Notifications
Clear all
Topic starter
18/08/2026 2:11 pm
TL;DR: June 2026 crypto losses totalled $75.32M across 32 incidents, with key and credential compromise driving about $34.40M and a targeted social-engineering attack on Humanity Protocol accounting for roughly $32M, according to Quantstamp. The month reinforces that identity and key governance, not just contract security, now shape loss severity.
NHIMG editorial — based on content published by Quantstamp: June Security Beat: Keys Over Code
By the numbers:
- $75.32M was lost across 32 crypto incidents in June, up from May's $59.52M.
- Key / Credential Compromise accounted for about $34.40M of June losses across 2 incidents.
- A targeted social-engineering attack against Humanity Protocol drained $32M, roughly 42% of every dollar lost in June.
Questions worth separating out
Q: What breaks when signing keys or privileged operator accounts are compromised?
A: When signing keys or privileged operator accounts are compromised, the attacker can act as a legitimate controller rather than an obvious intruder.
Q: Why do keys and credentials create such large losses in crypto incidents?
A: Keys and credentials often confer direct authority over assets, so a single compromise can scale into immediate value transfer.
Q: How can security teams reduce risk from supply-chain identities and build tokens?
A: Security teams should inventory every build, package, and release identity that can mint tokens, sign artifacts, or push code.
Practitioner guidance
- Classify signing keys as tier-0 assets Assign the same protection model to protocol signing keys, bridge relays, and mint authorities that you would use for domain or cloud root access.
- Split operator duties from key custody Separate routine administrative workflows, contract upgrade authority, and asset custody so a single phishing event cannot reach all three.
- Govern CI/CD identities like privileged accounts Inventory which build and release systems can request OIDC tokens, publish packages, or sign provenance attestations.
What's in the full report
Quantstamp's full report covers the operational detail this post intentionally leaves for the source:
- Incident-by-incident loss breakdowns across the 32 June events, including the categories that consumed the most value.
- Independent investigation notes on the Humanity Protocol case, including the malware indicators and phishing tradecraft.
- Source-backed commentary on the npm supply chain wave and the PeopleSoft zero-day timeline.
- The month-over-month comparison data that shows how June differed from May in both loss size and attack mix.
👉 Read Quantstamp's June security beat on keys, credentials, and June crypto losses →
Keys over code in June 2026: what practitioners need to act on?
Explore further
18/08/2026 3:04 pm
Key compromise is now the dominant loss mechanism in crypto-adjacent systems. The article shows that the largest damage came from reaching the keys behind trusted operations, not from exotic protocol logic. That is a governance failure, because the control assumption was that technical security would protect value even when operator identities were compromised. In practice, the identity that can sign or upgrade is the real blast-radius boundary, so practitioners should govern signing authority as critical infrastructure.
A question worth separating out:
Q: Who is accountable when phishing leads to account compromise?
A: Accountability is shared, but security leadership owns the control environment that made impersonation succeed. Email authentication, browser trust configuration, access scoping, and incident reporting are governance responsibilities, not just end-user habits. If phishing can repeatedly turn into compromise, the control model is failing at the organisational level.
👉 Read our full editorial: June crypto losses show keys, not code, drove the biggest damage
