Zero Bugs Found: Anatomy of 2026’s Biggest Key Heists

Two of the largest crypto thefts of 2026 have something uncomfortable in common: the code did its job. Drift, the biggest perpetual futures venue on Solana, lost about $285 million on April 1. Seventeen days later, KelpDAO’s rsETH bridge gave up roughly $292 million. Investigators combed both systems afterward and reached the verdict that has become the defining phrase of the year, borrowed from OpenZeppelin’s report on the second incident: zero bugs found.

That is not a comforting result. It is the whole problem. For most of the last decade, crypto security was a contest between attackers and Solidity. Reentrancy, integer overflows, oracle math, flash-loan logic: if you could find the flaw in the contract, you could take the money. The industry answered with formal verification, bug bounties, and audit firms that now read like a professional guild. It worked well enough that attackers changed targets. In 2026, for the first time on record, compromised private keys and credentials overtook smart-contract bugs as the leading way crypto gets stolen, according to reporting by crypto.news.

The money did not get harder to steal. The door just moved. It moved from the contract to the key, and then, in the two marquee cases of the year, to the operational machinery around the key: governance signatures, session tokens, and the servers a bridge trusts to tell it the truth. Bitcoin trades near $78,558 and the total market sits around $2.76 trillion (CoinGecko) as this is written; the value at stake keeps rising, and the cheapest way in is no longer a vulnerability report. It is a human being with signing authority.

The year the code stopped being the weak point

The numbers behind the shift are stark. Chainalysis counted more than $3.4 billion stolen across crypto in 2025, with North Korea-linked actors responsible for a record $2.02 billion, roughly 59% of the global total (The Record). The same research tracked a longer trend that matters more than any single year: attacks on personal wallets, which turn on stealing keys rather than breaking contracts, grew from 7.3% of stolen value in 2022 to 44% by 2024 (The Block).

2026 pushed that line past a threshold. Through the first eight months of the year, DeFi lost about $1.3 billion, and the defining feature was not a new class of contract exploit but the same move repeated: get the key, or get someone with the key to sign. CertiK’s mid-year review described the pattern as fewer incidents that were far more surgical, with wallet and credential breaches the single biggest category of loss (Forbes).

Ronghui Gu, CertiK’s co-founder, put the uncomfortable part plainly to Forbes: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.” That one sentence is the 2026 story. An audit certifies the code. It cannot certify the humans who hold admin rights, the laptops those humans use, or the servers a protocol trusts to relay a cross-chain message. Security researchers have argued this for a while; the harder point, which Trail of Bits has made in its work on crypto’s expanding attack surface, is that the risk has migrated to places an audit was never designed to see.

What a private key even is anymore

Private-key compromise used to mean a specific, almost quaint failure: someone got your 24-word seed phrase and drained your wallet. That still happens, and it is still the most common way ordinary users lose everything. But at the scale where eight and nine-figure sums move, the seed phrase is rarely the target anymore. The thing worth stealing is signing authority, in whatever form the system grants it.

In 2026 that authority took several shapes. It was an admin key or a multisig member’s signature that could change how a protocol behaves. It was a governance pre-signature, collected in advance and held until it was useful. It was a session token or a cloud credential belonging to a developer with production access. It was the set of servers a bridge queries to confirm that funds were locked on another chain. None of these is a seed phrase. All of them are keys in the sense that matters: whoever controls them controls the money.

This is why the old advice, buy a hardware wallet and never type your seed into a website, is necessary but no longer sufficient at the protocol level. A modern hardware signer, as we covered in our 2026 review of the leading signers, sharply narrows the attack surface for an individual. But the institutions that lost the most in 2026 were not careless with their seed phrases. They were beaten at the layer above the key, where a legitimate signature or a trusted server did exactly what it was designed to do, for the wrong person.

Case one: Drift and the signatures that never expired

Drift is the largest decentralized perpetual futures exchange on Solana. On April 1, 2026, an attacker walked out with about $285 million, more than half of the protocol’s total value locked, in what Chainalysis called the largest DeFi theft of the year at the time and, by most counts, the second-biggest exploit in Solana’s history after the $326 million Wormhole bridge hack of 2022 (Chainalysis).

There was no bug. The attackers took control of Drift’s admin rights by getting members of its Security Council, the multisig that governs the protocol, to sign transactions that looked routine but were not. According to Chainalysis, between March 23 and March 30 social engineering produced signatures from at least two council members on transactions that appeared ordinary while actually carrying instructions to transfer protocol control. The firm called it a classic case of blind signing: the signers approved what they were shown, not what they were signing.

The preparation was methodical. On March 12 the attackers created a token called CarbonVote (CVT), took control of roughly 80% of its supply, and manufactured a price for it, wash-trading in a thin pool and feeding a controlled oracle until the market read CVT at about a dollar. Once they held admin control, they whitelisted CVT as collateral, deposited 500 million units of it (nominally worth $500 million), and borrowed against the fiction. The decisive transactions cleared in roughly two minutes; crypto.news timed the core exploit at 128 seconds (crypto.news). Chainalysis traced the full withdrawal, across more than 18 different assets including $71.4 million in USDC and $159.3 million in Drift’s own JLP token, over about two and a half hours. At least 20 other protocols felt knock-on disruption.

The staging money came from where it usually does. The wallet that funded the CVT deployment traced back to a withdrawal from Tornado Cash, and TRM Labs’ early analysis pointed to North Korea (TRM Labs).

The durable-nonce trick, in plain terms

The technical hinge of the Drift attack was a legitimate Solana feature called durable nonces, and it is worth understanding, because it turns a familiar safeguard into a weapon.

Normally a Solana transaction includes a recent blockhash and expires within a couple of minutes if it is not executed. That expiry is a safety feature: a signature you gave cannot be replayed or held indefinitely. Durable nonces exist to relax that rule for legitimate reasons such as offline signing or scheduled operations. A transaction tied to a durable nonce does not expire on the usual clock; it stays valid until the associated nonce account advances. In effect, a durable nonce lets someone hold a validly signed transaction and fire it later, at a moment of their choosing.

That is exactly what the Drift attackers needed. They did not have to compromise a signer’s key. They only had to get council members to sign transactions once, then hold those pre-signed, non-expiring instructions until they had assembled everything else, the fake token, the manipulated price, the collateral, and execute in sequence. The signature was real. The signer’s intent was not. When the moment came, the pre-authorized instructions handed over admin control on command.

This is the uncomfortable elegance of the whole class of 2026 attacks. Nothing was forged. No cryptography was broken. A feature designed for convenience became the mechanism by which a legitimate signature outlived the intent behind it. It is the on-chain equivalent of signing a blank check after being assured it is only for the gas bill.

Case two: KelpDAO and the verifier that trusted one machine

Seventeen days after Drift, KelpDAO became 2026’s biggest DeFi theft outright. On April 18, attackers drained 116,500 rsETH, KelpDAO’s liquid restaking token, from the escrow behind its cross-chain bridge, a loss OpenZeppelin put at roughly $292 million (OpenZeppelin). Once again the post-mortem’s headline was that no contract bug was involved. OpenZeppelin titled its analysis, without irony, $292 Million Lost, Zero Bugs Found.

The failure was in what the bridge trusted. KelpDAO’s bridge relied on LayerZero, and specifically on a Decentralized Verifier Network, the set of nodes that confirm a message on one chain before assets are released on another. KelpDAO ran that verification as a 1-of-1 configuration: a single verifier, rather than the multi-verifier redundancy LayerZero recommends. A single point of trust is a single point of failure.

The attackers went after that point directly. According to Chainalysis, they obtained the list of RPC nodes the verifier was querying, gained access to two independent internal nodes running on separate clusters, and swapped out the software running them for versions that could selectively forge responses (Chainalysis). Nodes they could not compromise, they knocked offline with a distributed denial-of-service attack, forcing the verifier’s traffic through the poisoned infrastructure. Then they fed it a lie: a synthetic cross-chain message, with no corresponding transaction on the source chain at all, claiming that 116,500 rsETH had been locked and were therefore free to release (OpenZeppelin). The verifier attested to funds that never existed.

The whole drain took about 80 minutes. The stolen rsETH did not sit still: OpenZeppelin found that 89,567 of the tokens were promptly deposited on Aave and used as collateral to borrow $190 million in WETH, leaving a lending market holding claims against tokens the protocol itself no longer backed. That maneuver, turning stolen collateral into borrowed liquidity, is a recurring theme in on-chain credit. KelpDAO’s Security Council intervened on April 20 and blocked a second attempt to lift another 40,000 rsETH, worth roughly $95 million (Chainalysis).

When your monitoring reports exactly what the attacker wants

The KelpDAO attack deserves a second look, because it broke something more fundamental than a single misconfiguration. It defeated the protocol’s ability to know it was under attack.

A bridge like this is supposed to be self-verifying. It watches the source chain, confirms the lock, and only then releases funds on the destination chain. The verifier is both the lock and the alarm. By compromising the exact nodes the verifier queried, the attackers did not just bypass the check; they controlled the answer the check received. Monitoring that watched those same nodes would have seen a clean, successful, entirely normal confirmation. The system reported that everything was fine because the attackers were the ones telling it so.

This is the deepest lesson of 2026’s operational-key compromises. Defenders instinctively trust their own telemetry, their own dashboards, their own confirmations. But if an attacker owns the source of truth, the telemetry becomes a channel for the lie rather than a defense against it. A 1-of-1 verifier is not just fragile because it can fail; it is dangerous because when it is captured it fails silently and confidently. The fix is not more monitoring of the same source. It is independent verification from sources that do not share a single owner, so a captured node is outvoted rather than believed.

Three heists, one pattern

It is worth putting the three defining key-compromise thefts side by side, because the differences in method matter less than the sameness of the pattern. Bybit, in February 2025, remains the largest crypto theft in history at roughly $1.5 billion (CoinDesk); it belongs in the comparison because it was the template the 2026 attacks refined.

The through-line is that in every case a legitimate mechanism, a signer, a signature, a verifier, was made to work perfectly for the wrong party. Bybit’s signers saw a normal transfer and approved a malicious contract upgrade; Bybit later said its own systems were never infiltrated and that the failure lived in Safe’s infrastructure, a dispute the two companies aired publicly (CoinDesk). Drift’s council signed real transactions with fake intent. KelpDAO’s verifier confirmed a lock that never happened. Three different mechanisms, one identical outcome.

The common thread: North Korea’s patience

Attribution in crypto is usually hedged, but the 2026 pattern is unusually consistent. LayerZero publicly attributed the KelpDAO operation to North Korea’s Lazarus Group, and specifically to the sub-group known as TraderTraitor (Chainalysis). TRM Labs tied the Drift theft to North Korean actors as well (TRM Labs). Taken together, crypto.news reported that Lazarus, operating as TraderTraitor, was responsible for at least $575 million across the two incidents alone, roughly 44% of all crypto stolen in 2026, with Mandiant, CrowdStrike, and Elliptic jointly confirming the attribution (crypto.news).

What makes these operations effective is not technical wizardry but patience and human targeting. The KelpDAO intrusion began not with an exploit but with a person: attackers compromised a LayerZero developer’s session credentials, then used that foothold to reach the verification infrastructure (crypto.news). The Drift attack ran weeks of social engineering to get council members comfortable enough to sign. This is the same playbook North Korean operators have industrialized through fake job offers, fraudulent IT-worker hires, and long-con impersonation, aimed squarely at the people with access rather than at the code they protect.

Andrew Fierman, Chainalysis’s head of national security intelligence, has warned that the next phase makes this worse, not better. “AI could assist DPRK hackers by crafting more convincing personas for identity-based infiltration and by automating the laundering process to make it both more complex and rapid,” he told The Block. The uncomfortable implication is that the cheapest, most scalable part of a nine-figure theft is now the part that targets people, and it is getting cheaper.

Blind signing is the bug that lives in all of them

If there is a single technical villain across Bybit, Drift, and much of 2026, it is blind signing: approving a transaction whose real effect you cannot see. Bybit’s signers thought they were moving funds and instead upgraded a wallet’s logic. Drift’s council thought they were approving routine governance and instead pre-authorized a takeover. In both, a human with signing power looked at a screen, saw something benign, and signed something else.

The industry’s most concrete answer arrived in 2026. On May 12 the Ethereum Foundation launched clear signing as a shared standard, ERC-7730, hosted under its Trillion Dollar Security Initiative and built on work Ledger began years earlier (Ethereum Foundation). The goal is what security engineers call what you see is what you sign: instead of a wall of hex, a wallet shows a human-readable description of exactly what a transaction will do, backed by a registry of verified descriptions and tooling that wallets and apps can adopt. The launch had unusually broad support across the wallet industry, including MetaMask, Trezor, Ledger, Fireblocks, and WalletConnect (Ethereum Foundation).

Clear signing would not have stopped every 2026 attack; a manipulated oracle or a poisoned verifier is a different failure. But it directly attacks the mechanism Bybit and Drift shared. When the signer can actually read that a transaction transfers admin control rather than gas, blind pre-signing gets much harder to disguise. It is the difference between signing a document and signing a document you have read.

The controls that would have changed the outcome

None of these thefts required a zero-day. Each would have been blunted by controls that already exist and are, in most cases, boring. The gap in 2026 was not knowledge; it was implementation.

Read the list and a pattern emerges. Almost none of these are cryptography problems. They are operational-security problems, the kind that live in how an organization signs, who it trusts, and how quickly a privileged action can execute. That is precisely the territory a code audit does not cover.

Architecture is a security decision now

The consistent lesson of the year is that how you hold and use a key now matters as much as how well you hide the key itself. A few architectural choices separated the protocols that survived close calls from the ones that made headlines.

The first is eliminating single points of trust. KelpDAO’s 1-of-1 verifier is the cautionary tale, but the principle generalizes: any place where one node, one key, or one signer can unilaterally move value or decide truth is a place the 2026 attackers will find. Multi-verifier bridges, genuine N-of-M multisigs where the signers are truly independent, and distributed validation all raise the cost of an attack from compromising one thing to compromising several at once.

The second is separating the key from the humans and machines that can misuse it. Multiparty computation (MPC) splits a single key into shares that are never assembled in one place, so there is no complete key to steal at rest. Traditional multisig takes a different route, requiring several independent full keys to approve a transaction on-chain. Hardware security modules keep keys inside tamper-resistant hardware that never exports them. In practice, serious operators combine these, MPC or HSMs for execution and multisig for on-chain governance, so no single compromise of a laptop, a server, or a person is enough on its own.

The third is slowing down privileged actions. Timelocks, which delay the execution of sensitive changes, would have given Drift a window to notice that admin control was being transferred before the money left. Speed is convenient. In 2026 it was also the attacker’s friend. None of this is exotic. It is the difference between a system designed so that one bad signature is survivable and one designed so that a single trusted thing, once captured, ends the game.

Who pays when the key fails, not the code

A theft that runs through a legitimate signature raises a legal question the industry has not settled: when the code worked and the key was misused, who is liable?

Bybit and Safe previewed that fight in 2025. After the hack, Bybit said its own systems were never breached and that the failure lived in Safe’s front-end infrastructure; Safe disputed the framing. The two blamed each other publicly (CoinDesk), and no clean answer emerged, because custody rules were written for a world where losing funds meant losing a key you held, not a server a vendor ran.

In the United States, the ground shifted in early 2025 when the SEC rescinded Staff Accounting Bulletin 121 and replaced it with SAB 122 on January 23, removing the balance-sheet treatment that had effectively kept regulated banks out of crypto custody (Ropes and Gray). Banks can custody digital assets again, which pulls more institutional custody under a regulated umbrella. But it does not resolve the harder question that 2026 sharpened: whether an MPC provider, a multisig coordinator, or a bridge verifier counts as a qualified custodian, and who eats the loss when the compromise is of an operational credential rather than a stored key. The pending federal market-structure legislation, which HOGE Wire has tracked as it moved toward a Senate vote, will shape where that liability lands, but the statute is not written for durable nonces and poisoned RPC nodes.

For now the practical answer is that liability is contractual and contested. Protocols publish reimbursement plans case by case; KelpDAO moved to restore rsETH holders after its hack, and a lending market left holding stolen collateral is exactly the kind of counterparty exposure on-chain credit markets are built to price. Users and institutions are left to read the fine print and, more usefully, to avoid the exposure in the first place.

What this means if you hold your own keys

Most readers will never run a bridge verifier or sit on a protocol’s Security Council. But the same logic scales down, and the 2026 thefts carry direct lessons for anyone who holds crypto.

The first is that the seed phrase, while still worth protecting obsessively, is no longer where most sophisticated attacks aim. The aim is your approval. A hardware signer that forces you to confirm transactions on a separate screen is the single highest-leverage upgrade an individual can make, because it moves the decision off the compromised computer and in front of your eyes. It is not a magic shield, but it turns a silent drain into a decision you have to actively make.

The second is to treat blind signing as the enemy. If your wallet shows a wall of hex and asks you to trust it, that is the exact condition that defeated Bybit’s professional signers. Prefer wallets and workflows that describe what a transaction does in plain language, and slow down when an interface pushes you to approve something you cannot read.

The third is that the human layer is the real perimeter. Every marquee 2026 theft began with a person: a developer who ran the wrong file, a council member who trusted the wrong message, a signer who approved the wrong screen. Unsolicited job offers, urgent messages, and too-good collaboration pitches are not annoyances; they are the front door. For anyone managing meaningful sums, splitting signing authority so that no single person, device, or credential can move everything is no longer paranoid. In 2026 it was the only thing that reliably worked.

Frequently Asked Questions

What is a private-key compromise in crypto?

A private-key compromise is when an attacker gains the ability to authorize transactions from a wallet or protocol, either by stealing the key itself or, increasingly, by capturing the signing authority around it, such as admin keys, governance signatures, session credentials, or the servers a system trusts. In 2026 this class of attack overtook smart-contract bugs as the leading way crypto is stolen.

How did the Drift Protocol hack happen without a bug?

Attackers social-engineered Drift’s Security Council into signing transactions using Solana’s durable-nonce feature, which let those signatures stay valid indefinitely. They held the pre-signed, non-expiring instructions until they had also created a fake collateral token and manipulated its price, then executed everything to seize admin control and drain about $285 million. No code was exploited; legitimate signatures were used for the wrong purpose.

What went wrong in the KelpDAO hack?

KelpDAO’s cross-chain bridge relied on a single verifier (a 1-of-1 configuration). Attackers compromised the RPC nodes that verifier queried and used a denial-of-service attack to force traffic through the poisoned nodes, then fed the bridge a fabricated message claiming 116,500 rsETH had been locked when nothing had. The bridge released roughly $292 million against a lock that never existed.

How can I protect myself from private-key theft?

Use a hardware signer and never enter your seed phrase into a website; verify what a transaction actually does before approving it, ideally with a wallet that supports clear signing rather than blind signing; be skeptical of unsolicited job offers, files, and messages, which are the main entry point for targeted attacks; and for larger holdings, split signing authority so no single compromised key or device can move everything.

Who is behind the biggest 2026 crypto hacks?

North Korea’s Lazarus Group, operating as the sub-group TraderTraitor, has been tied to both the Drift and KelpDAO thefts and to at least $575 million of 2026’s losses, according to firms including Chainalysis, TRM Labs, Mandiant, CrowdStrike, and Elliptic. Their method relies on patient social engineering of people with access rather than on breaking code.

Marcus Feld covers security and on-chain forensics for HOGE Wire.