Crypto security firm Blockaid reports that losses from hacks and other onchain security incidents exceeded $1 billion in the first half of 2026, marking the highest number of security incidents in a six-month period tracked by the platform.

In Blockaid’s H1 2026 security report published Tuesday, Ethereum and Solana led the network-level loss tally, with stolen funds of roughly $332 million and $326 million, respectively.

Key takeaways

• Over $1B lost: Blockaid recorded total crypto losses above $1 billion across H1 2026.
• 212 security incidents: The period included 212 incidents, with more high-threshold exploits verified in H1 2026 than in all of 2025.
• Ethereum dominated by code exploits: The report attributes most Ethereum losses to application and smart-contract vulnerabilities.
• Solana losses driven by key compromises: More than 98% of Solana’s losses stemmed from compromised keys rather than contract bugs.
• Biggest single exploit was KelpDAO: Blockaid identified the largest incident as KelpDAO’s exploit at $292 million.

H1 2026: incident volume climbed, and major exploits shaped outcomes

Blockaid’s report covers 212 security incidents from the first six months of 2026. While the number of incidents rose, the distribution of losses was also shaped by a small set of very large events.

The largest single exploit Blockaid highlighted came from KelpDAO, which it linked to losses of $292 million. Blockaid also reported that it verified 3.4 times as many high-threshold exploits in H1 2026 compared with all of 2025, suggesting a higher frequency of severe, high-impact events rather than only a few outliers.

At the network level, Ethereum and Solana were responsible for nearly all of the most significant stolen-funds figures in the report. Blockaid attributes these differences not only to what applications exist on each chain, but also to how attackers executed their operations.

Why Ethereum losses reflected risk in high-value protocols

According to Blockaid, Ethereum saw the largest losses in H1 2026, driven primarily by incidents that stemmed from code exploits—meaning vulnerabilities in applications, smart contracts, or components interacting with them.

Blockaid said Ethereum’s highest-loss events included key compromises involving Humanity Protocol and StablR. In addition, CoWSwap was identified in the report as the only major Ethereum incident classified as a user mistake, rather than an exploit of protocol code.

Looking beyond individual cases, Blockaid outlined recurring Ethereum attack methods that included weaknesses in bridges and smart contracts, unauthorized access to privileged accounts, and market manipulation techniques. The report frames Ethereum as a persistent target partly because it hosts many of the sector’s highest-value building blocks—restaking platforms, stablecoins, and decentralized exchanges.

For investors and operators, the implication is straightforward: as long as the chain continues to concentrate high-value protocols and liquidity, attackers can profit from both direct smart contract vulnerabilities and operational failures (such as privileged account access) that turn code risk into real-world theft.

Solana’s surge: fewer contract bugs, more key and signer compromises

Solana’s H1 2026 losses came in at roughly $326 million, nearly matching Ethereum. Blockaid describes this as a substantial increase versus about $127 million in stolen funds during 2025.

Notably, Blockaid says the increase was not mainly caused by a rise in smart contract exploits. Instead, the report points to compromised keys as the dominant driver: more than 98% of Solana’s losses in the period were tied to key compromises.

Blockaid connected a large portion of those losses to incidents involving Drift Protocol and Step Finance, which the report linked to North Korea-linked cyber groups.

Blockaid also described a different profile for Solana attackers compared with Ethereum. Where Ethereum’s losses were largely associated with vulnerabilities in protocol code, Solana incidents were centered on signer infrastructure and organizational security controls. In Blockaid’s accounting, only a small portion of Solana losses came from code exploits—citing Raydium and Volo as examples of the remaining code-related cases.

For teams building on or around Solana, this is a clear operational reminder: security reviews can’t stop at smart-contract audits. The report’s emphasis on keys, signing infrastructure, and broader security posture suggests that threat models need to treat custody, signing workflows, and privileged access as first-class attack surfaces.

What to watch next: exploit severity, not just incident counts

As Blockaid’s data shows, H1 2026 combined higher incident volume with a significant jump in verified high-threshold exploits. Readers should watch whether future quarters keep the same balance—especially whether Solana’s key-compromise trend persists and whether Ethereum’s code and privileged-access attack patterns accelerate as new high-value applications launch.

Tokenized asset specialist Ondo Finance ONDO$0.4030 has abandoned plans to build a conventional layer-1 blockchain, instead introducing a trading network it says is better suited for the next wave of onchain financial assets.

Dubbed Ondo Network, the system marks a shift from the company’s February 2025 vision for Ondo Chain, a blockchain for institutional finance and tokenized real-world assets. After building its new perpetual futures platform, Ondo Perps, the firm said it concluded that a traditional blockchain wasn’t the best tool for handling the speed and privacy institutional trading requires.

Ondo Perps is the first application using the network, with plans to offer tokenized assets as collateral for trading.

The pivot comes as tokenization gathers momentum across Wall Street. Tokenization — the process of representing traditional assets such as stocks, bonds and funds as blockchain-based tokens — is gaining traction as firms look to modernize capital markets with faster settlement and around-the-clock trading. At the same time, perpetual futures, once largely confined to crypto markets, are expanding to traditional assets such as stocks and commodities like oil and gold.

Beyond issuing tokenized assets

Ondo has emerged as one of the sector’s largest issuers, with about $2.6 billion in tokenized U.S. Treasury products across OUSG and USDY and roughly $850 million in tokenized equities, according to rwa.xyz. The firm’s broker-dealer obtained last week FINRA approval to launch regulated markets and services for tokenized securities.

Flare launches Flare Smart Accounts v1.3, enabling XRP holders to access DeFi vaults with a single XRPL wallet signature.

Flare today announced the release of Flare Smart Accounts (FSA) v1.3, making it possible for XRP holders to mint FXRP and deposit it into yield-generating vaults with a single XRPL signature.

For XRP holders, accessing DeFi has often meant creating new wallets, bridging assets between chains, and managing gas tokens before earning a single dollar in yield. Flare Smart Accounts v1.3 removes much of that complexity. Users can now choose a vault, sign once using the XRPL wallet they already use, and Flare completes the rest automatically. No separate EVM wallet, gas token, or manual bridging is required.

The update builds on growing momentum for XRPFi. Since February 2026, the amount of FXRP deployed in DeFi has grown by nearly 75%, increasing from 82 million to 144 million FXRP. More than 40 million XRP is currently earning yield through Flare Smart Accounts, while nearly 24,000 Smart Accounts have already been created.

“Millions of XRP holders have wanted access to DeFi, but the experience has been too complex,” said Filip Koprivec, CPO at Flare network. “With Smart Accounts v1.3, users can go from XRP to yield with a single signature while remaining fully non-custodial.”

The update reduces what previously required two separate XRPL signatures to a single transaction. The user’s XRP remains secured on XRPL through FXRP’s 1:1 collateral model while Flare mints FXRP and deposits it into the selected yield strategy. Behind the scenes, the Flare Data Connector (FDC) verifies the XRPL transaction on Flare, allowing a smart contract linked to the user’s XRPL address to carry out the requested actions automatically.

The release also expands the range of yield strategies available through Flare Smart Accounts with the addition of the Clearstar Flare XRP Yield Vault. Users can now choose between two actively managed FXRP vaults with different approaches to generating yield.

The Monarq XRP Yield Vault, operated by Monarq, majority-owned by FalconX, combines options, basis trading, funding-rate capture, and on-chain DeFi strategies, dynamically adjusting allocations as market conditions change. The newly added Clearstar Flare XRP Yield Vault takes a fully on-chain approach, deploying FXRP across lending and liquidity protocols on Flare, including Avant and Euler. Every position is publicly verifiable on-chain, and the strategy has previously managed more than 33 million FXRP in deposits.

Flare is also expanding access by adding support for Ledger, Xaman, Joey Wallet, and WalletConnect, including Bifrost. These integrations join the existing D’CENT support, allowing more XRP holders to access Flare’s yield infrastructure through the wallets they already use.

As part of the release, Joey Wallet, a self-custodial XRPL wallet with under-3-second onboarding and social login support via Web3Auth, now embeds Flare Smart Accounts directly as an in-wallet dApp. Users can mint FXRP and deposit into yield vaults without leaving the wallet.

“There’s a lot of overlap between the XRPL and Flare communities, so integrating Flare Smart Accounts just made sense,” said Christopher Troia, Co-Founder of Joey Wallet. “It brings a breath of fresh air for XRP holders, letting them start putting their XRP to work in a seamless way.”

Users can get started at fsa.flare.network/vaults or through supported wallets, including Joey Wallet, Xaman, and D’CENT.

Blockchain security company AmericanFortress has unveiled a cryptographic scheme that it says could protect existing cryptocurrency wallets from future quantum attacks without requiring users to move funds, rotate keys or change wallet addresses.

Unlike most proposed post-quantum approaches, AmericanFortress said its scheme allows existing wallet addresses to remain unchanged while adding post-quantum protection.

The company published the proposal in a technical paper on the Cryptography ePrint Archive, describing the scheme as compatible with seed-based hierarchical deterministic wallets used across Bitcoin (BTC), Ethereum (ETH), Solana (SOL) and other blockchain networks that rely on elliptic curve cryptography. The paper has not yet been peer-reviewed.

According to the paper, the scheme uses zero-knowledge proofs derived from a wallet’s original seed phrase instead of replacing the elliptic curve cryptography underlying existing wallets. AmericanFortress said participating nodes would verify those proofs while users continue signing transactions with their existing keys.

AmericanFortress also cited a recent Bloomberg analysis estimating that up to $470 billion in Bitcoin could be vulnerable to quantum attacks if sufficiently powerful quantum computers become available.

Related: Hong Kong prepares banks for quantum threats amid tokenization push

Companies pursue different paths to post-quantum wallet security

AmericanFortress is not the only company developing post-quantum protections for cryptocurrency wallets. On Tuesday, Freedom Factory unveiled PQ1, which it describes as a post-quantum hardware wallet designed for Ethereum and other Ethereum Virtual Machine (EVM)-compatible networks.

Unlike AmericanFortress’ software-based approach, PQ1 uses post-quantum cryptographic signatures generated on dedicated hardware. According to Freedom Factory, the wallet uses SPHINCS+C10 signatures and ERC-4337 smart accounts to secure transactions against future quantum attacks.

Developers have increasingly focused on post-quantum cryptography because sufficiently powerful quantum computers could eventually break the elliptic-curve cryptography used to secure Bitcoin, Ethereum and many other blockchain networks. Although such computers are not yet available, several blockchain projects have already begun researching migration strategies.

In recent months, a Strategy-led consortium pledged $15 million to fund Bitcoin quantum security research, the Ethereum Foundation published a proposal for migrating accounts to quantum-resistant cryptography, and Algorand outlined plans to introduce quantum-resistant accounts by 2027.

Ethereum’s post-quantum roadmap. Source: Ethereum Foundation

Magazine: A quantum roadmap would push Bitcoin much higher: Charles Edwards

OpenAI and Anthropic are working together in Washington to shape a federal review system for advanced AI models, despite competing for customers, funding, and technological leadership.

OpenAI and Anthropic seek common review standards

OpenAI and Anthropic are urging the Trump administration to adopt a consistent review process for AI models with advanced cybersecurity or national security capabilities, according to The Information.

Their cooperation comes before an Aug. 1 deadline for federal agencies to define which systems should qualify as “covered frontier models.” Those models could be provided to the government for evaluation for up to 30 days before release to other trusted partners.

Both companies reportedly want the standards applied across the AI industry rather than limited to developers already cooperating with Washington. That could bring competing companies, including Meta and Elon Musk’s xAI, under the same review framework if their models cross the eventual capability threshold.

The discussions mark a rare policy alignment between OpenAI and Anthropic. Both companies sell general-purpose AI systems and compete for enterprise contracts, researchers, computing capacity, and investment.

Neither company has publicly released the full terms it wants included in the final framework.

Trump order sets voluntary 30-day process

President Donald Trump ordered federal agencies to establish a classified benchmarking process through Executive Order 14409 on June 2.

The order directs the National Security Agency, Cybersecurity and Infrastructure Security Agency, Treasury Department, and other federal bodies to determine when an AI model has capabilities strong enough to warrant additional review.

Developers participating in the framework would be able to ask the government whether a model meets the covered frontier model threshold. They could then provide federal evaluators with access for up to 30 days before making the system available to other approved partners.

The order requires safeguards for intellectual property, confidential information, cybersecurity, and insider threats during the evaluation.

However, it expressly states that the process cannot create mandatory federal licensing, preclearance, or permitting rules for developing or releasing AI models. Companies would therefore participate voluntarily unless separate laws or government powers apply.

US AI developers seek clarity before launches

A shared framework could give US developers clearer standards for deciding when government testing is expected. Questions remain over which technical benchmarks will trigger a review, which agencies will test each system, and how officials will approve early-access partners.

Those uncertainties have already affected recent launches. OpenAI and Anthropic provided government officials with early access to advanced models before wider distribution, but outside researchers had limited visibility into the evaluations.

A July report found that the agencies, tests, and approval requirements involved in those reviews remained unclear. The lack of a published process could make release planning harder for developers and leave smaller AI companies unsure whether the same standards apply to them.

Applying one capability-based threshold to OpenAI, Anthropic, Meta, xAI, and other developers could reduce some of that uncertainty. It could also limit concerns that Washington is giving selected companies different treatment.

Open-weight AI debate divides the industry

OpenAI and Anthropic’s call for a common review process comes as other technology companies are warning Washington against placing broad controls on open-weight AI models.

As crypto.news reported last week, Nvidia, Meta, and Microsoft joined 22 other organizations in an open letter arguing that sweeping restrictions could weaken US leadership as competition with China intensifies. IBM, Palantir, Mistral, Hugging Face, Mozilla, Andreessen Horowitz, and the Linux Foundation also signed the letter.

The group called for targeted legal and commercial measures against misuse instead of restrictions covering technologies with legitimate research and business applications.

Open-weight models allow companies, researchers, and governments to download software, modify it, and run it on their own infrastructure. Supporters say this gives users greater control over their data, security, and computing systems while lowering deployment costs.

The signatories did not frame open and closed models as mutually exclusive. Instead, they argued that both approaches are needed to support competition and give developers different ways to build and deploy AI systems.

Nvidia CEO Jensen Huang shared the letter in his first post on X and defended the role of both development models.

“The world needs both frontier closed models and frontier open models.”

Elon Musk also supported the letter in a reply to Huang, although his AI company, xAI, was not listed among the 25 reported signatories.

The two efforts address different parts of the policy debate. OpenAI and Anthropic are seeking consistent federal evaluations for models that cross a national security capability threshold, while the open letter argues against restrictions based mainly on whether a model makes its weights available.

Federal agencies now have until Aug. 1 to define the frontier-model threshold and outline the voluntary review process. The final framework will show whether Washington focuses on measurable capabilities or applies broader conditions based on how AI models are distributed.

Elon Musk has set an early August target for Grok 4.6 and disclosed plans for a larger Grok 4.7 model as SpaceXAI steps up its competition with OpenAI, Anthropic, and China’s Moonshot AI.

Grok 4.6 targets an Aug. 7 release

Musk disclosed the timeline in a July 28 post on X, saying Grok 4.6 would be released “around August 7.” He described it as a 1.5 trillion-parameter model with stronger supervised fine-tuning and reinforcement learning.

Supervised fine-tuning trains a model on selected examples to improve the quality of its responses. Reinforcement learning uses feedback and reward signals to refine how a model handles tasks and follows instructions.

Musk also said Grok 4.7 would follow “a few weeks later” as a 2.1 trillion-parameter model. However, he did not provide an exact launch date or disclose pricing and availability details for either release.

“This will be better than 4.6 in every way, except slightly slower to serve, albeit with even better token efficiency,” Musk said about Grok 4.7.

Both dates remain targets rather than confirmed release appointments. Model development schedules can change during training, testing, and deployment.

Grok 4.5 sets the baseline for the upgrades

SpaceXAI introduced Grok 4.5 earlier in July as a model designed for coding, agent-based tasks, and knowledge work. The company currently charges $2 per million input tokens and $6 per million output tokens.

Musk announced the next two models in response to an assessment from Vercel CEO Guillermo Rauch, who described Grok 4.5 as the best-performing cybersecurity model relative to its price in Vercel’s latest tests.

According to Rauch’s post, Grok 4.5 was 10 times cheaper than OpenAI’s GPT-5.6 Sol, 5.7 times cheaper than Anthropic’s Opus 5, and 2.2 times cheaper than Moonshot’s Kimi K3 while delivering performance close to Kimi.

Rauch still ranked Sol as the leading frontier model, ahead of Opus 5. His findings reflect Vercel’s testing methods and do not establish a universal ranking across every AI workload.

SpaceXAI has not said whether Grok 4.6 and Grok 4.7 will retain Grok 4.5’s pricing. Service speed, token use, and API costs will determine whether the newer models maintain the same price-performance advantage.

US AI firms face pressure from China’s Kimi K3

Grok’s planned upgrades arrive as Chinese developers narrow the gap with leading US AI companies. Moonshot AI released the full weights for Kimi K3 on July 27, allowing developers to download, modify, and operate the model on their own infrastructure.

Kimi K3 has 2.8 trillion parameters, native visual capabilities, and a one-million-token context window. Its scale and open-weight structure have added pressure on US companies that mainly distribute their most advanced models through closed platforms and paid APIs.

SpaceXAI, OpenAI, and Anthropic are also competing on coding, cybersecurity, reasoning, and the cost required to complete each task. Grok 4.7’s larger architecture may improve its capabilities, but Musk acknowledged that it would be slower to serve than Grok 4.6.

Parameter counts alone do not determine model quality. Training data, architecture, post-training methods, inference systems, and token efficiency can all affect performance.

US AI firms split over federal oversight

OpenAI and Anthropic have already agreed to provide US officials with early access to unreleased frontier models for safety testing. Those agreements formed the basis for a broader voluntary federal review framework that now covers other major developers, including SpaceXAI, Google DeepMind, and Microsoft.

President Donald Trump formalized the framework through a June executive order. Participating companies can provide covered models to the federal government for up to 30 days before releasing them to trusted partners. The order states that the reviews do not create a mandatory licensing or preclearance system.

However, the industry remains divided over how Washington should handle open-weight models. Nvidia, Microsoft, Meta, OpenAI, Palantir, and other organizations warned US policymakers against broad restrictions in a July 24 open letter. They argued that open models support competition, lower deployment costs, and allow developers to run and modify AI systems on their own infrastructure.

The debate has intensified following Moonshot AI’s release of the 2.8 trillion-parameter Kimi K3. Trump administration officials have accused Moonshot of using outputs from Anthropic’s Fable model to train Kimi K3 through large-scale distillation. White House technology adviser Michael Kratsios described the alleged practice as an attempt to obtain proprietary US technology, while Treasury Secretary Scott Bessent said the administration was considering sanctions and placing Moonshot on a trade blacklist.

Moonshot has not publicly accepted those allegations. The dispute has nevertheless placed Kimi K3 at the center of a wider policy fight over whether Washington should target specific security and intellectual-property risks or restrict access to Chinese open-weight models more broadly. Grok 4.6 and Grok 4.7 will enter that market as US developers face pressure to improve performance while meeting emerging federal safety expectations.

AmericanFortress has proposed a post-quantum cryptography scheme aimed at protecting cryptocurrency wallets from future quantum attacks—without forcing users to move funds, rotate keys, or change wallet addresses. The company’s approach centers on cryptographic proofs tied to a wallet’s original seed phrase, according to a technical paper published on the Cryptography ePrint Archive.

The proposal comes at a time when the industry is actively planning for a potential “migration” away from today’s elliptic-curve cryptography. While quantum computers capable of breaking these schemes are not available today, analysts have warned that the long lead time for upgrades makes preparation urgent. Earlier coverage cited a Bloomberg analysis suggesting as much as $470 billion in Bitcoin could become vulnerable under sufficiently capable quantum machines.

Key takeaways

• AmericanFortress says its post-quantum wallet protection keeps existing wallet addresses unchanged and avoids user-side migration steps.
• The scheme relies on zero-knowledge proofs derived from a wallet’s seed phrase, with verifying nodes validating those proofs while users sign transactions using existing keys.
• The technical details were published on Cryptography ePrint, but the paper has not yet undergone peer review.
• Freedom Factory’s separate PQ1 product takes a different path: post-quantum signatures generated on dedicated hardware for Ethereum and other EVM networks.
• Across the sector, multiple teams are now outlining migration or hardening strategies for post-quantum security—despite no current availability of relevant quantum-breaking hardware.

A post-quantum upgrade that doesn’t require changing addresses

In its ePrint paper, AmericanFortress describes a cryptographic method intended to safeguard wallets that are based on seed phrases and hierarchical deterministic (HD) key structures—widely used across networks including Bitcoin, Ethereum, Solana, and others that rely on elliptic-curve cryptography.

The company’s framing is notable because many post-quantum proposals involve changing the cryptographic scheme end-to-end, which can imply key rotation, new address generation, or even asset movement to a new system. AmericanFortress instead claims its approach can preserve the user’s existing wallet identity while adding a layer of quantum resistance.

According to the paper, the mechanism uses zero-knowledge proofs derived from the wallet’s seed phrase rather than replacing the elliptic-curve cryptography already embedded in current wallets. Under the described design, participating nodes would verify the generated proofs. Meanwhile, users would continue to sign transactions using their existing keys, with wallet addresses remaining the same.

The company also positions the idea as compatible with the broader seed-based ecosystem, suggesting it could be integrated without asking users to reorganize their custody setup—an important consideration for retail holders, institutional custody providers, and infrastructure teams that manage address derivation at scale.

The proposal was published at eprint.iacr.org and remains unreviewed at the time of publication.

Why quantum-readiness is becoming a roadmap, not a proposal

Quantum-resistant wallet security has moved beyond academic interest in recent months because the timeline for cryptographic transition is often longer than the timeline to react to a real-world threat. Even without today’s quantum computers capable of breaking elliptic curves, the industry is working on how to migrate without destabilizing networks or invalidating existing assets.

AmericanFortress’s paper cites Bloomberg’s analysis estimating potential quantum exposure for Bitcoin—figures that highlight why preparation is drawing attention from investors and builders, not just cryptographers. Even if those estimates turn out to be too high or depend on assumptions that don’t materialize, the core lesson remains: large cryptographic ecosystems may need time to adapt.

This is also why the industry’s posture has increasingly shifted toward “future-proofing” roadmaps—plans that aim to keep networks usable and wallets secure even as underlying cryptographic primitives evolve.

Freedom Factory’s PQ1 highlights how varied the solutions are

AmericanFortress is not the only team exploring post-quantum protections. On Tuesday, Freedom Factory unveiled PQ1, which it describes as a post-quantum hardware wallet for Ethereum and other EVM-compatible networks.

Freedom Factory’s approach differs from AmericanFortress’s software-centric proposal. PQ1 is designed to generate post-quantum cryptographic signatures on dedicated hardware rather than relying on wallet-level proofs layered over existing signing keys. The company said PQ1 uses SPHINCS+C10 signatures and secures transactions through ERC-4337 smart accounts, aiming to provide protection against future quantum attacks.

For users and custody providers, these two approaches illustrate a key tension in post-quantum planning: do you prioritize backward compatibility and minimal disruption, or do you adopt a more direct cryptographic replacement—potentially requiring new wallet management workflows?

Both strategies have trade-offs. Hardware-based signing can offer stronger operational separation and clearer cryptographic boundaries, but it may require new devices or account setups. Proof-based compatibility could reduce disruption for existing wallets, but it depends on how verification is implemented across the network and whether the approach scales cleanly in practice.

Broader post-quantum efforts: research funding and migration planning

Beyond individual companies, multiple blockchain ecosystems have begun putting post-quantum security into concrete terms.

In recent months, a Strategy-led consortium pledged $15 million to fund Bitcoin quantum security research. At the same time, the Ethereum Foundation published a proposal outlining a path for migrating accounts to quantum-resistant cryptography, hosted on its quantum resistance roadmap. Separate reporting also notes that Algorand has outlined plans to introduce quantum-resistant accounts by 2027.

Taken together, these initiatives underscore a common industry reality: network-level cryptographic upgrades are complex, and different ecosystems are choosing different methods—ranging from dedicated migration proposals to cryptographic research funding and account-level changes.

AmericanFortress’s claim of keeping wallet addresses stable adds another dimension to that landscape. If the method works as intended and can be validated by nodes efficiently, it could reduce one of the biggest friction points in post-quantum adoption: forcing users to re-derive keys and manage new address formats.

What to watch next

For now, AmericanFortress’s scheme is a published technical proposal rather than a deployed standard, and the paper has not been peer-reviewed. Readers should watch for follow-up work: peer review outcomes, details on node verification requirements, and any broader ecosystem response—especially from teams actively drafting migration strategies for post-quantum wallet security.