Blockchain security keeps failing in the same place: the moment a private key — or the trust placed in whoever controls it — gets exploited. From 2024 through the first half of 2026, hot wallets, cold wallets, admin keys, cross-chain bridges, and DeFi protocols were drained for billions of dollars combined, and in most cases the root cause traces back to how, and where, signing keys were handled.
Anjuna reviewed the major incidents from this period to assess financial impact, attack vector, and whether Trusted Execution Environments (TEEs) and Confidential Computing could have changed the outcome. The pattern that emerges is clear: TEEs are a powerful mitigation for key compromise, but they aren't a substitute for sound smart contract engineering, decentralized verification, or careful transaction review. And the attackers are adapting. 2026 has seen a marked shift away from smart-contract bugs and toward attacks on trust itself: social engineering, compromised infrastructure, and cross-chain message forgery.
The Incidents
Originally compiled July 2025; updated August 2026 with incidents through H1 2026, based on public disclosures and verified sources.
Five Trends Worth Noting
Hot wallets remain the highest-risk surface. Every hot wallet incident above traces back to a compromised key, a breached server, or a manipulated employee. This is exactly the problem TEEs are built to solve: isolating key usage and signing so that even a fully compromised server can't extract the key material.
Cold wallets aren't automatically safe. Bybit and WazirX show that "cold" doesn't mean "immune." Both attacks exploited social engineering and altered multisig logic rather than direct key theft. TEEs help here, but only when paired with application-level validation that verifies what's actually being signed.
Admin keys are a recurring blind spot. zkSync, UPCX, and now Resolv were all drained through admin or minting key misuse such as upgrading a contract, minting tokens, or authorizing collateral without proper validation. TEEs can protect the key itself, but that protection only matters if it's paired with governance controls: multi-sig quorums, time-locked upgrades, on-chain transparency.
Not every hack is a key problem. Cetus DEX and Loopscale were pure smart contract failures. There were pricing bugs and liquidity-math flaws with no wallet component at all. No amount of key isolation fixes a bad contract. These require formal verification, audits, and bug bounties, full stop.
Attackers have shifted from bugs to trust. The biggest 2026 incidents including Kelp DAO, Drift Protocol, and CoW Swap weren't code exploits at all. They were attacks on the infrastructure and human processes around the code: a bridge's single trusted verifier, a multisig's signers, a domain registrar. As protocols harden their smart contracts, attackers (increasingly attributed to North Korea–linked groups such as Lazarus/TraderTraitor) are moving up the stack to targets that are harder to patch with an audit.
What This Means for Teams Securing Key Infrastructure
- Put TEEs in front of all key management, especially hot wallets and admin/minting operations, to isolate keys and enforce secure signing even if the surrounding infrastructure is compromised. Resolv's compromised AWS KMS key is the clearest recent example of what TEE-based key custody is designed to prevent.
- Verify intent, not just signatures. Pair TEE-based signing with tooling that matches what a user sees in the UI to what a contract will actually execute. This is the gap exploited in Bybit's fake signing UI, WazirX's altered contract logic, and CoW Swap's phishing frontend.
- Layer governance on top of key security. Admin actions like upgrades, minting, and zero-timelock migrations should require quorum signatures, time delays, and transparency, regardless of how well the key itself is protected. Drift Protocol shows how a socially engineered multisig can bypass even a well-run governance process.
- Decentralize cross-chain trust. Kelp DAO's single-verifier LayerZero configuration shows why "1-of-1" trust assumptions in bridges are as dangerous as a single private key. Both are single points of failure.
- Don't skip the audit. Confidential computing secures key material; it doesn't validate contract logic. DeFi protocols and bridges still need deep security review.
How Anjuna Helps
Anjuna's confidential computing platform runs key generation, storage, and transaction signing inside hardware-backed TEEs so even if a hot wallet server, exchange backend, or cloud KMS is fully compromised, the signing key itself is never exposed in the clear. That's precisely the gap that let attackers walk away with BtcTurk's hot wallets, Phemex's staff credentials, and Resolv's AWS KMS-held minting key. Pairing that TEE-based custody with governance controls, transaction-intent verification, and rigorous contract audits closes the remaining gaps this dataset keeps exposing.
The Bottom Line
TEEs are one of the most effective tools available for shutting down key-compromise attacks, which remain a leading category of loss in this dataset. But the record through H1 2026 draws an even sharper boundary around what TEEs can't do on their own: they don't fix bad contract code, they don't decentralize a bridge's trust model, and they don't stop a human from approving a malicious transaction or pre-signing an authorization they were tricked into trusting. Chainalysis puts total crypto theft at $3.4 billion for 2025, and industry trackers show H1 2026 has already crossed $1.1 billion across 212 verified incidents — the highest first-half total on record, with North Korea-linked actors tied to more than half of it. Real resilience requires TEE-based key protection combined with governance controls, decentralized verification, UI/transaction verification, and rigorous smart contract auditing.
Ready to close the key-compromise gap in your own infrastructure? Start a free trial of Anjuna Seaglass and see how TEE-based confidential computing protects your keys even when everything around them is compromised.
Sources
- Crypto hacks hit $3.4 billion in 2025, attacks on individual wallets rise — The Block (theblock.co)
- Crypto Hacks Cross $1.1B in Record H1 2026 Losses — CryptoTimes (cryptotimes.io)
- Explained: The Kelp DAO Hack (April 2026) — Halborn (halborn.com)
- North Korean Hackers Attack Drift Protocol in $285 Million Heist — TRM Labs (trmlabs.com)
- $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News (thehackernews.com)
- Resolv Hack Analysis: $23M Loss Traced via Compromised Key — Chainalysis (chainalysis.com)
- How a Compromised Key Minted $80M in Resolv's USR Stablecoin and Triggered a Depeg — Blockaid (blockaid.io)
- CoW Swap Loses $1.2M in Domain Hijacking Attack — Phemex News (phemex.com)
- From Bybit to GMX: The 10 biggest crypto hacks of 2025 — The Block (theblock.co)
Try free for 30 days on AWS, Azure or Google Cloud, and experience the power of intrinsic cloud security.
Start Free