Private Key Compromise attacks in 2026

An attacker emptied 1,404 Qubic wallets created with predictable seeds, taking about 2.94 trillion QU worth roughly $1.4 million before validators halted the chain.

A server intrusion drained crypto casino Gamdom's hot wallets across several chains for roughly $4.2 million in a suspected key compromise.

An estimated $86 million was drained from Ledger users who bought devices from reseller CryptoBilis, in a suspected supply-chain attack that captured their seed phrases.

An attacker whitelisted a fresh contract on an unidentified Base vault and borrowed against its Aave V3 position to drain about 1,783 wstETH, roughly $6 million.

Attackers drained about $7 million from crypto casino Duelbits's hot wallets across five chains in a suspected private-key compromise, forcing the platform offline.

Attackers used compromised recovery phrases to sweep roughly 11.7 million XRP — about $18 million — from over 6,600 D'CENT App Wallet accounts across five chains.

A flaw in XRP Healthcare's XRPH Wallet app exposed users' seed phrases, letting an attacker drain 4,011 wallets of roughly 267,664 XRP and XRPH tokens worth about $452,000 on the XRP Ledger.

Attackers drained roughly $7.9M in USDT and ETH from crypto payment processor Coinsbuy across Tron and Ethereum in a coordinated hot-wallet key compromise.

A 2021 Coldcard firmware build flag disabled the hardware RNG, weakening wallet seeds enough to brute-force offline. Attackers drained ~1,816 BTC (~$116M) from 5,200+ addresses.

Attackers social-engineered an AFX Trade developer, seized 5 of 7 bridge validator keys, and drained $24.15M in USDC from the Arbitrum perp DEX.

An attacker seized the upgrade authority of B² Network's staking contract on BNB Chain and drained 8.591M B2 tokens (~$3.86M), swapping them into ~1,128 ETH.

Coinspect disclosed 'Ill Bloom,' a weak-randomness flaw in some wallets' seed-phrase generation that let attackers brute-force keys and drain over $5 million.

A predictable-randomness flaw in SecondFi's Cardano wallet-generation software let attackers drain about $2.4M in ADA from 178 wallets, with up to $20M more potentially at risk.

A compromised Humanity Foundation key let an attacker drain wallets and mint 100M H tokens on BNB Chain, netting about $32M and crashing $H nearly 90%.

An attacker with control of privileged minting rights created 99 million TSR tokens on BNB Chain and dumped them for roughly $2.5 million, crashing the token nearly 99%.

An attacker controlling a legacy DxSale liquidity-locker contract on BNB Chain drained roughly $7.3 million of BNB from more than 1,400 locked pools, amid strong suspicions of insider involvement.

An attacker minted 1,000 unbacked eBTC (~$76.7M nominal) on Echo Protocol via an admin-key compromise, used it as Curvance collateral, and extracted ~$821K through Tornado Cash before containment.

~$10.8M drained from THORChain Asgard vaults across nine chains via a suspected GG20 threshold-signature flaw exploited by a malicious node operator.

Wasabi Protocol's perp vaults across Ethereum, Base, Berachain and Blast lost $5M when a compromised deployer EOA with sole ADMIN_ROLE allowed UUPS upgrades.

Volo Protocol's Sui vaults lost $3.5M after social engineering compromised the admin key. The team froze $500K in 30 minutes and blocked a $2.1M WBTC bridge.

Resolv Labs lost $25M after attackers compromised its AWS KMS keys; a $100K USDC deposit minted 50M USR and depegged the stablecoin 74% in 17 minutes.

Step Finance lost 261,854 SOL ($27M) from treasury and fee wallets to a 'sophisticated' actor. STEP fell 96%; Step, SolanaFloor and Remora all shut down.