Topic starter
14/07/2026 5:23 pm
TL;DR: North Korean hackers stole $577 million from DeFi protocols in early 2026, with Drift Protocol and KelpDAO among the principal targets, and the attacks accounted for 76% of global crypto hack losses in that period, according to FYEO. The pattern shows that smart contract logic, supply chain exposure, and compromised identities now combine into a governance problem, not just a code problem.
Editorial analysis by NHI Mgmt Group, based on content published by FYEO: “Hybrid AI + Human-Led Web3 Security Audits”.
By the numbers:
- North Korean hackers stole $577 million from Web3 protocols in early 2026.
- Those incidents represented 76% of all global cryptocurrency hack losses during that period.
Key questions
Q: What breaks in DeFi when contract control and identity governance are not separated?
A: The protocol becomes vulnerable to the same failure pattern as a centralised system: whoever reaches the privileged path can redirect assets, change logic, or approve releases.
Q: Why do smart contract audits fail to prevent many Web3 exploits?
A: Audits reduce risk, but they do not eliminate runtime threats because attackers often exploit operational behaviour, timing, or multi-step sequences that emerge after deployment.
Q: What are the signs that a DeFi protocol's trust boundary is too broad?
A: Warning signs include permanent admin privileges, many people able to sign or deploy, weak segregation between development and release systems, dependency sprawl, and limited visibility into bridge or treasury movements.
Practitioner guidance
- Audit privileged contract paths Review admin-only functions, upgrade hooks, and emergency controls in the contracts that move value or change protocol behaviour.
- Harden the software supply chain Verify build provenance for smart contracts, external packages, and deployment tooling so malicious dependencies cannot alter production code or release artefacts.
- Treat signing keys as high-risk identities Map who can sign transactions, deploy contracts, or approve changes, then enforce separation of duties, rotation, and rapid revocation for those credentials.
Bottom line: The article shows that major DeFi thefts are driven by a blend of code weakness, supply chain exposure, and identity compromise rather than a single technical flaw.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:27 pm
DeFi security is now an identity and governance problem as much as a code problem. Smart contract audits matter, but this article shows that attacker success also depends on who can sign, deploy, upgrade, or influence protocol operations. When privileged access is concentrated in a few hands, the protocol inherits the same trust fragility seen in traditional infrastructure. Practitioners should treat DeFi control planes as governed identity surfaces, not just codebases.
A question worth separating out:
Q: What should Web3 teams do immediately after a protocol compromise?
A: Contain the affected signing paths, freeze or narrow privileged functions where possible, and identify whether the compromise reached keys, deployment systems, or external dependencies. Then review transaction history for fund movement, because fast laundering can erase recovery options quickly. Immediate response should focus on stopping further authorised-looking activity before the attacker completes asset extraction.
👉 Read our full editorial: North Korean DeFi theft shows Web3 security gaps at scale