If you’re holding Pro token right now, you already know the feeling: refreshing the chart, refreshing X, waiting for the team to say literally anything.
Somewhere on Ethereum, an exploiter is sitting on roughly $8.2 million in USDT while the project behind the drained token stays completely silent. It’s a scene that’s become almost routine in 2026, a year that just delivered the worst six months for onchain security the industry has ever recorded.
Blockaid’s exploit detection system caught this one in real time. Whether the team behind it catches up to its own community remains an open question, and if you’ve got exposure here, that silence is probably the most frustrating part.
An Active Exploit Hits Pro Token, And The Team Stays Silent
Blockaid’s monitoring systems flagged an ongoing exploit targeting the Pro token, a project tied to the account @CryptoDAOGlobal, in an alert detailed in a thread on social media. The security firm’s tracking shows roughly $8.2 million in USDT currently sitting between the exploiter’s wallet and a cluster of addresses that appear to have won early from the attack, whether through front-running the exploit transaction or simply being positioned to benefit from the chaos that followed.
As of this writing, the CryptoDAOGlobal team has not issued a statement, a post-mortem, or even a basic acknowledgment that anything is wrong. For holders watching their token’s chart in real time, that silence is arguably its own kind of red flag, and it fits a pattern security researchers have flagged all year: teams increasingly find out about their own exploits from a security firm’s public alert before they find out internally. If you’re one of those holders, you’re not overreacting by worrying. You’re just paying attention faster than the project is.
Inside The $8.2 Million Drain
Live exploit alerts like this one follow a familiar shape, and once you’ve watched a few of them play out, you start to recognize the rhythm. A security system built to watch onchain activity around the clock catches unusual contract behavior, minting patterns, or fund movements within minutes, sometimes seconds, of the first transaction.
Blockaid built its reputation doing exactly that kind of real-time detection, and its track record this year includes catching everything from bridge exploits to governance takeovers before the wider crypto community even noticed the chain had moved. The Pro token case slots into that same category: an active, unresolved exploit, a dollar figure that keeps a community glued to block explorers, and a project team that has gone quiet at the exact moment its holders need answers most. Until CryptoDAOGlobal responds, the $8.2 million currently parked in the exploiter’s wallet and the associated winning addresses stands as the clearest public record of what happened, which says a lot about where the accountability gap in this industry still sits.
A Record First Half For Onchain Crime
Zoom out from any single incident, and the bigger picture gets grim fast, and honestly, a little exhausting if you’ve been holding crypto through it. Blockaid’s own research arm verified 212 separate security incidents across the first half of 2026 alone, a volume that runs 3.4 times higher than everything recorded across the entirety of 2025.
Total verified losses for the period landed around $1.1 billion, with Ethereum and Solana absorbing the bulk of the damage, according to details shared in a recent breakdown. To put that pace in perspective, an industry that used to measure major exploits in the dozens per year is now clearing that same count roughly every few weeks. If you’ve felt like your timeline has been nonstop exploit alerts lately, it’s not just you. The data backs up that gut feeling.
Why Operational Security, Not Code, Is Bleeding Crypto Dry
Here’s the finding that should reshape how every project, and every person trusting a project with their money, thinks about security: 74% of all funds stolen in H1 2026 didn’t come from a smart contract bug at all. They came from operational security failures, compromised private keys, hijacked signer infrastructure, social engineering that tricked an insider into approving something they shouldn’t have.
Code audits, once treated as the finish line for security, are increasingly catching the smaller share of the problem. The bigger, costlier failures are happening around the code, in the humans and processes that hold the keys to it. That should change how you evaluate a project before you ape in, too. A clean audit badge on a landing page tells you almost nothing about whether the team’s laptop, multisig, or Slack workspace is the actual weak point.
The DPRK Cluster Behind More Than Half Of H1 Losses
Attribution data from the same period points to one actor cluster doing an outsized share of the damage. Blockaid’s research ties North Korea-linked operators to 55% of all H1 2026 losses, a concentration that lines up with what other blockchain security firms have separately reported this year about the scale of Pyongyang’s crypto theft operations. These aren’t smash-and-grab hacks.
The pattern researchers keep describing involves patient, methodical campaigns: fake job offers aimed at developers, impersonated venture capital outreach, and infiltration of trusted infrastructure long before a single dollar moves. It’s worth sitting with that for a second. The team behind a token you hold might already have a compromised hire on staff months before anyone notices anything is wrong.
What Blockaid Expects Attackers To Scale Next
The forward-looking part of Blockaid’s research is arguably the most useful for anyone building or holding crypto right now, you included. The firm’s team flagged a set of newer attack vectors it expects to scale through the second half of 2026, patterns that have shown up in isolated incidents so far but haven’t yet become industry-wide trends. Given how quickly this year’s dominant tactics, operational compromises and infrastructure targeting, went from edge cases to the majority of stolen funds, that forecast carries real weight. If the first half of 2026 taught the industry anything, it’s that the next wave of losses probably won’t look like the last one, which means the questions worth asking about any project you’re in aren’t just “was the code audited,” but “who has the keys, and how would I even know if that changed.”
For now, the Pro token exploit remains active and unresolved, CryptoDAOGlobal remains quiet, and roughly $8.2 million sits in limbo between an exploiter’s wallet and the addresses that came out ahead. It’s a small case study inside a much larger story: an industry that keeps building faster than it secures, and a threat landscape that keeps proving it’s paying close attention to exactly where the gaps are. If you’re holding anything right now, that’s probably worth remembering the next time a team goes quiet after a chart starts moving in the wrong direction.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!