Bitcoin Magazine

Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled “a list of protocols that were hacked for more than $50,000 in 2026.” 230 protocols year-to-date. “Crypto security is absolutely cooked.” September alone accounted for about $768 million in Muur’s tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.

The largest single loss was Bitget’s September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.

Liquid Network, Blockstream’s Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol. 

Samson Mow later called the episode part of an “avalanche of AI-assisted attacks” that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors. 

DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors. 

KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK’s Lazarus Group, specifically TraderTraitor. 

Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.

Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC. 

Ledger losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents. 

The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.” 

Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. 

OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year’s largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.

Bitcoin’s base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.

This post Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures first appeared on Bitcoin Magazine and is written by Juan Galt.

Bitcoin Magazine

Blink Wallet Adds Inactivity Fee to Custodial Accounts, Accelerating Migration to Self Custody

Blink Wallet announced a new $1 a month inactivity fee, aimed at custodial accounts that have not logged in to the app in over 12 months. 

The decision was put into motion in early September via a Terms of Service change, with push notifications sent out to inactive users, and the first charge made by mid-October. Fees charged will be refunded if users log back in within 12 months, according to a blog post published by the company. 

The fee, which only affects custodial accounts, serves to relieve the burden of inactive accounts on the startup. According to the announcement, these inactive accounts have ongoing costs such as “ledger and infrastructure, retention of verification records, compliance monitoring and reporting, and support claims.” These costs are in turn borne by active user accounts via normal in-app transaction fees. 

A source familiar with the matter told Bitcoin Magazine that around a hundred thousand such accounts fit the inactive category at the time of the first fee charge, with an aggregate balance of over $800,000. The first fee pulled in about $45,000, mostly from accounts that had dust amounts of bitcoin inactive for over a year. None of these figures could be independently verified. 

A Bit of History

Blink Wallet may be one of the most popular Bitcoin wallets in the world, favored by advocates of Bitcoin Circular Economies across Latin America and Africa. Designed for an audience not already familiar with Bitcoin, the wallet first came to prominence as the ‘Bitcoin Beach Wallet’. It grew out of El Salvador’s initial wave of Bitcoin adoption, choosing design principles similar to Wallet of Satoshi, which had seen viral success in earlier years. The wallet was initially custodial and oriented around fast Lightning payments, with the innovative option of hedging value in USD via the Stable Sats feature.

Historically, custodial wallets have seen accelerated early growth compared to their non-custodial counterparts. It is arguably due to the friction introduced by non-custodial setup steps like the 12-word backup, but also by the lack of key material under the company’s control, which enabled features like the first generation of Stable Sats in the first place.

Because of the smooth interface and user experience Blink offered, it quickly became a favorite for evangelists to recommend. One particular evangelist allegedly got everyone he met to download the app and gave them about $1 worth of bitcoin. Some of those new users might have stuck around. But events like today’s Blink announcement put into question the effectiveness of such evangelism strategies, given that they may just be turned into dormant dust accounts. 

Blink was eventually spun off from Galoy Inc its founding firm, to be run by Lukas Duczko and a new board of directors. The announcement published in October 2024 stated that Duczko now had a controlling stake in the company, while Galoy continued to be a service provider and minority stakeholder. The Bitcoin Beach Fund was also established at the time, seeded with Blink shares as part of the transaction. The wallet once headquartered in El Salvador is now based in the free economic zone of Roatán, Honduras, though it maintains corporate entities in El Salvador and the United States.

Headwinds

Despite its success gaining international adoption among Bitcoin circular economies, evangelists and supporters of the Lightning Network, the company has also faced significant headwinds. And not just Blink but custodial wallets in general, like Wallet of Satoshi, Alby, and Blue Wallet, all phased out their custodial wallet offerings in recent years, pivoting to self custody infrastructure like Spark. The tide began to rise with the EU’s MiCA regulations, which sought licensing and KYC compliance standards from custodians that these wallets simply could not provide. 

On the U.S. side of the pond, the Samourai Wallet case and the broader war on crypto by the Biden administration pushed wallet operators outside of the country, with notable examples like Phoenix Wallet, Wallet of Satoshi, Wasabi Wallet, and Blink, limiting or altogether exiting American app stores. The legal uncertainty took place under the shadow of the Samourai Wallet and Tornado Cash cases, which the industry read as threats to user privacy and certainly to self custody wallets, let alone custodial ones. 

Fast forward a couple of years and Google Play decided to enforce EU and American laws by limiting Play Store distribution of wallets or exchange apps that do not hold licenses in corresponding jurisdictions. The viral nature and stunningly easy-to-use apps that were possible thanks to custodial Lightning had, in a matter of 2 years, become a liability. It was time to pivot to self custody. 

Nobody Said it was Easy

By 2025, Blink’s counterparts already offered self custody options; WOS was beginning to push their Spark-powered wallet, with 2027 as the deadline for custody wallet users to migrate. Alby had shipped a feature to connect self-hosted Lightning nodes to its hub and shut down its custodial Lightning option. Blue wallet had long ago shut down its custodial offer and had since doubled down on becoming an onchain wallet for new and power users alike.

Unlike its competitors, however, Blink’s biggest differentiator is the Stable Sats feature, which likely required a significant redesign to fit the limitations of self custody. It wasn’t until June 2026 that Blink launched its Spark supported self custodial wallet, a big move and one that its user base is still adapting to. 

To make things worse, on September 19th, hackers managed to withdraw 6.61 bitcoins from custodial wallet users via compromised admin tools. The company’s backers quickly announced they would make the affected users whole, and the bleeding was stopped, but the blow nevertheless must have shaken the company. 

Remarkably, despite some of the most difficult years for the Bitcoin wallet industry, Blink wallet has so far not just survived but stayed in the game. It has retained the slick design that made it so popular, while delivering advanced features that users in developing nations need, such as dollar-denominated value at the speed of lightning, meanwhile pivoting to self custody. The inactivity fee is but an inevitable step further down that transition. Perhaps having teams like Blink’s working on self custody will yield a new crop of sovereign technologies, its fruits badly needed by a sector of the industry battered by regulators and now AI cyber threats. 

This post Blink Wallet Adds Inactivity Fee to Custodial Accounts, Accelerating Migration to Self Custody first appeared on Bitcoin Magazine and is written by Juan Galt.