Private-Key Compromise in 2026: Why Stolen Keys Beat Broken Code

The costliest exploits of 2026 never touched the code

For most of crypto’s history, the archetypal hack was a coding problem. An attacker studied a smart contract, found a reentrancy bug or a rounding error, and drained a liquidity pool before the developers could react. That story still happens, but in 2026 it is no longer where the big money goes. The largest thefts now share a different signature: someone obtains the private keys, or persuades a legitimate key holder to approve a transaction they did not understand. The cryptography works perfectly. The signature is valid. The blockchain executes exactly what it was asked to do, and the funds are gone, with no bug to patch and no protocol to blame.

The scale is hard to overstate. Blockchain analytics firm Chainalysis tallied roughly $3.41 billion stolen across the industry in 2025, and found that private-key compromise drove 88% of stolen value in the first quarter of that year alone, according to The Block. CertiK’s Hack3D report for the first half of 2026 counted more than $1.31 billion lost across 344 incidents, with wallet compromise ranking as the single most destructive category, per CertiK. Neither figure is dominated by exotic exploits. Both are dominated by keys.

This is a map of that problem: what private-key compromise really is, the specific ways attackers get hold of keys, why one nation-state has turned the tactic into an assembly line, and what a serious defensive stack looks like today. HOGE Wire has examined the narrower slices of this picture already, from the argument that bridge failures are really key-management failures to the physical threats now stalking large holders. Consider this the umbrella over all of it.

What private-key compromise actually means

A private key is the secret number that authorizes spending from a blockchain address. Whoever holds it controls the funds, without exception: there is no password reset, no fraud department, and no chargeback. Private-key compromise is the umbrella term for any event in which an attacker becomes able to produce a valid signature the owner never intended. That can happen by stealing the raw key, by stealing the seed phrase that derives it, by hijacking a live signing session, or by manipulating a genuine signer into approving something malicious.

That final category is what makes the definition broad, and dangerous. Blind signing, where a hardware device displays an unreadable string of data and the user confirms it anyway, produces the same result as a stolen key: an authorized transaction the owner did not mean to send. A poisoned token approval does the same thing on a delay, granting a malicious contract permission to sweep a wallet weeks later. Analysts at Chainalysis and CertiK group these together because, from the chain’s point of view, they are indistinguishable from a rightful owner moving their own money.

Where a key lives determines how much damage its loss can do. A retail holder with a seed phrase written on a single laptop is one convincing phishing page away from losing everything. An exchange running a multisignature cold wallet spreads that risk across several independent signers. As Bybit discovered, though, splitting the key only helps when every signer can see the truth about what they are approving. Newer designs try to change the equation entirely; smart-contract wallets can add spending limits, session keys, and social recovery, a shift HOGE Wire covered in its look at what account abstraction lets you do.

The numbers behind the shift

The composition of crypto theft has changed as much as its total. Chainalysis reports that attacks on personal wallets, rather than exchanges or protocols, made up about 44% of all stolen value in 2025, up from just 7.3% in 2022; over the year some 158,000 personal-wallet compromises struck more than 80,000 victims and cost individuals around $713 million, again via The Block. Theft is migrating toward ordinary holders for a blunt reason: they guard their keys with the least sophistication and the fewest layers.

At the top of the market the trend runs the other way, toward fewer and far larger breaches. CertiK found that wallet compromise alone produced more than $444 million across just 33 incidents in the first half of 2026, an average above $13 million per event; stripping out the one-off Bybit baseline, comparable losses were up roughly 28% year on year. The incidents in the table below are the reference points for the entire category.

Sources for the table: the Bybit attribution comes from the FBI; Ronin from Halborn‘s post-mortem; Drift and Kelp DAO from CertiK; DMM Bitcoin and WazirX from The Block; and the Coinbase insider breach from BleepingComputer.

Bybit: anatomy of a $1.5 billion blind-signed heist

The Bybit heist of 21 February 2025 is the defining case, and the clearest illustration that key compromise is not the same as a stolen key. Bybit’s Ether reserves sat in a multisignature cold wallet built on Safe{Wallet}. Attackers did not break that wallet’s cryptography. Instead, according to a technical reconstruction by NCC Group, they compromised a Safe{Wallet} developer’s machine and injected malicious JavaScript into the transaction interface, code written to activate only for Bybit’s specific wallet.

The result was a lie told at the exact moment of signing. Bybit’s signers, using hardware wallets, saw what looked like a routine transfer and approved it. What they actually signed was an instruction that handed control of the cold wallet’s logic to the attacker. Roughly 400,000 ETH, about $1.5 billion at the time, drained out in a single sequence, making it the largest theft in the history of the industry. The multisignature setup performed as designed; it simply signed the wrong thing, because the screen in front of each human lied about the payload.

Within days the FBI attributed the operation to the North Korean cluster it tracks as TraderTraitor, part of the group widely known as Lazarus. The bureau asked exchanges and analytics firms to help block laundering as the stolen Ether was converted, dispersed across thousands of addresses, and pushed through mixers.

Bybit’s response became a case study of its own. Chief executive Ben Zhou said early on that 88.87% of the stolen assets remained traceable, though by April 2025 he acknowledged that 27.6% had gone dark. The story took a notable turn on 7 August 2026, when Bybit sued North Korea and the Lazarus Group and secured a preliminary injunction freezing part of the funds. The Lazarus attack, Zhou said, “wasn’t just an attack on Bybit,” but “an attack on trust in our industry,” adding that the exchange had worked closely “with investigators, exchanges, regulators, law enforcement, and now the courts.”

How the keys actually get taken

If Bybit shows what key compromise looks like at the high end, the broader picture is a taxonomy of routes to the same outcome. Keys can be taken in at least seven distinct ways, and most of the year’s damage maps cleanly onto them. The table below sets out the main vectors, a real example of each, and the control that most directly blunts it.

The infrastructure category alone accounted for the two biggest exploits of early 2026: the Kelp DAO RPC compromise and the Drift Protocol breach, each near $290 million and both in April, together nearly 44% of all first-half losses, according to CertiK. The Drift breach, executed through a multi-stage administrative key compromise, stands as the largest exploit ever recorded on Solana. In every one of these cases the signature that moved the money was, technically, valid.

North Korea turned key theft into an assembly line

One actor sits behind an outsized share of these numbers. Chainalysis attributes at least $2.02 billion of 2025’s thefts to North Korean groups, a record that lifts the regime’s cumulative crypto haul above $6.75 billion since 2022, as reported by CoinDesk. That dominance carried into 2026, with trackers including TRM Labs attributing a large share of the first half’s stolen value to the same actors. This is not a fringe threat riding on the industry; for these operators, it is the business.

Andrew Fierman, head of national security intelligence at Chainalysis, frames the appeal bluntly. Cryptocurrency, he said, offers the regime a “unique value proposition” because of its “global 24/7 access.” He has also warned that the laundering has become disturbingly smooth, describing heists now processed “with consistency and fluidity indicative of the use of AI.” His conclusion is that “sanctions alone are far from sufficient,” and that disruption requires coordinated action across exchanges, analytics firms, and law enforcement.

One tactic deserves special attention because it turns an outside attacker into an inside one. Chainalysis and law-enforcement agencies have documented a sustained campaign in which North Korean nationals pose as freelance developers and take real engineering jobs at crypto and web3 companies, often using fake identities and outsourced interview help. Once inside, they draw salaries that fund the regime and, in some cases, position themselves close to the keys, deployment pipelines, and admin credentials that later enable a theft. It is the human supply chain sitting behind the technical one, and it is why serious teams now treat hiring and vendor vetting as a security control rather than an administrative formality.

The strategic point for defenders is that North Korea rarely bothers with smart-contract bugs. It goes after keys and the humans who hold them, through fake job offers, infiltration by remote IT workers, and supply-chain footholds, because that path is cheaper, more reliable, and works across every chain at once. The same logic explains why so many of the largest 2024 and 2025 exchange losses, from DMM Bitcoin to WazirX, trace back to the same cluster. When the goal is stolen keys rather than broken code, the attack surface is people and process, and both scale badly for the defender.

Blind signing and the push for clear signing

If one technical failure runs through the biggest heists, it is blind signing. When a wallet cannot decode what a transaction will do, it shows raw hexadecimal and asks the user to trust it. Attackers live in that gap. Bybit’s signers, WazirX’s approvers on the Liminal interface, and countless phishing victims all confirmed something they could not read. HOGE Wire dissected this dynamic in its account of how the signature became the exploit.

The industry’s structural answer is clear signing, formalized as the ERC-7730 standard. It attaches machine-readable metadata to contracts so wallets can render a plain-language summary, showing that a transaction sends a specific amount to a specific, named destination rather than an opaque blob. Ledger co-developed the standard with an Ethereum Foundation working group and has been transferring its governance to the Foundation for neutrality, with support extending to wallets such as MetaMask, as detailed on the Ledger engineering blog. Ledger, whose chief technology officer Charles Guillemet has championed the effort, describes blind signing as one of the two leading causes of significant user losses in hardware-wallet incidents, a framing echoed in coverage from crypto.news.

Clear signing is not a cure. It depends on contracts publishing metadata, on wallets implementing the standard correctly, and on users still reading the summary. It also does nothing against a signer whose own device or build pipeline is compromised, which is precisely how Bybit fell. Still, closing the readability gap removes the single most exploited weakness in the signing flow, and it is one of the few defenses that scales to millions of retail users at once.

When the exploit is a person: the rise of wrench attacks

The grimmest evolution of key compromise skips computers entirely. In a wrench attack, named for a well-known xkcd comic about beating a password out of someone rather than cracking it, criminals threaten, kidnap, or assault a holder until they surrender their keys. CertiK counted about $124 million in physical-attack losses in the first half of 2026, a record and roughly a twelvefold jump, across more than 50 incidents, as reported by Decrypt.

The pattern is specific. Home invasions rose from a single publicly reported case in the first half of 2025 to twenty a year later, and Europe accounted for about three-quarters of verified incidents, with France alone near two-thirds of the global total, according to Chainalysis. The victims are often people whose crypto wealth became visible: founders, influencers, and holders whose personal details leaked. TRM Labs, which published a response framework for the trend, notes that attackers now target a victim’s entire perimeter, their home, their family, and their composure under duress, in its wrench-attack report.

Data breaches feed the problem directly. A 2020 leak of Ledger customer records, including physical addresses, has been cited as an upstream risk factor in later cases, and in August 2026 TechCrunch reported a fresh wave of personal-data thefts putting hardware-wallet owners at renewed physical risk. The defensive answer is old-fashioned operational security: keep holdings private, consider a decoy or duress wallet with a small balance, and never let the size of a portfolio become public knowledge.

Multisig, MPC, and the myth that more signers means more safety

The instinctive response to key risk is to split the key, and it is only half right. Multisignature wallets require several independent signers to approve a transaction, so stealing one key achieves nothing. Multi-party computation, or MPC, goes further by splitting a single key into shares that are never assembled in one place. Both raise the bar. Neither is a panacea.

The lesson of 2026 is that quorum protects against a stolen key but not against a corrupted view. Bybit’s cold wallet needed multiple signatures, and it got them, because every signer was shown the same falsified transaction. WazirX failed the same way through a custody interface. Adding signers to a process where the display cannot be trusted simply multiplies the number of people who approve the wrong thing. More signers is not automatically safer; the returns depend entirely on whether those signers use independent hardware, verify payloads on separate channels, and can actually read what they sign.

MPC shifts the risk rather than removing it. It eliminates the single seed phrase, which is why regulated custodians favor it, but it concentrates trust in the software that orchestrates the shares and the operators who run it. Whichever model a team chooses, the controls that matter are the ones around the signing moment: policy engines that enforce spending limits and address allowlists, timelocks that delay large transfers, and independent verification of every payload before it is approved.

The defense stack for teams and protocols

A serious operation layers controls so that no single failure becomes a total loss. The table below lists the core defenses, what each one actually stops, and where each one falls short, because the shortfalls are exactly where attackers aim.

No single row on that list is sufficient, which is the entire point. Bybit had hardware wallets and multisig; it lacked clear signing and independent payload verification at the moment that mattered. Defense in depth means assuming any one control will fail and layering the next, so that a single compromise cannot become an unrecoverable loss.

Individuals are now the target: a personal playbook

For individuals, the threat model has inverted. A few years ago the safest assumption was that hacks happened to exchanges; now personal wallets absorb the plurality of stolen value. The defensive basics are unglamorous and effective. Keep the bulk of holdings in a hardware wallet whose seed phrase has never touched an internet-connected device. Treat every signing prompt as hostile until you have read exactly what it does. Assume that any unsolicited message, job offer, airdrop, or support agent is a social-engineering attempt.

A workable personal checklist looks like this:

• Use a hardware wallet for savings, and a separate hot wallet with limited funds for daily activity.
• Verify the full destination address, not just the first and last characters, to defeat address poisoning.
• Revoke stale token approvals regularly, and never grant unlimited spending allowances by default.
• Enable clear signing where your wallet supports it, and refuse to approve transactions you cannot read.
• Keep your crypto holdings private; do not advertise gains, and compartmentalize anything that leaks in a data breach.
• Store your seed phrase offline in more than one physical location, and never type it into a website.

None of this is exotic, and that is the uncomfortable message of the data. The overwhelming majority of losses trace to failures of process and human trust, not to unbreakable cryptography being broken.

Custody, banks, and the SEC’s about-face

The other half of the market, institutions, is being reshaped by both the threat and the regulators. For years, an accounting rule discouraged American banks from holding crypto for customers. The Securities and Exchange Commission’s Staff Accounting Bulletin 121 required custodians to record customer crypto as a balance-sheet liability, which made the business capital-intensive to the point of impracticality. In January 2025 the SEC rescinded it through Staff Accounting Bulletin 122, reopening the door for regulated institutions to act as digital-asset custodians.

That shift matters for key security because it moves more keys into the hands of qualified custodians using MPC and institutional controls, and away from ad hoc self-custody. Whether that reduces risk or merely concentrates it is an open question. A regulated custodian brings audited controls, insurance, and segregation of client assets; it also becomes a larger and more attractive target. The SEC’s move made the choice of who holds the keys a live regulatory and commercial question in the United States, rather than a purely technical one, and it puts fresh weight on how custodians run their signing ceremonies and rotate their keys.

History cuts both ways here. The collapses of FTX and Celsius taught retail holders that handing keys to a third party can mean losing everything if that party is fraudulent or insolvent, the origin of the maxim that if you do not hold the keys, you do not really hold the coins. Yet self-custody transfers the entire burden of key security onto individuals who, as the 2025 personal-wallet numbers show, are frequently the least equipped to carry it. There is no setting that removes key risk; there is only the choice of who bears it, and how competently they carry it.

Following the money: tracing, freezing, and recovery

When keys are compromised and funds move, the chain becomes both the crime scene and the evidence. Public ledgers are permanent, so stolen funds can be followed in real time, which is why Bybit could state that almost 89% of its stolen assets were initially traceable. That transparency is the industry’s structural advantage over cash, and it powers the recovery playbook: freeze what passes through cooperating exchanges, blacklist stablecoins where issuers allow it, and offer bounties for information.

The limits are just as real. Once funds hit mixers, cross-chain routes, and peer-to-peer networks, the trail fragments, which is why a share of the Bybit haul went dark within weeks. The same forensic tools that trace a rug pull, which HOGE Wire examined in its guide to what the chain can and cannot see, apply directly to key theft; the difference is that a compromised key produces a signature that looks entirely legitimate, giving investigators fewer anomalies to flag at the moment of the theft.

Recovery also has a tax dimension that catches victims off guard. In the United States the treatment of stolen or lost crypto is narrow and technical, and getting it wrong can turn a theft into a second, avoidable loss; HOGE Wire walks through the current rules in its guide to what the IRS now sees. The practical takeaway for anyone hit is to document everything, report promptly to exchanges and law enforcement, and preserve the on-chain trail while it is fresh.

The quantum horizon and the keys of the future

Every threat in this article assumes today’s cryptography holds. A longer-horizon risk is that it will not. A sufficiently powerful quantum computer could, in principle, derive a private key from a public key, turning every exposed address into a standing target. That day is not here, and credible estimates place it years out, but the funds that would be at risk are visible on-chain now, which is why the phrase “harvest now, decrypt later” worries cryptographers.

Bitcoin’s developers are already debating defenses, from post-quantum signature schemes to proposals that would freeze vulnerable coins to protect the network, a fight HOGE Wire covered in its report on Taproot’s quantum problem. The relevance to key compromise is direct: a quantum break would be the ultimate key theft, one that needs no phishing, no malware, and no wrench, only enough computing power to reverse the math. Preparing for it is a slow project, but it belongs on the same continuum as clear signing and hardware wallets, all of them attempts to keep the gap between a valid signature and an authorized one as narrow as possible.

Frequently Asked Questions

What is a private-key compromise in crypto?

It is any incident where an attacker gains the ability to produce a valid signature for a wallet the victim controls, whether by stealing the private key or seed phrase, hijacking a signing session, or tricking a legitimate signer into approving a malicious transaction. Because the signature is cryptographically valid, the blockchain treats the theft as an ordinary transfer, and it cannot be reversed.

What was the largest private-key hack ever?

The February 2025 Bybit hack, worth about $1.5 billion in Ether, is the largest crypto theft on record. Attackers compromised a Safe{Wallet} developer machine and manipulated the signing interface so Bybit’s multisignature approvers unknowingly authorized a malicious transaction. The FBI attributed it to North Korea’s TraderTraitor group.

How do hackers steal private keys?

The main routes are supply-chain and build compromises, infrastructure or admin-key theft, social engineering such as fake job offers, insider access, malware that scrapes seed phrases, address poisoning, and physical wrench attacks. Most large 2025 and 2026 losses came from stolen keys and manipulated approvals rather than smart-contract bugs.

How can I protect my crypto from key theft?

Store savings on a hardware wallet whose seed phrase has never touched an online device, enable clear signing and read every transaction before approving, verify full destination addresses, revoke stale token approvals, and keep your holdings private to reduce the risk of targeted or physical attacks.

Does multisig or MPC prevent private-key compromise?

They help but do not eliminate the risk. Multisignature and multi-party computation protect against a single stolen key, yet they failed at both Bybit and WazirX because every signer was shown a falsified transaction. Quorum only works when each signer uses independent hardware and can verify the real payload before signing.

By the HOGE Wire security desk, covering exploits, key management, and on-chain forensics.