Whale Investor Suffers Second Major Crypto Heist, Losing Over $26 Million
A prominent cryptocurrency investor, known by the wallet address TLBL, has been hit by a second significant digital asset theft, losing more than $26 million. This latest incident follows a phishing attack two years ago that saw the same holder lose $24 million.
The recent exploit appears to stem from a compromised private key, raising critical questions for large-scale crypto holders about the efficacy of enhanced security measures when a wallet has already been a target.
On August 13, blockchain analytics firm Lookonchain reported that over $26 million in assets were drained from three wallets associated with TLBL. The firm indicated that the whale “appears to have had its private key compromised.” The stolen assets included aWBTC, DAI, WBTC, ETH, aUSDC, sDAI, USDS, cbBTC, and various other tokens.
Lookonchain’s analysis estimates the total value of assets lost across TLBL’s two major thefts to be approximately $50.3 million. The initial incident, occurring two years prior, involved the theft of 9,579 stETH, valued at $15.54 million, and 4,851 rETH, worth $8.51 million, through a phishing scheme.
The latest loss, however, differs in its apparent method. Security firm PeckShield stated the victim lost around $25.6 million, with significant portions including approximately $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC, and $2.6 million in ETH. PeckShield reported that the attacker had already converted a portion of the stolen funds into 20 million DAI and roughly 3,000 ETH, collectively valued at about $5.64 million, distributing them across four separate addresses.
Minor discrepancies in the reported figures between Lookonchain and PeckShield are attributed to variations in asset valuations used in their respective analyses. Nevertheless, both sources confirm a substantial draining of TLBL-linked wallets, with Lookonchain identifying a compromised private key as the likely cause.
In a separate development this week, Lookonchain also highlighted a smaller incident involving address poisoning. In this scenario, a victim inadvertently copied a wallet address directly from their transaction history without verification, subsequently sending funds to a lookalike address controlled by an attacker, resulting in a $100,000 loss. While distinct from the method used against TLBL, this case underscores a persistent vulnerability: crypto wallets remain a significant weak point in digital asset security.
TLBL’s second major loss occurs amidst a record-breaking period for cryptocurrency theft. A report by Blockaid, published on August 2, revealed that hackers stole $1.1 billion across 212 incidents in the first half of 2026. Privileged key misuse, the same category implicated in the TLBL incident, accounted for approximately $790 million of that total, representing about three-quarters of all funds stolen during that period.
Monthly incident counts saw a sharp rise, increasing from 18 in January to 57 in June. Blockaid also found that hackers linked to North Korea were responsible for roughly 55% of all funds stolen in the first half of the year, amounting to about $609 million. However, current data related to TLBL’s case does not specifically connect it to this group.
