Executive Summary
In July and August 2026, the crypto industry recorded 184 security incidents, with total losses reaching $535 million. DeFi remained the most affected sector, accounting for 38% of incidents, while phishing and fraud accounted for 31% and endpoint and supply chain security incidents accounted for 17%.
Crypto security risks during the period showed four key characteristics: persistently frequent on-chain attacks, the accelerating spread of off-chain attacks, expanding supply chain risks, and the early emergence of AI-related threats. Attackers can obtain credentials or authorization to move funds through tools and services that users and developers encounter in their daily activities. In addition to strengthening routine defenses, platforms must promptly identify and intercept risk-related funds flowing onto their systems, buying time for subsequent investigations and asset recovery.
During July and August, MEXC successfully acted on all 215 reports of risk-related funds, intercepting approximately 38.66 million USDT. During the same period, the platform identified and restricted 20,752 risk-related accounts and manually processed 818 applications for the return of misdirected assets. The total balance of the Futures Insurance Fund rose to 792 million USDT, while the disclosed reserve ratios for BTC, ETH, USDT, and USDC all remained above 100%.
1. July–August Crypto Industry Security Incident Overview
Security incidents during the period affected centralized institution wallets, DeFi protocols, phishing and fraud, endpoints, supply chains, and other areas. A total of 184 incidents were recorded in July and August, resulting in total losses of approximately $535 million.
By incident count, security incidents in July and August were distributed as follows:
| Distribution of Crypto Security Incidents | ||
| Category | Number of Incidents | Share |
| Centralized Security | 12 | 7% |
| DeFi Security | 70 | 38% |
| Phishing & Scams | 58 | 31% |
| Endpoint & Supply Chain Security | 31 | 17% |
| Other Threats | 13 | 7% |
Losses From Security Incidents in July–August 2026
| Financial Losses by Security Category (July-August 2026) | |
| Category | Amount（Unit: US$10,000） |
| Centralized Security | 17,300 |
| DeFi Security | 29,700 |
| Phishing & Scams | 3,300 |
| Endpoint & Supply Chain Security | 379 |
| Other Threats | 2,805 |
DeFi ranked first in both incident count and losses. Although centralized security incidents were the fewest by count, they caused $173 million in losses, ranking second by value. This shows that once wallet or fund authorization is compromised, a single incident can still result in substantial asset losses. The share of phishing and fraud incidents rose from 17% in the previous period to 31%, while endpoint and supply chain security incidents increased from 13% to 17%. Together, these two categories accounted for approximately 48% of incidents, nearly half of the total for the period.
2. Major Threat Types and Representative Cases
- Centralized Security
- A critical vulnerability was discovered in the Zilliqa Ledger application, and ZIL was stolen from the cold wallet of one of its partner exchanges.
- The hot wallets of Singapore-based stablecoin payment company Triple-A were accessed without authorization across multiple blockchains, resulting in losses of approximately $11.8 million.
- Ethereum and TRON hot wallets associated with Coinsbuy, a B2B crypto payment processor, were compromised, resulting in losses of more than $7.9 million.
- A firmware vulnerability in Coinkite’s Coldcard hardware wallet allowed private keys to be brute-forced offline, resulting in cumulative losses of more than $100 million across multiple waves of attacks.
- DeFi Security
- BonkDAO was attacked through a malicious governance proposal, resulting in the theft of approximately $20 million worth of BONK.
- An Arbitrum bridge operated by AFX Trade was attacked after hackers used a compromised validator hot key to satisfy multisignature requirements and withdraw approximately $24.15 million in USDC.
- Lending protocol Tectonic suffered a price manipulation attack in which the attacker extracted approximately $120.4 million in a single transaction. The Cronos chain halted and rolled back blocks, but $9.19 million had already been bridged to Ethereum and could not be recovered.
- Phishing and Fraud
- BitMart’s official Chinese-language account was compromised on August 17, and the attacker used it to publish phishing posts.
- A Robinhood founder’s seed phrase was exposed during a livestream, allowing hackers to promote the $1 meme coin. The token’s market capitalization rapidly rose from approximately $500,000 to $14 million before the hackers sold their holdings for a profit.
- Singapore police disclosed a cryptocurrency fraud case in which attackers stole $11.8 million in corporate assets through a fake recruitment process and malware.
- Endpoint and Supply Chain Security
- Thirty malicious npm packages disguised as trading bot code repositories were designed to steal developer keys and seed phrases.
- MetaMask reportedly discovered that North Korean hacker Tyler Knapp had infiltrated the organization as a contractor and participated in the development of fiat on- and off-ramp services.
- Customer data belonging to hardware wallet provider Trezor was exposed by a logistics provider, resulting in the theft of sensitive information belonging to more than 13,000 customers.
- Forty malicious crypto wallet extensions appeared on Firefox, impersonating wallets such as Rabby Wallet to steal seed phrases.
- Other Threats
- Boltz suspended its swap service indefinitely following AI-assisted attacks. Its founders exited, and a group of veteran Bitcoin users agreed to provide funding and take over the service.
- Security firm Genians found that North Korea-linked hacking group Kimsuky was building AI tools to automate phishing, analyze stolen data, and enhance malware development.
- Ravencoin was attacked through a consensus vulnerability, causing its price to fall sharply while some transactions faced the risk of chain reorganization.
3. Summary of Industry Security Trends in July‒August 2026
3.1 Major Losses Remain Concentrated in Protocols and Wallets
During the period, DeFi and centralized security incidents caused approximately $297 million and $173 million in losses, respectively. Governance proposals, cross-chain validation, and wallet keys directly determine whether funds can be accessed and transferred. Platforms and projects should assess whether fund authorization is overly concentrated and whether keys are properly isolated. They should also combine abnormal transaction monitoring, operating limits, and emergency suspension measures to contain losses when a single control point is compromised.
3.2 Phishing and Fraud Increase as Attacks Blend Into Routine Business Activities
The share of phishing and fraud incidents rose from 17% in the previous period to 31%. Attackers may exploit familiar accounts or seemingly routine business processes to gain trust, embed phishing links in community messages, or persuade users to download malicious programs under the guise of recruitment tests or work assignments.
Even when a message comes from a familiar account, users should verify its source and purpose through another channel before downloading software, providing credentials, or signing transactions. Recruitment tests or external code involving corporate devices or internal systems should be reviewed by security personnel before execution. Platforms and projects should also monitor official accounts and publishing channels, promptly restrict activity after a compromise, and alert users.
3.3 Supply Chain Risks Affect Tools, Personnel, and Customer Data
Third-party risks span development tools, personnel permissions, and customer data. Endpoint and supply chain security incidents increased from 13% in the previous period to 17%. Cases involving malicious npm packages, counterfeit wallet extensions, outsourced developers, and logistics data breaches show that sensitive information may be exposed across development, partnerships, and customer service.
Companies should verify the sources of packages and extensions and determine whether version updates add data-reading or other operating permissions. Contractors and service providers should receive only the permissions required for their work, and those permissions should be revoked promptly when the engagement ends. API keys, private keys, and cloud credentials should be stored separately with restricted access, reducing the risk of simultaneous exposure if a development device or third-party tool is compromised.
3.4 Attackers Seek to Improve Efficiency With AI
Attackers are attempting to use AI to automate parts of their operations. The Kimsuky hacking group is building AI tools that can automate phishing, analyze stolen data, and assist in malware development. Boltz said it had suspended its swap service after being subjected to persistent AI-assisted attacks. These cases show that companies need to identify threats, patch vulnerabilities, and respond more quickly.
When companies use AI tools, intelligent agents, skills, and plugins, they should also determine which files these tools can read, which APIs they can call, and which programs they can execute. The broader a tool’s permissions, the more data and systems may be affected by an erroneous action or malicious instruction.
Unreviewed code, skills, and plugins should first be inspected in an isolated test environment and should not be granted direct access to sensitive credentials, internal code, or production systems. After approval, tools should receive only the permissions required to complete their tasks. Any new functionality or expanded permissions should trigger another risk review. Companies should also retain activity logs so they can promptly stop execution and revoke authorization when anomalous behavior occurs.
4. MEXC Trust: Risk-Related Fund Interception and Verifiable Asset Protection
4.1 All 215 Reports of Risk-Related Funds Successfully Intercepted
During July and August, MEXC assisted with 215 reports involving externally stolen or fraud-related funds flowing onto the platform. All 215 cases were successfully intercepted, covering 38,655,490 USDT, or approximately 38.66 million USDT. This included 42 cases involving assistance with judicial freezes, all of which were also successfully intercepted.
To promptly identify risk-related funds flowing onto the platform, MEXC shares suspicious addresses with major industry participants, assists in tracing stolen and fraud-related funds, and supports verification and freezing procedures in accordance with investigation and law enforcement cooperation processes, buying time for subsequent asset recovery.
4.2 20,752 Risk-Related Accounts Identified and Restricted
MEXC identified and restricted 20,752 accounts associated with risk-related activities during the period, an increase of 118.03% from the previous reporting period. The platform identified 5,288 risk groups, up 20.35%, concentrated primarily in the Commonwealth of Independent States (1,803), Nigeria (1,099), and Indonesia (976). By identifying accounts and related activity, the platform can further investigate abnormal transactions and fund flows, supporting subsequent restrictions and investigative action.
4.3 818 Applications for the Return of Misdirected Assets Manually Processed
For user asset recovery, MEXC manually processed 818 applications for the return of misdirected assets during the period, returning the equivalent of 602,225 USDT, an increase of 75.31% from the previous reporting period. The average amount returned per application was approximately 736 USDT, up approximately 74% from about 423 USDT in the previous period. This manual verification and return service continues to support eligible applications involving misdirected assets.
4.4 Futures Insurance Fund Reaches 792 Million USDT
As of September 1, 2026, the total balance of the MEXC Futures Insurance Fund reached 791,696,422 USDT, an increase of approximately 5.44%.
The Futures Insurance Fund primarily covers negative balance shortfalls that may arise after liquidation. A sufficient fund balance helps absorb settlement risks during extreme market conditions and reduces the likelihood of auto-deleveraging (ADL). If the fund cannot cover a shortfall, the relevant deleveraging mechanism may still be triggered. Users can view fund information on the Proof of Trust page of the MEXC website.
4.5 Reserve Ratios for Four Major Assets Exceed 100%, With BTC at 287.53%
MEXC maintained reserve ratios above 100% for BTC, ETH, USDT, and USDC. The wallet balances and corresponding user assets for each asset are as follows:
| Asset | Reserve Ratio | Platform Assets | User Assets |
| BTC | 287.53% | 12,312.75 BTC | 4,282.20 BTC |
| ETH | 113.29% | 66,227.79 ETH | 58,457.33 ETH |
| USDT | 114.66% | ≈ 1.94 billion USDT | ≈ 1.692 billion USDT |
| USDC | 113.95% | ≈ 194.85 million USDC | ≈ 171.00 million USDC |
The relevant on-chain wallet addresses have been disclosed. Through the Merkle Tree proof of reserves, users can verify whether their account balances were included in the corresponding liability snapshot and review the reserve coverage disclosed by the platform.
4.6 Guardian Fund Maintains a Dual-Reserve Structure of USDT and BTC
MEXC currently maintains a $100 million Guardian Fund with a dual-reserve structure of USDT and BTC. The USDT portion provides immediate liquidity support, while the BTC portion serves as a long-term reserve allocation. MEXC plans to expand the fund to $500 million, continuing to strengthen user asset protection.
- USDT: 0x469AfE803C54A36674C55231489Cf4b61da8c1bC
- BTC: 1MDVjZdX8QD212pT8Z8EMP7DuFQHKqN3mx
5. Conclusion
Security incidents during the period show that risks exist not only in on-chain protocols but also in the tools, accounts, and business processes users encounter every day. Phishing and fraud incidents, together with supply chain incidents, accounted for nearly half of the total. The emergence of AI-assisted attacks has further compressed the time available for companies to identify and respond to threats.
For platforms, security requires more than protecting their own systems. They must also intercept risk-related funds as they enter the platform, rapidly identify anomalous account activity, and upgrade defenses as the attack surface expands. These capabilities are equally important in determining the effectiveness of asset protection.
MEXC will continue to publish bi-monthly security reports and proof of reserves, regularly disclosing the platform’s security performance and asset reserve information so that every step of MEXC Trust can be seen, verified, and continuously tracked.
