A rogue OpenAI research agent bypassed blocks on the Australian government health-data portal, accessing non-public files in June.
A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol’s recent hack, according to blockchain security company Quantstamp.
The decentralized identity company said a compromised employee’s laptop enabled attackers to steal $36 million in Humanity (H) tokens on Monday.
The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response.
The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp
Quantstamp added that the malware was signed with a South Korean Hancom digital certificate, a pattern it described as “characteristic of DPRK intrusions.” The malware enabled attackers to copy Humanity Protocol director Chong Yee Wai’s MetaMask wallet credentials and private keys.
The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April.
North Korean hackers tied to some of the largest crypto hacks
According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion lost to crypto exploits in 2025, while accounting for 12% of total incidents. CertiK said the figures reflect a focus on “precision and scale.”
Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the report said.
Related: CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea
CertiK added that North Korea has “industrialized” crypto theft into a core state revenue mechanism, making these operations a substantial share of the regime’s external income.
Total DPRK crypto theft over the years. Source: CertiK/Skynet
North Korea rarely responds to cybercrime allegations, but on May 3, a Foreign Ministry spokesperson rejected them in a statement carried by the Korean Central News Agency, the country’s state media.
The spokesperson accused the US of spreading “incorrect” narratives about the “non-existent ‘cyber threat’” from North Korea.
Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Decentralized finance has gotten a lot safer over the past six years, and a new review of protocol losses from 2020 through 2025 puts a pretty large number behind that claim.
Industry-wide DeFi losses peaked at $2.62 billion in 2022 and fell roughly 80% to $534 million by 2024. Bridge hacks that once produced billion-dollar headlines now account for a tiny slice of annual totals, and the typical exploit today does about a quarter as much damage as it did at the peak.
While this is certainly great news for the crypto industry, there’s still quite a bit of risk left; it just shows up in a different place. Major protocols now often deploy the same code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet, and Sonic, so a single flaw can now drain funds on every network running it at the same time, and that’s the form crypto’s next systemic problem is likely to take.
We’ve seen this in November last year, when Balancer’s V2 Composable Stable Pools were drained of roughly $128 million in under half an hour across six blockchains simultaneously.
According to Check Point Research, the attacker exploited an arithmetic precision flaw in the pools’ invariant math, nudging token balances onto a rounding boundary and then chaining batched swaps until those tiny errors compounded into a full drain.
The contracts with the same vulnerability had been deployed on Ethereum, Arbitrum, Base, Polygon, Sonic, and OP Mainnet, so the exploit reached all of them at once because the flaw was embedded in the code itself, and that code had been copied everywhere.
As CryptoSlate reported at the time, eleven separate audits had failed to catch it, which tells you just how subtle this class of bug has become and why it’s so much harder to anticipate than the attacks that came before.
The hacks got smaller as the chains multiplied
The encouraging part of the data is that the cheap, repeatable attacks that defined crypto’s early years have mostly been engineered out of existence, and total losses dropped 80% in two years, even as DeFi’s TVL kept climbing. A huge drop was also seen in the median loss per incident, which fell from $6 million in 2022 to $1.5 million in 2025, a 75% decline.
The count of unique incidents actually rose to 83 in 2025, so more hacks are happening while each one does far less damage, which is roughly what a maturing security field is supposed to look like.
Bridges were the defining vulnerability in 2021 and 2022, and in that second year alone, nine bridge exploits resulted in $1.9 billion in losses. These hacks were truly some of crypto’s worst moments, with the Ronin Bridge accounting for a $624 million loss on its own.
CryptoSlate tracked it on-chain as the funds moved through Tornado Cash, followed by Binance Bridge at $570 million, Wormhole at $326 million, Nomad at $190 million, Harmony at $100 million, and Qubit at $80 million.
It accounted for 73% of all DeFi losses that year, and by 2025, the bridge’s share had collapsed to 3%, thanks to improved verification mechanisms, decentralized validator sets, and a broader shift toward native cross-chain messaging.
Flash-loan attacks followed the same path down. They represented 54% of all losses in 2020 when they were the signature DeFi technique, and by 2025, they accounted for under 1%, because protocols adopted defenses tailored specifically to that attack: time-weighted average prices, Chainlink oracle integrations, reentrancy guards, and designs that assume an attacker can manipulate prices within a single atomic transaction.
Private-key compromises saw a similar decline, falling from 28.7% of losses in 2022 to 8.1% in 2025. Each of these categories shrank for the same underlying reason, which is that the industry recognized a repeatable pattern and built a standardized answer to it, and as CryptoSlate’s year-end review of 2025 found, those answers have largely held.
What’s left is harder to defend against
Closing off the generic attacks left behind a far more difficult category: in 2025, 89.1% of DeFi losses came from protocol logic exploits, meaning code-level flaws specific to how one application was designed. A bridge hack involves recognizable trust assumptions, and a flash-loan attack is part of a known family of techniques, so both can be defended with reusable patterns.
However, a protocol logic bug is bespoke by nature. It emerges from the particular math, access controls, or composability choices of a single codebase, making it hard to defend against systematically, because each instance is its own puzzle and shares little with the last.
Multi-chain deployment is what turns one of these bespoke bugs into a full-blown crisis. ImmuneFi’s report draws a direct line from the defining multi-chain incident of 2021, the roughly $611 million Poly Network exploit, to Balancer in 2025.
Poly Network was a failure at the connection point between systems, the kind of choke point that bridges create, whereas Balancer was the same logic failing identically across networks that share code, signer paths, and verification assumptions. Once a chain becomes part of the default deployment map for major protocols, it absorbs the risk surface of everything it hosts, however sound its own infrastructure happens to be.
That changes how you measure an ecosystem’s safety, and the report’s method shows this by attributing the full loss from a multi-chain exploit to each affected chain, on the logic that participants across all six networks were exposed to the full impact.
The trade-off is that the 2025 hack figures for Polygon, OP Mainnet, Base, and Sonic are heavily influenced by the Balancer cascade. The report also strips out centralized exchange failures entirely, which is why the year’s largest single theft, the $1.5 billion Bybit hack that the FBI attributed to North Korea, is considered a custody failure rather than a protocol one.
On a loss-to-TVL basis, the safest tier among major ecosystems was Ethereum at around 0.42%, Solana at 0.42%, and BNB Chain at 0.33%, the three largest DeFi ecosystems by value locked, which suggests scale and security have been improving together rather than at each other’s expense.
While these changes fare much better for the average protocol, they’re not so good for the average user. A loss can now occur in an app that carries a flaw imported from elsewhere, and the convenience that makes multi-chain apps appealing is what makes this mistake escalate from a local to a shared one.
Crypto spun up all these separate chains partly to avoid depending on any single system, and the irony is that running the same handful of popular protocols across all of them has rebuilt the concentration those chains were meant to escape.
The next big incident may look small on the day it lands (a single logic bug in a widely deployed protocol), but reveal its true size only once people realize the same vulnerable code was sitting on half a dozen networks the entire time.
A $3 million XRP theft incident drained a US retiree’s Ellipal wallet, revealing the predatory industry that preys on victims after a hack.
Blockchain investigator ZachXBT, who traced the $3.05 million loss through over 120 cross-chain swaps, warned that most firms charge desperate users exorbitant fees for hollow promises of restitution.
Sponsored
Sponsored
$3 Million XRP Hack Unmasks Crypto’s Predatory Recovery Firms
The incident began when Brandon LaRoque discovered that his 1.2 million XRP had been drained from his Ellipal wallet earlier this month. Notably, the loot, worth $2.88 million at current rates, comprised the 54-year-old retiree’s life savings, accumulated since 2017.
He had believed his funds were secured in cold storage. Later, however, LaRoque learned that importing his seed phrase into the Ellipal mobile app had effectively converted the setup into a hot wallet.
“I’ve been accumulating XRP for the past eight years,” LaRoque said in a YouTube video recounting the theft. “It was our whole retirement, and I don’t know what we’re going to do.”
ZachXBT’s on-chain investigation found that the attacker converted the stolen XRP through 120 Ripple-to-Tron bridge transactions. They leveraged Bridgers (formerly SWFT), before consolidating the funds on Tron.
Within three days, the assets had vanished into OTC desks tied to Huione. The US Treasury recently sanctioned the Southeast Asian payments network for laundering billions from scams, human trafficking, and cybercrime.
The case exposes a key weakness in global enforcement by linking the XRP theft to Huione’s network. US authorities say Huione has facilitated more than $15 billion in illicit transfers.
The weakness is that even when blockchain trails are public, cross-jurisdictional laundering pipelines remain difficult to disrupt.
Sponsored
Sponsored
Predatory Recovery Industry
While law enforcement often struggles to respond swiftly, ZachXBT says a recovery economy has emerged to exploit victims’ desperation.
“Another lesson is >95% of recovery companies are predatory and charge large amounts for basic reports with few actionable insights,” he wrote.
Many such firms, he added, rely on SEO and social-media targeting to lure victims. They often provide only superficial blockchain reports or telling clients to “contact the exchange.”
This secondary layer of exploitation has turned many high-value hacks into multi-stage crimes. First, by the hacker, and then by fake recovery operators who promise to reclaim funds that are, in reality, long gone.
Self-Custody Confusion and the Broader Risk
Beyond the laundering trail, the Ellipal case reignited debate around the safety of self-custody. The victim’s confusion between Ellipal’s cold wallet and its app-based hot wallet mirrors the issue of unclear wallet design and user education gaps.
The odds of recovering LaRoque’s $3 million are slim, amid few law-enforcement units equipped to handle crypto-related crimes. The challenge increases with cross-border laundering networks like Huione thriving.
However, the real tragedy, ZachXBT implies, is that the next wave of losses may not come from hackers, but from those claiming to help get the money back.
Astra Nova, an AI-powered entertainment platform, has confirmed a major loss involving its newly launched RVV token.
In an October 18 statement, the project said the breach was linked to a compromised account belonging to one of its third-party market makers.
Sponsored
Sponsored
Astra Nova Loses Over $10 Million in RVV Token
The team said the attacker struck soon after the token’s debut, exploiting a compromise in the market maker’s account.
Astra Nova did not disclose the total amount of tokens drained from the exploit.
However, blockchain analyst EmberCN estimated the loss at approximately $10.3 million.
The analyst said on-chain data shows that the attacker withdrew 860 million RVV tokens—about 8.6% of the total supply—from the project’s minting contract. These tokens were later exchanged for Tether’s USDT stablecoin.
The massive sell-off triggered an immediate market reaction. According to CoinGecko, RVV’s price plunged more than 50% within 24 hours, sliding from $0.26 to roughly $0.0103 as of press time.
EmberCN added that about $8.2 million of the proceeds were moved to two centralized exchanges, including Gate and KuCoin. Another $2 million remains in an on-chain wallet currently under observation.
Sponsored
Sponsored
Considering this, EmberCN questioned Astra Nova’s account of events, arguing that the transaction pattern does not resemble typical hacker behavior.
“Which hacker would convert stolen assets into USDT and hold onto them? And even transfer them directly to a CEX? USDT can be frozen, and going straight to a CEX—where are there hackers this foolish,” EmberCN wrote.
Token Buyback and Bounty Offer
In response to the skepticism and the market crash, Astra Nova reaffirmed that it was a victim of an external compromise, not internal foul play.
The project announced plans to repurchase the same number of RVV tokens affected by the breach. The move aims to stabilize the token’s liquidity and reassure investors.
At the same time, the Astro Nova team also launched a 10% bounty program for anyone who returns the stolen assets to a verified recovery address.
The project’s team said it would not pursue legal action if the full amount is returned. It also described the offer as an opportunity to “close this peacefully.”
“If you return the full amount to the verified recovery address shared on our official channels, no further action will be taken, and the bounty will be transferred once confirmed by our forensics team,” the project stated.
