Crypto Whale Loses $26M in Second Theft, Private Key Likely Hit

Separately, Lookonchain flagged a smaller case this week involving address poisoning. A victim copied a wallet address straight from their transaction history without checking it and sent funds to a lookalike address, losing $100,000. That method differs from the private-key compromise that hit TLBL, Lookonchain said.

The question for large holders is how much stronger security practices help when a wallet has already been targeted once. TLBL moved funds after the first theft, presumably to fresh addresses, the second loss suggests the attacker either retained access to a related key or found a new vector through the same infrastructure. No wallet service, exchange, or custody provider has been publicly tied to either theft.

The Blockaid data show that private-key and seed-phrase compromises are not isolated to whales. The first half of 2026 saw an average of 35 incidents per month, up from 18 in January. The incident count nearly doubled by June, driven partly by targeted attacks on DeFi protocols and individual wallets. The TLBL case fits a pattern where attackers wait months or years after an initial compromise to strike again, often after the victim assumes the danger has passed.

For the broader sector, each high-profile wallet theft feeds two trends. It pushes more institutional holders toward qualified custodians with insurance and hardware-backed key management. And it drives demand for on-chain security tools that monitor wallet activity for suspicious patterns before funds move. The TLBL case is the second time a single whale has lost more than $20 million. It reinforces that self-custody, even with cold storage, carries risk when private keys are generated or stored on a device that has been connected to the internet.

PeckShield said the attacker had already begun moving the stolen assets through multiple addresses, a common obfuscation step. The firm did not name any exchange or mixer that received the funds. Lookonchain said it would continue tracking the addresses linked to the theft.