BlockThreat - Week 18, 2026
$15M stolen across 16 incidents as exploit volume keeps accelerating.
More than $15M was stolen this week across 16 incidents. There are now single days, like April 28, with more incidents than I used to track in an entire week, sometimes more. The same familiar attack vectors were all present: bad signature validation, arbitrary calls, private key compromises, and now mass wallet drains.
My prediction earlier this year that 2026 would be a bloody year for DeFi security has come true and then some.
In this edition, we cover the latest supply chain compromises, critical infrastructure that needs immediate patching, new phishing and malware campaigns, and the usual survey of security research, defensive tools, postmortems, and writeups from the latest barrage of hacks.
BlockThreat is fully supported by readers like you. If this work helps you understand attacks, improve defenses, or stay ahead of emerging threats, please consider supporting it in the Giveth Ethereum Security QF Round.
https://qf.giveth.io/project/blockthreat
Let’s dive into the news!