2026 is crime season.

>> protocol hacks:
> kelp dao: ~$292m drained through its layerzero bridge on april 18. biggest exploit of the year.
> drift protocol: $285m gone on april 1. they social-engineered the multisig signers, not the smart contract. north korea's fingerprints all over it.
> one guy, $284m: a single investor phished on jan 16 through his hardware wallet.
> step finance ($28.9m), truebit ($26.4m), swapnet ($13.3m) in january. yieldblox ($10m), iotex bridge ($8.8m), crosscurve ($4.95m), moonwell ($1.8m) in february.
>> wrench attacks
> france is the kidnapping capital now: 88 people charged, 10+ of them minors, ~41 attacks this year. that's one every 2.5 days.
> a magistrate and her mother abducted in february. ransom demanded from the judge's crypto-exec partner.
> mother and son grabbed in burgundy on april 13. $400k ransom. freed after 20 hours.
> savannah guthrie's 84-year-old mom kidnapped in arizona over a $6m bitcoin ransom.
> "the godfather" pleaded guilty june 2 for trying to kidnap the parents of a kid who'd helped steal 4,100 btc (~$245m).
> 3 tennessee guys ran a robbery tour across california. forced a victim at gunpoint to sign in and move $6.5m.
>> rug pulls
> catfi pumped 1,001x in 26 hours, then vanished. south korea filed its first-ever dex fraud case over it.
> eric adams, the ex-mayor of nyc, launched a token. down 82% in january.
> rkc, a roaring kitty-themed coin: dev wallets held 39.5% of supply and cashed out $600k as the hype peaked. down 67% on may 12.
> "120 hours": a pumpfun dev claimed he was dying, "i have 120 hours to live", then drained the $534k pool and disappeared.
> $world: launched on pumpfun may 27. minutes later the creator dumped 220m tokens for 26.5 sol in one transaction. that's the whole life cycle now.
> quant: a 13-year-old spun up a solana token, rugged it, and walked away with $30k.
>> ponzis & fake exchanges
> goliath ventures: $328m ponzi, ceo arrested. the pitch was 3-8% "guaranteed" monthly. it never is.
> dsj exchange / bg wealth: $150m gone in may. then the same crew rebranded to "swift wave" and "hqi" and kept going.
>> pig butchering
> chen zhi, boss of cambodia's prince group, arrested and extradited. seizure: 127,271 bitcoin. ~$15 billion.
> china executed 11 people tied to the myanmar scam compounds on jan 29.
> the doj's "scam center strike force" hit southeast asia april 23. operation level up froze $701m and made 276 arrests.
>> north korea
> the ethereum foundation found ~100 north korean operatives planted inside web3 companies and warned 53 projects.
> the method: fake recruiters on linkedin and github send a "coding challenge" that installs malware. the job interview was the attack.