
A whale lost $26M in a private key hack, adding to $24M lost in a 2024 phishing attack. Private key misuse drove 75% of $1.1B stolen in H1 2026.
A crypto whale known as TLBL lost more than $26 million in assets across three wallets on Aug. 13 after a private key compromise, according to blockchain analytics platform Lookonchain.
The same trader lost $24 million in stETH and rETH to a phishing attack in 2024, Lookonchain said. Together, the two hacks drained roughly $50.3 million from the same address cluster.
Security firm PeckShield identified the stolen tokens as roughly $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC and $2.6 million in ETH, with smaller amounts in other assets. The attacker converted part of the haul into 20 million DAI and about 3,000 ETH, worth $5.64 million at current prices, and spread the funds across four separate addresses, PeckShield said.
The TLBL case follows a broader surge in crypto theft this year. Hackers stole $1.1 billion across 212 attacks in the first half of 2026 alone, according to an Aug. 1 report from Blockaid. Private key misuse accounted for roughly $790 million of that – nearly 75 percent of all stolen value. Monthly incidents climbed from 18 in January to 57 in June.
Security data from Nominis pegged cumulative losses at roughly $1.65 billion through July 2026. April was the heaviest month, driven by hacks at Kelp DAO and Drift Protocol that together lost roughly $578 million. July ranked second at $242 million, with $116 million of that coming from a firmware vulnerability in Coldcard hardware wallets made by Coinkite.
Lookonchain also flagged a separate case this week of address poisoning, where a victim lost $100,000 by copying a fake address from past transaction history without verifying it. Both attack vectors – private key theft and address spoofing – share a target: the wallet interface itself, which remains the most exploited point in the custody chain.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.