Every quarter, the SEAL Intel team pulls together the incidents, patterns, and attacker behavior we've tracked across the ecosystem. Q3 2026 was dominated by two massive thefts: the Bitget hot-wallet breach ($351.6M - $387.5M) and the AFX Trade bridge exploit ($24.15M)
Neither of those thefts required a private key and both started with attackers getting through a door the victim trusted, then waiting for the right moment to strike. That pattern of trusted entry points, patient attackers, and losses that land far from the keys runs through everything we discuss below.
The full report shared with our donors goes deeper on attribution, tooling, and technical indicators. This post is the shorter version focused on the top 10 threats we saw this quarter and what you can do about them.
1. DPRK is still the biggest threat, and the gap is widening
North Korea-linked actors account for roughly 95% of the losses in our report when public reporting is included, up from about 77% last quarter. Both of the largest thefts, Bitget and AFX Trade, are publicly attributed to TraderTraitor / UNC4899. In incidents SEAL handled directly, DPRK-linked clusters were behind a $23.3M perpetuals-protocol compromise, a 5,000 ETH + 30 BTC exchange theft, and a $4.8M exchange account compromise. Public tracking now puts DPRK-attributed theft in 2026 above $1 billion.
What to do: Contain the blast radius of a compromised device because successful infrastructure compromises frequently start from a single employee device. Implement robust device isolation and granular access controls across all infrastructure to minimize lateral movement and limit the damage when an intrusion occurs.
2. The biggest heists didn't need a private key
Last quarter we warned that attackers were moving beyond keys and this quarter proved it. At Bitget, attackers reportedly entered through a third-party security appliance, moved laterally to wallet job servers, and forged risk-control parameters to authorize withdrawals. At AFX, a trojanized artifact-repository plugin led to unauthorized co-signing on bridge validators. Smaller incidents followed the same pattern, including an MPC node attack, an admin-API takeover, and spoofed deposit records.
What to do: Segregate signing and withdrawal-authorization paths from general infrastructure. Artifact repositories, CI plugins, security appliances, and risk-control services all sat on the path to theft in Q3. Monitor them for integrity and require independent attestation for high-value withdrawals.
3. Fake job interviews are still the most reliable way in
Fake recruitment was the entry point for the AFX exploit (a cloned "interview" repository) and for the largest single loss SEAL responded to this quarter (a fake DEX recruiter followed by a fake Teams call). It also drove most Contagious Interview thefts and was one of PolinRider's main infection routes through malicious coding tests. In Japan, local law enforcement tied about 30,000 compromised devices and roughly ¥1.7B in theft to the same campaign.
What to do: Treat every external codebase as code execution. Before running anything from a recruiter or partner, review postinstall hooks, .npmrc tokens, git hooks (post-checkout), VS Code tasks.json, Rust build.rs, and build configs (postcss, tailwind). SEAL created a framework for exactly this type of developer-targeted intrusion. You can find it at: https://frameworks.securityalliance.org/devsecops/developer-targeted-intrusions/overview
4. Supply-chain attacks have reached ecosystem scale
BlueNoroff / Sapphire Sleet moved from npm (Axios in March, Mastra in June) to Rust (arrayref in August) by taking over maintainer accounts. PolinRider's self-propagating compromise of developer accounts reached 4,367 repositories and spread into npm, Go, and Packagist. In our own cases, Contagious Interview payloads showed up in dependency hooks, git hooks, and build configuration. These intrusions spread like worms, moving from a single developer device or GitHub profile to the rest of the organization.
What to do: Adopt "assume breach" threat modeling and maintain visibility into your full dependency chain. Pin dependency versions, pin infrastructure-as-code provider sources, and revoke publishing rights from dormant maintainers. TraderTraitor delivered macOS backdoors through Terraform lock files that pointed to lookalike HashiCorp registries. Protect your GitHub environment with the tooling available in the Enterprise subscription, and assume any GitHub compromise will be used to infect every developer in your organization.
5. Fake meetings are mass-produced, and copycats now have their own cluster
UNC1069 rotated through more than 90 typo-squat variations of "teams live," and newly flagged deployments rose from 10 in July to 55 in September. Another 158 fake-meeting domains couldn't be tied to a specific cluster. The copycat trend we flagged in Q2 has also matured.
SEAL now tracks SINT-69 as a separate intrusion set running fake Zoom and Teams infrastructure modeled on UNC1069, with 88 flagged domains this quarter and four successful compromises, including three Telegram account takeovers. Public reporting links an overlapping kit to BlueNoroff, but SEAL is not attributing SINT-69 to DPRK at this time. Our team actively works to detect and take down both the phishing domains and the hijacked Telegram accounts DPRK uses.
What to do: Standardize due diligence for all interactions with unknown parties, including known contacts who suddenly move a call to a new link. Most UNC1069 and SINT-69 lures arrived from the hijacked Telegram accounts of real contacts.
6. Attackers get in, test, and wait
The timelines this quarter show patient, deliberate operators. At AFX, initial access came on July 9 and the theft on July 22. At Bitget, attacker activity reportedly began August 31 and the theft happened September 24. In one UNC1069 intrusion we handled, the fake call took place around July 24, an on-chain test followed on July 31, and the theft came on August 6. Other UNC1069-related incidents showed attackers sitting on compromised devices for 19 and 26 months before stealing anything.
What to do: Conduct retroactive reviews of all infrastructure, codebases, and credentials. Adversaries are actively using latent access, including long-dormant account takeovers, compromised infrastructure access tokens, leaked personal access tokens (PATs), and persistent backdoors established over the previous 6 - 12 months. They are also using LLMs to automate vulnerability research, malware campaign components, lateral movement, and internal reconnaissance. Optimize your EDR and SIEM configurations for operational efficacy: move policies from "Detect" to "Block," and inspect logs regularly for abnormalities and signs that you're being targeted.
7. Stolen money funds the next attack, and laundering is getting faster
We saw proceeds from a SINT-01 theft used to buy governance tokens and stage a malicious proposal against a second protocol. SEAL's alerting helped stop it. However, individual DPRK operators also used stolen card data to pay for campaign tools, including premium Calendly and Shutterstock subscriptions.
On the cash-out side, public tracing shows DPRK moving more than $30M through Hyperliquid, while Bitget proceeds are being laundered by illicit Chinese networks that recruit openly on Discord and Telegram. Meanwhile, enforcement is catching up in some places. For example, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) and the U.S. Department of Justice worked together to take down the Xinbi marketplace, which processed Bybit and WazirX proceeds.
What to do: Keep governance timelocks long enough to react, and monitor proposals funded by freshly acquired tokens. Verify OTC escrow addresses out-of-band. One $1.6M loss this quarter came from a swapped address.
8. The IT-worker scheme keeps adapting
DPRK's IT-worker operation now recruits interview proxies from third countries, and it has placed operatives inside a U.S. federal agency and in a contractor role on MetaMask code. We also see these workers targeting staffing agencies to get into companies through legitimate intermediaries. We saw several insider thefts this quarter, resulting in $1.4M losses.
What to do: Integrate counter-party risks into your organizational threat modeling. Staffing agencies, contractors, and vendors are now entry points, so their security posture is part of yours.
9. Wallet software and hardware are high-impact targets
A compromised wallet application drained $5.3M from users, another affected about 4,000 users, and a hardware-wallet vulnerability led to at least four successful thefts. We assess with medium confidence that LLM-driven research was behind these vulnerabilities, which reinforces last quarter's warning that AI is lowering the bar for attackers.
What to do: Prioritize managed device environments and enterprise-grade security solutions, and mandate dedicated, hardened work devices for all sensitive operations. In Q3, we observed that keys kept on personal laptops caused at least two seven-figure losses.
10. Attackers are calling, and some are showing up in person
We linked fake support callers to 19 thefts totaling more than $10M. Most started with a fake "Google" or "Yahoo" account-security call. Five more cases, totaling about $678K, involved physical robbery, home invasion, or drugging. Both vectors rose significantly throughout 2026.
What to do: Hang up on any unsolicited account-security call and contact the provider through its official channels. Anyone known to hold significant crypto should keep their holdings, location, and travel plans private.
Looking for a deeper dive? This post covers the highlights, but the full Q3 2026 report includes detailed incident breakdowns, attacker cluster data, and technical indicators. Full reports like this one are available to our institutional donors. Your support makes this work possible.