Trust Inversion

Your AI Agent's Plumbing Can Steal Your Crypto

Researchers from UC Santa Barbara, UC San Diego, blockchain security firm Fuzzland, and World Liberty Financial published a paper documenting a class of attacks on LLM routers — the services that sit between users and AI models like Claude, ChatGPT, and Gemini. Of 428 routers analyzed, 9 were found injecting malicious code or stealing credentials. The paper defines two attack classes: payload injection, where the router rewrites tool-call traffic, and secret exfiltration, where it harvests credentials from plaintext. One router drained ETH from a researcher-controlled test wallet. Secondary reporting links the research to a $500,000 real-world wallet drain, though the primary paper documents the test wallet theft. Two routers deployed adaptive evasion targeting autonomous sessions specifically. The attack surface is not the AI model. It is the infrastructure between you and the model.

Apr 13, 2026

Fake Ledger App Drained $9.5M From Apple's App Store

A counterfeit version of Ledger Live operated on Apple's Mac App Store from April 7 to April 13, 2026, draining approximately $9.5 million from more than 50 victims before Apple removed it. The attack worked by prompting users to enter their 24-word seed phrase during a fake wallet setup flow. Once entered, attackers immediately reconstructed the wallet on a separate device and drained every account on the seed. Three victims lost over $1 million each. Musician Garrett Dutton, known as G. Love, lost 5.92 BTC — his retirement savings accumulated over a decade — while setting up a new MacBook. The hardware wallet never failed. The seed phrase rule did.

Apr 16, 2026

UNC1069 Is Deepfaking CEOs on Zoom to Drain Crypto Wallets

On April 15, 2026, crypto wallet provider Zerion disclosed that approximately $100,000 was stolen from its hot wallets through an AI-enabled social engineering attack that compromised employee sessions, credentials, and private keys. The methodology matched a detailed Mandiant report published February 9, 2026 documenting North Korean threat group UNC1069 using deepfake video of real crypto CEOs inside fake Zoom calls to deliver the ClickFix payload. The Security Alliance has blocked 164 UNC1069-linked domains between February and April. This is the industrialization of AI-enabled social engineering at the nation-state level, and the attack surface is the human layer, not the smart contract layer.

Apr 24, 2026

Drift Hack Began With Months of In-Person DPRK Social Engineering

On Wednesday, April 29, TRM Labs and Chainalysis published detailed analyses of the April 1 Drift Protocol breach: North Korean state-backed operators began the campaign in fall 2025 with in-person meetings between proxies and Drift employees, building professional credibility for months before exploiting it. Access came through Solana durable nonces, a feature that lets transactions be signed in advance and broadcast later, converting routine pre-signed approvals from Security Council members into delayed exploits. Once admin control was transferred, attackers whitelisted a fake CVT token as collateral, deposited the fake collateral, and drained real assets from vaults in approximately 12 minutes. The same intelligence research now puts North Korea-linked actors at 76% of all 2026 crypto theft and approximately $6 billion cumulative since 2017. The attribution share has risen from under 10% in 2020-2021 to 64% in 2025 to 76% in early 2026.

Apr 29, 2026

Sui Validators Reversed a $223M DEX Exploit by Vote

On May 22, an attacker exploited an integer overflow bug in an open-source math library used by Cetus Protocol, the dominant concentrated-liquidity DEX on the Sui blockchain, and drained approximately $223 million from liquidity pools. Sui validators coordinated within hours to freeze roughly $162 million still held in attacker-controlled Sui addresses, and a governance vote concluded in under 48 hours with 90.9% of staked validators in favor of recovery. The seizure worked against this thief, and the code path that achieved it does not disappear when the voting ends.

May 22, 2026

Trafficking Victims Unpaid as 127,000 BTC Sit in Reserve

In October 2025, the DOJ seized 127,271 Bitcoin from Prince Group founder Chen Zhi, the largest cryptocurrency forfeiture in US history. On May 28, the FBI announced Operation Blackout, the coordinated crackdown that freed nearly 2,000 trafficking victims from the same network's forced-labor scam compounds across Cambodia, Myanmar, and the UAE. The Bitcoin now sits in the Strategic Bitcoin Reserve under a non-sale executive order. The victims, hundreds of Americans defrauded by pig-butchering schemes, are fighting DOJ to get any of it back. The protective architecture is holding. The people it was stolen from are not being protected.

May 31, 2026

Four Years Undetected: Zcash Patches Orchard Counterfeit Bug

On June 5, Shielded Labs and Zcash Open Development Lab disclosed that a critical vulnerability in Zcash's Orchard shielded pool, present since May 2022, allowed unlimited undetectable ZEC counterfeiting for approximately four years before an emergency patch on June 2. Security engineer Taylor Hornby found the flaw using an AI-assisted audit powered by Anthropic's Opus 4.8: an under-constrained zero-knowledge circuit check that let forged proofs pass validation without triggering any on-chain signature. Because Orchard hides transaction amounts through zero-knowledge proofs, there is no cryptographic method to determine whether exploitation occurred before the fix, an uncertainty that sent ZEC down roughly 45% and prompted Arthur Hayes to exit his entire ZEC position.

June 5, 2026

AudiA6 Takedown Hits $389M Wash for 20 Ransomware Groups

On June 10, 2026, an international coalition led by the US Secret Service, IRS Criminal Investigation, and Polish Police dismantled AudiA6, a cryptocurrency laundering service that processed more than €336 million for 20 ransomware groups between 2022 and 2025, including funds stolen through the fake Ledger Live app attack OPNorange covered in April. AudiA6 operated by cycling stolen crypto through more than 6,000 KYC-verified money mule accounts at legitimate exchanges and returning clean funds within approximately one hour for a 3-to-10 percent commission. The takedown is a genuine law enforcement success but a diagnostic one: the €692,000 frozen at arrest is under 0.2 percent of the $389 million already processed, and none of it goes back to individual victims.

June 13, 2026

FTX Repays Bitcoin Creditors at $16,871 Petition-Date Price

June 16, 2026 is the record date for the fifth FTX creditor distribution, with payments to commence July 31. To claim, former FTX customers must have completed KYC with BitGo, Kraken, or Payoneer by today's cutoff. The payout formula is fixed at petition-date prices from November 11, 2022, when Bitcoin closed at $16,871. Bitcoin trades above $66,000 today. A creditor who held 1 BTC on FTX will receive approximately $16,871 in USD. The same 1 BTC held in private-key self-custody through the same 3.5 years is worth approximately $66,000 and required no claim, no tax disclosure to a third party, and no onboarding with a distribution provider. The FTX bankruptcy is the largest single retail test of custodial risk ever conducted. The record date is the financial checkpoint where the gap between the custodial outcome and the self-custody outcome becomes precise and permanent.

June 16, 2026

$1.7 Million Drained Through a Single Forged Proof on Taiko

On June 22, 2026, an attacker forged source-signal proofs on Taiko's Ethereum L2 bridge and drained $1.7 million from an ERC-20 vault for withdrawals with no matching deposits on the source chain. Taiko halted block production and urged users to withdraw from every bridge on the network because chain state verification failure is not bounded to a single contract: when the proof mechanism fails, every bridge relying on it fails simultaneously. This is the Trust Inversion pattern at the cryptographic layer: the mechanism that was supposed to make bridges trustless became the attack surface. Native Bitcoin in self-custody has no proof verification layer, no source-signal mechanism, and no bridge to forge.

June 22, 2026

Hinkal Lost $820,000 After Its Privacy Proof Verification Failed to Verify Anything

An attacker drained roughly $820,000, nearly the protocol's entire total value locked, from Hinkal, a zero-knowledge privacy protocol, on July 3, 2026, by submitting a deposit that skipped the required cryptographic proof and then withdrawing funds the contract should have refused. Blockchain security firm CertiK confirmed the technique targeted Hinkal's core proof-verification step, and the stolen funds moved through Tornado Cash and a Thorchain bridge to Bitcoin within hours. It's the latest entry in OPNorange's Trust Inversion series: a mechanism built to provide privacy and security became the exact vector that broke both.

July 4, 2026