{
  "generatedAt": "2026-06-17T02:42:28.569Z",
  "windowHours": 72,
  "executiveSummary": "The most material incident is a $36M exploit at Humanity Protocol, with a separate $20M Coinbase spoofing case and a $2.2M theft from Aztec Connect, totaling at least $58.3M in direct losses. Dominant attack vectors include phishing-wallet-drainers and smart contract exploits, though several incidents lack clear vector attribution. Regulatory actions are intensifying, with the CLARITY Act proposing $150M for crypto fraud investigations and the UK designating HTX under major sanctions. Enforcement is also rising globally, as seen in South Korea's arrests for USDT laundering linked to Cambodian fraud.",
  "trends": [
    "Large-scale exploits remain the top financial risk to protocols.",
    "Phishing and wallet drainers are a persistent, low-friction attack vector.",
    "Sanctions enforcement is increasingly targeting cryptocurrency addresses.",
    "Authorities are successfully using blockchain analysis for fund recovery."
  ],
  "items": [
    {
      "id": "https://thedefiant.io/news/defi/defi-lending-and-dex-fees-slump-as-leverage-drains-out-after-june-selloff",
      "source": "The Defiant",
      "sourceKind": "rss",
      "title": "DeFi Lending and DEX Fees Slump as Leverage Drains Out After June Selloff",
      "summary": "Fees fell as much as 65% week over week across the largest lending protocols and decentralized exchanges.",
      "url": "https://thedefiant.io/news/defi/defi-lending-and-dex-fees-slump-as-leverage-drains-out-after-june-selloff",
      "publishedAt": "2026-06-16T20:49:56.000Z",
      "category": "other",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Lending",
        "DEX",
        "Fees"
      ],
      "amountUsd": null,
      "oneLiner": "DeFi Lending and DEX Fees Slump as Leverage Drains Out After June Selloff"
    },
    {
      "id": "https://www.chainalysis.com/blog/ofac-sanctions/",
      "source": "Chainalysis",
      "sourceKind": "rss",
      "title": "OFAC and Crypto Crime: Every OFAC Specially Designated National with Identified Cryptocurrency Addresses",
      "summary": "As far back as the early 1800s, the U.S. Department of the Treasury has issued economic sanctions to achieve foreign… The post OFAC and Crypto Crime: Every OFAC Specially Designated National with Identified Cryptocurrency Addresses appeared first on Chainalysis.",
      "url": "https://www.chainalysis.com/blog/ofac-sanctions/",
      "publishedAt": "2026-06-16T16:16:12.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "OFAC",
        "Crime"
      ],
      "amountUsd": null,
      "oneLiner": "OFAC and Crypto Crime: Every OFAC Specially Designated National with Identified Cryptocurrency Addresses"
    },
    {
      "id": "https://crypto.news/clarity-act-to-set-aside-150m-for-crypto-fraud-investigations/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "CLARITY Act to set aside $150M for crypto fraud investigations",
      "summary": "The Digital Asset Market Clarity Act has secured a $150 million allocation for law enforcement efforts targeting cryptocurrency scams and other digital asset crimes, according to U.S. Senator Cynthia Lummis. In a post published on X on June 16, the…",
      "url": "https://crypto.news/clarity-act-to-set-aside-150m-for-crypto-fraud-investigations/",
      "publishedAt": "2026-06-16T14:40:51.000Z",
      "category": "other",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "CLARITY",
        "Act"
      ],
      "amountUsd": null,
      "oneLiner": "CLARITY Act to set aside $150M for crypto fraud investigations"
    },
    {
      "id": "https://thedefiant.io/news/tokens/humanity-protocol-h-token-airdrop-recovery-36m-exploit",
      "source": "The Defiant",
      "sourceKind": "rss",
      "title": "Humanity Protocol Launches New H Token Airdrop After $36M Exploit",
      "summary": "Humanity Protocol has announced a full token migration and 1:1 airdrop of a new H token after the June 8 exploit that drained approximately $36 million.",
      "url": "https://thedefiant.io/news/tokens/humanity-protocol-h-token-airdrop-recovery-36m-exploit",
      "publishedAt": "2026-06-16T14:40:00.000Z",
      "related": [
        {
          "source": "crypto.news",
          "url": "https://crypto.news/humanity-protocol-sets-new-h-airdrop-after-36m-exploit/"
        }
      ],
      "category": "exploit",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Humanity Protocol",
        "Launches",
        "New"
      ],
      "amountUsd": 36000000,
      "oneLiner": "[$36.0M] Humanity Protocol Launches New H Token Airdrop After $36M Exploit"
    },
    {
      "id": "https://www.openzeppelin.com/news/openzeppelin-confidential-contracts-v0.5-diff-audit",
      "source": "OpenZeppelin",
      "sourceKind": "rss",
      "title": "OpenZeppelin Confidential Contracts v0.5 Diff Audit",
      "summary": "Summary Type:Library Timeline:From 2026-05-18 → To 2026-05-21 Languages:Solidity Findings Total issues: 12 (6 resolved) Critical: 0 (0 resolved) · High: 0 (0 resolved) · Medium: 5 (2 resolved) · Low: 0 (0 resolved) Notes & Additional Information 6 notes raised (3 resolved) Client Reported Issues 1 issue reported (1 resolved)",
      "url": "https://www.openzeppelin.com/news/openzeppelin-confidential-contracts-v0.5-diff-audit",
      "publishedAt": "2026-06-16T13:06:11.000Z",
      "category": "advisory",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "OpenZeppelin",
        "Confidential",
        "Contracts"
      ],
      "amountUsd": null,
      "oneLiner": "OpenZeppelin Confidential Contracts v0.5 Diff Audit"
    },
    {
      "id": "https://www.trmlabs.com/resources/blog/uk-designates-htx-what-the-biggest-crypto-sanctions-action-yet-means-for-compliance-teams",
      "source": "TRM Labs",
      "sourceKind": "rss",
      "title": "UK Designates HTX: What the Biggest Crypto Sanctions Action Yet Means for Compliance Teams | TRM Labs",
      "summary": "The UK designated HTX for alleged Russian sanctions evasion. TRM covers immediate response steps, look-back guidance, and OFSI reporting obligations.",
      "url": "https://www.trmlabs.com/resources/blog/uk-designates-htx-what-the-biggest-crypto-sanctions-action-yet-means-for-compliance-teams",
      "publishedAt": "2026-06-16T13:00:00.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "UK",
        "Designates",
        "HTX"
      ],
      "amountUsd": null,
      "oneLiner": "UK Designates HTX: What the Biggest Crypto Sanctions Action Yet Means for Compliance Teams | TRM Labs"
    },
    {
      "id": "https://crypto.news/pyra-to-shut-down-after-drift-exploit-derails-recovery-efforts/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "Pyra to shut down after Drift exploit derails recovery efforts",
      "summary": "Pyra has announced plans to shut down operations after months of efforts to recover from the impact of the Drift exploit, with user withdrawals remaining available until September 15, 2026. According to a June 15 announcement from Pyra, the crypto…",
      "url": "https://crypto.news/pyra-to-shut-down-after-drift-exploit-derails-recovery-efforts/",
      "publishedAt": "2026-06-16T10:25:15.000Z",
      "category": "exploit",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Pyra",
        "Drift"
      ],
      "amountUsd": null,
      "oneLiner": "Pyra to shut down after Drift exploit derails recovery efforts"
    },
    {
      "id": "https://crypto.news/south-korea-detains-23-suspects-over-usdt-laundering-for-cambodia-based-fraud-network/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "South Korea arrests 23 over USDT laundering for Cambodian fraud network",
      "summary": "South Korean authorities have dismantled an alleged cryptocurrency laundering operation that moved 16.8 billion won ($11.1 million) through USDT transactions and exchange transfers on behalf of a Cambodia-based phishing syndicate. According to local news outlet Newsis, the Seoul Metropolitan Police…",
      "url": "https://crypto.news/south-korea-detains-23-suspects-over-usdt-laundering-for-cambodia-based-fraud-network/",
      "publishedAt": "2026-06-16T09:31:03.000Z",
      "category": "enforcement",
      "vectors": [
        "phishing-wallet-drainer"
      ],
      "protocols": [
        "South",
        "Korea",
        "USDT"
      ],
      "amountUsd": null,
      "oneLiner": "[phishing / wallet drainer] South Korea arrests 23 over USDT laundering for Cambodian fraud network",
      "related": [
        {
          "source": "Decrypt",
          "url": "https://decrypt.co/371277/south-korea-charges-23-over-crypto-laundering-tied-to-11m-cambodian-scam-ring"
        }
      ]
    },
    {
      "id": "https://crypto.news/ethereum-price-tests-multi-year-support-trendline-can-it-reclaim-2000/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "Ethereum price tests multi-year support trendline, can it reclaim $2,000?",
      "summary": "Ethereum price has rebounded toward $1,800 after buyers stepped in near a multi-year support trendline while easing geopolitical tensions triggered a sharp recovery across risk assets. According to crypto.news market data, Ethereum (ETH) price surged more than 10% on June…",
      "url": "https://crypto.news/ethereum-price-tests-multi-year-support-trendline-can-it-reclaim-2000/",
      "publishedAt": "2026-06-16T09:18:10.000Z",
      "category": "other",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Ethereum"
      ],
      "amountUsd": null,
      "oneLiner": "Ethereum price tests multi-year support trendline, can it reclaim $2,000?"
    },
    {
      "id": "https://crypto.news/indias-ed-files-charges-in-20m-coinbase-spoofing-case/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "India’s ED files charges in $20M Coinbase spoofing case",
      "summary": "The Enforcement Directorate has filed a prosecution complaint in a cryptocurrency fraud case involving more than $20 million in stolen digital assets and has attached assets worth about INR 64.55 crore (approx. $6.83 million) linked to the alleged proceeds of…",
      "url": "https://crypto.news/indias-ed-files-charges-in-20m-coinbase-spoofing-case/",
      "publishedAt": "2026-06-16T08:37:01.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "India",
        "ED",
        "Coinbase"
      ],
      "amountUsd": 20000000,
      "oneLiner": "[$20.0M] India’s ED files charges in $20M Coinbase spoofing case"
    },
    {
      "id": "https://www.chainalysis.com/blog/ghana-eoco-uk-nca-blockchain-analysis-case/",
      "source": "Chainalysis",
      "sourceKind": "rss",
      "title": "How Ghana’s EOCO and the UK NCA are Using Blockchain Analysis to Return $15 Million to Fraud Victims",
      "summary": "When an e‑commerce “investment” platform promising high-yield returns began circulating in Ghana, thousands of people signed up to run online… The post How Ghana’s EOCO and the UK NCA are Using Blockchain Analysis to Return $15 Million to Fraud Victims appeared first on Chainalysis.",
      "url": "https://www.chainalysis.com/blog/ghana-eoco-uk-nca-blockchain-analysis-case/",
      "publishedAt": "2026-06-16T08:32:24.000Z",
      "category": "other",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "How",
        "Ghana",
        "EOCO"
      ],
      "amountUsd": null,
      "oneLiner": "How Ghana’s EOCO and the UK NCA are Using Blockchain Analysis to Return $15 Million to Fraud Victims"
    },
    {
      "id": "https://crypto.news/oklahoma-flags-bg-wealth-dsj-over-suspected-crypto-fraud/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "Oklahoma flags BG Wealth, DSJ over suspected crypto fraud",
      "summary": "Oklahoma warns investors about BG Wealth, DSJ and HQI Exchange, citing fake crypto returns, blocked withdrawals and added fee demands.",
      "url": "https://crypto.news/oklahoma-flags-bg-wealth-dsj-over-suspected-crypto-fraud/",
      "publishedAt": "2026-06-16T07:47:38.000Z",
      "category": "other",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Oklahoma",
        "BG",
        "Wealth"
      ],
      "amountUsd": null,
      "oneLiner": "Oklahoma flags BG Wealth, DSJ over suspected crypto fraud"
    },
    {
      "id": "https://crypto.news/congress-proposes-doj-crypto-theft-task-force-a-year-after-ncet-shutdown/",
      "source": "crypto.news",
      "sourceKind": "rss",
      "title": "Congress proposes DOJ crypto theft task force a year after NCET shutdown",
      "summary": "Congress has proposed a new Justice Department task force focused on cryptocurrency theft after the FBI received 181,565 crypto-related complaints and more than $11 billion in reported losses during 2025. According to legislation introduced by Representatives Lance Gooden and Josh…",
      "url": "https://crypto.news/congress-proposes-doj-crypto-theft-task-force-a-year-after-ncet-shutdown/",
      "publishedAt": "2026-06-16T07:12:31.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Congress",
        "DOJ",
        "NCET"
      ],
      "amountUsd": null,
      "oneLiner": "Congress proposes DOJ crypto theft task force a year after NCET shutdown"
    },
    {
      "id": "https://blockthreat.com/blockthreat-week-24-2026/",
      "source": "BlockThreat",
      "sourceKind": "rss",
      "title": "BlockThreat - Week 24, 2026",
      "summary": "$42.4M stolen across 15 incidents as attackers return to old code, exposed keys and deprecated protocols still holding value.",
      "url": "https://blockthreat.com/blockthreat-week-24-2026/",
      "publishedAt": "2026-06-15T21:42:11.000Z",
      "category": "exploit",
      "vectors": [
        "unknown"
      ],
      "protocols": [],
      "amountUsd": null,
      "oneLiner": "BlockThreat - Week 24, 2026"
    },
    {
      "id": "https://www.trmlabs.com/resources/blog/eu-sanctions-russian-propagandists-military-suppliers-and-officials-in-new-listings",
      "source": "TRM Labs",
      "sourceKind": "rss",
      "title": "EU Sanctions Russian Propagandists, Military Suppliers, and Officials in New Listings | TRM Labs",
      "summary": "EU designates 34 individuals and 47 entities for supporting Russia’s war. Includes TRM analysis of crypto fundraising by a designated propagandist.",
      "url": "https://www.trmlabs.com/resources/blog/eu-sanctions-russian-propagandists-military-suppliers-and-officials-in-new-listings",
      "publishedAt": "2026-06-15T20:42:00.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "EU",
        "Sanctions",
        "Russian"
      ],
      "amountUsd": null,
      "oneLiner": "EU Sanctions Russian Propagandists, Military Suppliers, and Officials in New Listings | TRM Labs"
    },
    {
      "id": "https://slowmist.medium.com/analysis-of-the-2-19-million-asset-theft-from-aztec-connect-d867c59b1fc6?source=rss-4ceeedda40e8------2",
      "source": "SlowMist",
      "sourceKind": "rss",
      "title": "Analysis of the $2.19 Million Asset Theft from Aztec Connect",
      "summary": "Analysis of the $2.19 Million Asset Theft from Aztec Connect: ZK-Rollup Settlement Boundary Bypass Leads to L1/L2 State Discrepancy Background On June 14, 2026, the deprecated Aztec Connect RollupProcessor contract (0xff1f2b4adb9df6fc8eafecdcbf96a2b351680455) was exploited. The attacker constructed a boundary gap between numRealTxs and decoded_slots, extracting approximately $2.19 million worth of assets from the L1 pool in a single atomic transaction. Aztec Connect was deprecated in March 2024, but the immutable contract continues to be exposed to risk due to holding legacy user assets. This…",
      "url": "https://slowmist.medium.com/analysis-of-the-2-19-million-asset-theft-from-aztec-connect-d867c59b1fc6?source=rss-4ceeedda40e8------2",
      "publishedAt": "2026-06-15T15:02:49.000Z",
      "category": "exploit",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Analysis",
        "Million",
        "Asset"
      ],
      "amountUsd": 2190000,
      "oneLiner": "[$2.2M] Analysis of the $2.19 Million Asset Theft from Aztec Connect",
      "related": [
        {
          "source": "The Defiant",
          "url": "https://thedefiant.io/news/hacks/aztec-connect-deprecated-contract-exploit-2-1m-zk-proof"
        }
      ]
    },
    {
      "id": "https://thedefiant.io/news/hacks/aztec-connect-thetanuts-zk-rollup-exploit-4-3m",
      "source": "The Defiant",
      "sourceKind": "rss",
      "title": "Thetanuts Finance: $2.1M Attack, Partial White-Hat Recovery",
      "summary": "The on-chain options and structured product protocol Thetanuts Finance was exploited for $2.1 million. Security firm Blockaid published the exploit transaction and exploiter address shortly after the attack.",
      "url": "https://thedefiant.io/news/hacks/aztec-connect-thetanuts-zk-rollup-exploit-4-3m",
      "publishedAt": "2026-06-15T15:02:49.000Z",
      "category": "exploit",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "Thetanuts Finance"
      ],
      "amountUsd": 105000,
      "oneLiner": "[$2.1M] Thetanuts Finance: $2.1M Attack, Partial White-Hat Recovery",
      "related": [
        {
          "source": "DeFiLlama Hacks DB",
          "url": "https://api.llama.fi/hacks"
        }
      ]
    },
    {
      "id": "https://decrypt.co/371143/one-indicted-over-crypto-wrench-attack-in-france",
      "source": "Decrypt",
      "sourceKind": "rss",
      "title": "One Indicted Over Crypto ‘Wrench Attack’ in France",
      "summary": "The crypto-related assault reportedly involved attackers posing as police officers, and follows a spate of attacks in the country.",
      "url": "https://decrypt.co/371143/one-indicted-over-crypto-wrench-attack-in-france",
      "publishedAt": "2026-06-15T14:40:46.000Z",
      "category": "enforcement",
      "vectors": [
        "unknown"
      ],
      "protocols": [
        "One",
        "Indicted",
        "Over"
      ],
      "amountUsd": null,
      "oneLiner": "One Indicted Over Crypto ‘Wrench Attack’ in France"
    }
  ],
  "stats": {
    "totalItems": 18,
    "totalReportedLossUsd": 58295000,
    "topVectors": [
      {
        "vector": "phishing-wallet-drainer",
        "count": 1
      }
    ],
    "sourcesUsed": [
      "BlockThreat",
      "Rekt News",
      "Cointelegraph (Security)",
      "crypto.news",
      "The Defiant",
      "CoinDesk",
      "Decrypt",
      "Protos",
      "SlowMist",
      "OpenZeppelin",
      "Zellic",
      "Chainalysis",
      "TRM Labs",
      "Elliptic",
      "Trail of Bits",
      "CISA Advisories",
      "SANS ISC",
      "DeFiLlama Hacks DB",
      "SlowMist Hacked DB"
    ],
    "sourcesFailed": [
      {
        "source": "Week in Ethereum",
        "error": "HTTP 403 (native fetch)"
      },
      {
        "source": "X (security alerts)",
        "error": "HTTP 503: {\"title\":\"Service Unavailable\",\"detail\":\"Service Unavailable\",\"type\":\"about:blank\",\"status\":503}"
      }
    ],
    "sourceStats": [
      {
        "source": "BlockThreat",
        "raw": 15,
        "kept": 15,
        "windowed": 1,
        "final": 1
      },
      {
        "source": "Rekt News",
        "raw": 7,
        "kept": 7,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "Cointelegraph (Security)",
        "raw": 30,
        "kept": 12,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "crypto.news",
        "raw": 50,
        "kept": 8,
        "windowed": 8,
        "final": 7
      },
      {
        "source": "The Defiant",
        "raw": 100,
        "kept": 17,
        "windowed": 4,
        "final": 4
      },
      {
        "source": "CoinDesk",
        "raw": 25,
        "kept": 0,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "Decrypt",
        "raw": 35,
        "kept": 3,
        "windowed": 2,
        "final": 2
      },
      {
        "source": "Protos",
        "raw": 10,
        "kept": 0,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "Week in Ethereum",
        "raw": 0,
        "kept": 0,
        "windowed": 0,
        "final": 0,
        "error": "HTTP 403 (native fetch)"
      },
      {
        "source": "SlowMist",
        "raw": 10,
        "kept": 10,
        "windowed": 1,
        "final": 1
      },
      {
        "source": "OpenZeppelin",
        "raw": 10,
        "kept": 3,
        "windowed": 1,
        "final": 1
      },
      {
        "source": "Zellic",
        "raw": 20,
        "kept": 9,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "Chainalysis",
        "raw": 10,
        "kept": 4,
        "windowed": 2,
        "final": 2
      },
      {
        "source": "TRM Labs",
        "raw": 100,
        "kept": 37,
        "windowed": 2,
        "final": 2
      },
      {
        "source": "Elliptic",
        "raw": 10,
        "kept": 4,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "Trail of Bits",
        "raw": 20,
        "kept": 4,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "CISA Advisories",
        "raw": 30,
        "kept": 2,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "SANS ISC",
        "raw": 10,
        "kept": 0,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "DeFiLlama Hacks DB",
        "raw": 558,
        "kept": 558,
        "windowed": 1,
        "final": 1
      },
      {
        "source": "SlowMist Hacked DB",
        "raw": 20,
        "kept": 20,
        "windowed": 0,
        "final": 0
      },
      {
        "source": "X (security alerts)",
        "raw": 0,
        "kept": 0,
        "windowed": 0,
        "final": 0,
        "error": "HTTP 503: {\"title\":\"Service Unavailable\",\"detail\":\"Service Unavailable\",\"type\":\"about:blank\",\"status\":503}"
      }
    ],
    "candidateSources": [
      "thestar.com.my",
      "coincentral.com"
    ]
  },
  "missed": [
    {
      "title": "Zcash critical counterfeiting vulnerability disclosure",
      "url": "https://www.thestar.com.my/tech/tech-news/2026/06/16/crypto-tokens-wipeout-shows-scale-of-ai-hacking-threat",
      "why": "A ~4-year-old cryptographic flaw in Orchard could have allowed unlimited counterfeit ZEC; disclosure triggered a sharp price drop."
    },
    {
      "title": "Raydium legacy AMM V3 pools exploit",
      "url": "https://coincentral.com/raydium-got-exploited-for-1-34m-but-your-funds-are-safe-heres-why/",
      "why": "~$1.34M drained from five deprecated Solana AMM V3 pools (RAY, SOL, USDC)."
    },
    {
      "title": "TOP DAO governance takeover drains Balancer pool",
      "url": "https://thedefiant.io/news/hacks/attacker-mints-10-billion-top-tokens-governance-takeover-drains-1-58m-balancer",
      "why": "Attacker seized governance, minted 10B TOP, and drained ~944 WETH (~$1.58M) from a Balancer V1 pool."
    }
  ]
}