- An investor using the TLBL symbol lost over $26 million as a result of the probable takeover of the private key to his wallets.
- This is the second such serious incident involving the same entity, totaling over $50.3 million in losses over two years.
- Private key leaks account for approximately 75% of all funds stolen in the cryptocurrency industry in the first half of 2026.
Insane! More than $50M has been stolen from whale “TLBL”. Two years ago, whale “TLBL” lost $24M in a phishing attack. Today, the whale appears to have had its private key compromised, and over $26M in assets across 3 wallets were completely drained. https://t.co/JVrb19u5gi
The funds disappeared in a short time, and the criminals immediately started covering their tracks. Data from the aforementioned Lookonchain show that the total balance of losses related to TLBL addresses has just exceeded $50.3 million. Two years ago, the same investor fell victim to a phishing attack in which he lost 9,579 stETH and 4,851 rETH, worth approximately $24 million at the time.
However, the new incident is of a completely different technical nature.
Transfer funds from TLBL addresses
Although the exact mechanism of key takeover took place outside the blockchain, analysts most often point to hardware infection with malware, leakage of an unencrypted cloud backup or an advanced social engineering attack.
Network security company PeckShield estimated the loss at $25.6 million. The stolen funds included approximately $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC and $2.6 million in Ethereum. Differences in valuations between analysts result from the market volatility of individual tokens at the time of measurement.
Before the injured party managed to react, the attacker managed to exchange some of the seized assets for 20 million DAI and approximately 3,000 Ethereum worth $5.64 million. The seized funds went directly to four new technical addresses.
It is difficult to find more clear proof that even very experienced players make critical mistakes in access management. The method of storing private keys is still the weakest link in the entire ecosystem.
Do you currently have cryptocurrencies?
It’s about cryptocurrencies on an exchange, in an application or in a wallet. Don’t treat cryptocurrency ETFs, ETNs and ETPs as ownership.
The survey is anonymous and voluntary. We do not collect your name or IP address. We only publish data in aggregate. Privacy Policy
The seizure of keys is the main cause of losses in 2026
The scale of the phenomenon is growing from month to month. Just 18 incidents were reported in January, while the number jumped to 57 in June.
According to Blockaid statistics, North Korea-linked groups accounted for approximately 55% of all stolen funds during this period, which translates to $609 million. However, in the case of the attack on TLBL addresses, no links to these structures were found. Lookonchain reported a case from the same week where an investor lost $100,000 due to address poisoning attacks. The user copied a fake address from the transaction history without fully verifying the characters.
The loss of control of the private key by the TLBL whale proves that advanced security procedures do not protect against basic human errors. Standard software wallets and inadequately secured backups create recurring risks that institutional investors still cannot eliminate.
