.
Über den Autor
