Wallet compromise has replaced smart contract exploits as the most damaging attack vector in crypto, accounting for the majority of the $1.32 billion in losses across 224 incidents in the first half of 2026. The shift reflects a fundamental change in how attackers operate: rather than targeting code vulnerabilities, they are now impersonating users and support staff using artificial intelligence-generated deepfakes and voice cloning to bypass identity verification and trick employees into granting access.

Why Are Attackers Shifting Away From Smart Contract Hacks?

For years, the crypto industry focused on auditing smart contracts and securing blockchain code. But the data from the first half of 2026 tells a different story. Attackers have discovered that social engineering amplified by AI is more reliable and scalable than finding zero-day vulnerabilities in code. North Korea accounted for $643 million of the total losses, representing 66 percent of all theft across the period. This concentration suggests organized, well-resourced threat actors are leading the charge toward AI-powered attacks rather than traditional exploit development.

The new playbook is straightforward but effective: generate a deepfake video or voice recording of an executive or customer, use it to bypass Know Your Customer (KYC) verification processes, and trick support teams into transferring funds or revealing private keys. Unlike a smart contract bug that affects thousands of users at once, these attacks are targeted and harder to detect at scale because they exploit human judgment rather than code logic.

What Specific Attack Methods Are Now Most Dangerous?

The shift in attack vectors reflects three converging trends in on-chain security. First, wallet compromise has become the costliest single attack category, surpassing bridge exploits and protocol hacks that dominated headlines in previous years. Second, AI-generated deepfakes and voice synthesis are now reliable enough to fool both automated systems and human reviewers. Third, attackers are targeting the human layer of security, not just the technical layer.

• AI Deepfakes and Voice Cloning: Attackers use generative AI to create convincing video and audio impersonations of executives, customers, or support staff to trick employees into granting unauthorized access or transferring assets.
• KYC Bypass Techniques: Deepfakes are deployed specifically to circumvent identity verification systems, allowing bad actors to create accounts or move funds without proper authentication.
• Support Team Manipulation: Threat actors impersonate customers or internal staff to convince support teams to reset passwords, disable two-factor authentication, or authorize withdrawals.

How Can Wallet Users and Platforms Strengthen Their Defenses?

The rise of wallet compromise as the primary attack vector has forced the industry to rethink on-chain security beyond code audits. Platforms and users now face a dual challenge: securing the technical infrastructure while also protecting against social engineering powered by AI. This requires a multi-layered approach that combines traditional security practices with new defenses designed specifically for the deepfake era.

• Multi-Factor Authentication with Biometric Verification: Move beyond SMS-based two-factor authentication to hardware security keys and biometric verification that cannot be easily spoofed by deepfakes or voice cloning.
• Liveness Detection and Behavioral Analysis: Implement AI-powered liveness detection systems that can identify deepfakes in real time, combined with behavioral analytics that flag unusual account activity or access patterns.
• Support Team Training and Verification Protocols: Train customer support staff to recognize social engineering tactics, implement strict call verification procedures, and require multiple forms of identity confirmation before granting sensitive access.
• Cold Storage and Hardware Wallets: Encourage users to store the majority of assets in hardware wallets or cold storage solutions that are not connected to the internet and cannot be compromised through account takeovers or social engineering.
• Threat Intelligence and Incident Response: Deploy real-time threat monitoring systems that can detect compromised accounts or unusual transactions, combined with rapid incident response protocols to freeze accounts and recover stolen funds.

The data from the first half of 2026 underscores a critical insight for the on-chain security industry: the weakest link is no longer the code, it is the human. As AI tools become more sophisticated and accessible, attackers will continue to exploit social engineering vectors because they are faster, cheaper, and more reliable than finding zero-day vulnerabilities. Platforms that invest in detecting and preventing deepfake-based attacks will have a significant advantage over those that continue to focus exclusively on smart contract audits and code-level security measures.

The $1.32 billion in losses across 224 incidents in H1 2026 represents a wake-up call for the industry. Wallet security is no longer a secondary concern; it is the primary battleground where on-chain security will be won or lost in the coming years.