On January 2, 2026, the prominent on-chain sleuth ZachXBT reported that hundreds of independent wallets had been drained of their assets, with the root cause remaining unidentified as of the latest investigations.
The new year began with a significant blow to the decentralized finance (DeFi) ecosystem as a massive, coordinated security breach hit users across multiple Ethereum Virtual Machine (EVM) compatible chains.
The attack is characterized by its broad reach and technical stealth. Unlike traditional “phishing” schemes where users are tricked into signing a malicious transaction, many affected users reported that funds were moved without any recent interaction with new dApps or websites. This has led security researchers to hypothesize a potential supply-chain compromise in a common library, a vulnerability in a popular browser extension, or a deep-seated exploit within a widely used wallet-connect protocol.
Thousands of users across networks like Ethereum, Arbitrum, and Polygon have seen their balances of ETH, stablecoins, and high-value NFTs transferred to several central “mixer” addresses.
Major wallet providers and security firms like SlowMist and CertiK have issued urgent advisories, urging users to revoke all open token approvals and move high-value assets to “cold” hardware wallets that have not been connected to hot browser environments.
ZachXBT and other white-hat groups are currently tracking the flow of funds, which appear to be moving toward specialized obfuscation protocols designed to hide the final destination of the stolen capital.
This event serves as a stark reminder of the “fragility of trust” in the DeFi space, prompting renewed calls for the adoption of multi-signature security and institutional-grade custody solutions even for individual retail investors.
