Crypto whale loses $25.6 million in wallet drain attack

An unknown cryptocurrency whale lost $25.6 million in a wallet drain attack on August 13, 2026, with the stolen assets including aWBTC, DAI, WBTC, and ETH. The attacker subsequently converted the assets into 20 million DAI and 3,000 ETH, distributing them across four addresses. Notably, the same wallet was previously drained of $24.2 million in a September 2023 phishing attack, though 90% of those funds were eventually returned. The incident adds to a rising wave of crypto security breaches in 2026.

$25.6 million wallet drain

• ▪The August 2026 wallet drain also targeted smaller balances of cbBTC, USDS, Lido DAO (LDO), and Curve DAO (CRV).
• ▪The stolen assets from the August 2026 wallet drain included approximately $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC, and $2.6 million in Ethereum (ETH).
• ▪An unknown cryptocurrency whale lost $25.6 million worth of cryptocurrency in a wallet drain attack reported on August 13, 2026.

Stolen asset conversion

• ▪Following the August 2026 wallet drain, the attacker swapped the stolen assets for approximately 20 million DAI and 3,000 ETH.
• ▪The swapped assets from the August 2026 wallet drain were valued at approximately $5.64 million at the time of the report by blockchain security firm PeckShield.

2023 phishing attack history

• ▪Following the September 2023 phishing attack, the attacker returned approximately 90% of the stolen funds to the victim's wallet.
• ▪During the September 2023 phishing attack, the attacker stole approximately 4,851 rETH and 9,579.2 stETH, which were swapped for roughly 13,785 ETH and 1.64 million DAI.
• ▪The same cryptocurrency wallet address targeted in August 2026 was previously drained of $24.2 million in a phishing attack in September 2023 due to malicious token approvals.

August 2026 security incidents

• ▪DefiLlama logged 13 cryptocurrency hacks in August 2026 with tracked losses exceeding $12 million, including a $7.9 million loss by payment processor Coinsbuy on August 9, 2026.
• ▪According to Nominis, major cryptocurrency security incidents resulted in approximately $1.65 billion in losses during the first seven months of 2026, with July 2026 accounting for $242 million.
• ▪A five-year-old firmware vulnerability in Coinkite's Coldcard hardware wallets accounted for approximately $116 million in losses in July 2026.

Attacker fund distribution

• ▪Blockchain security firm PeckShield and on-chain analyst Specter reported the August 2026 wallet drain but did not identify the owner of the victimized wallet.
• ▪Following the August 2026 wallet drain, the attacker distributed the stolen cryptocurrency funds across four separate addresses.

2 sources