Bitcoin at Center of $1.2 Billion Crypto Hack Wave Spanning 276 Exploits

Crypto News

Blockchain security researchers have documented 276 separate cryptocurrency exploits since the start of 2026, with cumulative losses reaching approximately $1.2 billion. The tally, compiled by incident-tracking firm REKT, underscores a persistent escalation in attack frequency across decentralized finance protocols, custody platforms, and payment infrastructure. A single incident — the compromise of Coldcard hardware wallets — accounted for roughly 10% of the year's total damage within just days of its disclosure, highlighting how concentrated the risk has become around Bitcoin (BTC) self-custody tools. The findings arrive as the broader digital-asset market, spanning Bitcoin and major altcoin ecosystems, navigates heightened institutional participation, making security failures increasingly consequential for retail and corporate holders alike. On-chain data corroborates the scale of illicit outflows, with stolen funds moving through mixing services and cross-chain bridges within minutes of each breach. The annual loss trajectory already threatens to surpass prior cycles if the current pace continues through the remaining months of 2026.

Self-hosted Bitcoin payment processor BTCPay Server issued an urgent advisory after confirming that attackers actively exploited a critical vulnerability to steal user funds. The flaw, patched in version 2.4.2, permitted an unauthenticated remote attacker to extract .macaroon credential files belonging to LND, a widely deployed Lightning Network node implementation. Possession of those credentials grants full operational control over an LND node, enabling direct fund transfers without additional authentication. The project team confirmed through its official announcement that exploitation occurred and user funds were taken, though technical details remain withheld to give operators time to patch. Separately, security analysts verified that 1,719 BTC — valued near $111 million — was exfiltrated from Coldcard users, with total losses projected to exceed $130 million once pending cases are validated. Operators running LND configurations were instructed to update immediately or disconnect their servers, while those using alternative Lightning implementations face no credential risk to their crypto wallet infrastructure.

Three Binance-affiliated entities — Nest Trading, DistributedTechnologies, and Chaintecs Consulting Singapore — filed a $472.8 million lawsuit in Hong Kong against RedotPay's three co-founders, alleging improper commingling of user funds. The dispute centers on a partnership allowing users to top up RedotPay payment cards directly via Binance Pay balances. According to the filing, RedotPay failed to segregate those assets, effectively funneling approximately 470,000 Binance Pay users into the RedotPay card ecosystem. The damages calculation applies a lifetime-value estimate of $925 per diverted user. A parallel proceeding was opened in Singapore by Chaintecs, with a hearing scheduled within the same week. RedotPay, which processes roughly $10 billion in annual payment volume and commands more than 6 million registered users, had been preparing a U.S. initial public offering at a valuation exceeding $4 billion. The company stated it will contest all claims vigorously and that daily operations remain unaffected. The litigation exposes intensifying competition over user ownership in crypto payments, where stablecoin settlement rails are becoming a strategic battleground.

Microsoft Threat Intelligence disclosed a new attack vector in which threat actors abuse smart contracts on BNB Smart Chain to distribute malware instructions to compromised Windows machines. The technique, labeled EtherHiding, embeds malicious payloads within on-chain contract code rather than hosting them on conventional command-and-control servers. Victims encounter fake CAPTCHA screens instructing them to press Windows + R, paste a clipboard-staged command, and execute it — unknowingly running attacker-supplied code. The campaign leverages social-engineering patterns identified as ClickFix and TerminalFix, collectively targeting thousands of corporate and individual devices daily. By routing instructions through a public blockchain's RPC gateway, adversaries gain a resilient distribution layer that complicates takedown efforts. BNB, the native altcoin of the BNB Chain ecosystem, is unaffected at the protocol level; the vulnerability lies in how external applications interact with permissionless smart-contract storage. Microsoft advised enterprise defenders to monitor for anomalous script execution and restrict clipboard-based command pasting in managed environments.

COINOTAG's analysis: these four incidents share a common thread — the attack surface has migrated from protocol-layer exploits to the tooling, custody, and distribution layers surrounding digital assets. On-chain evidence from the Coldcard breach confirms 1,719 BTC moved through identifiable addresses within hours, while BTCPay's official incident report attributes the LND credential leak to a single unpatched code path. The remediation pattern is consistent: patch, rotate credentials, and audit node activity. As institutional capital deepens exposure, security diligence around third-party infrastructure becomes the primary risk-management frontier — not consensus-layer integrity. The Binance–RedotPay dispute further signals that commercial governance is maturing alongside technical security, with litigation replacing informal negotiation as the industry's dispute-resolution mechanism.