Crypto Hacks Hit Record 207 in H1 2026, but Total Losses Fell Below $1 Billion

 

The first half of 2026 delivered a paradox for the crypto industry. According to blockchain security platform Immunefi, 207 separate hacks were recorded between January and June, the highest number ever logged in a six-month period. Yet total losses came in at approximately $972 million, down more than 50% from H1 2025 and, for the first time in years, below the psychological $1 billion mark.

That raises an obvious question: how can attacks become more frequent while the money stolen keeps shrinking? The answer says as much about how crypto security has matured as it does about how attackers have adapted.

 

Immunefi’s count of 207 incidents and roughly $972 million in losses is the headline figure, though other trackers frame the half differently depending on methodology. Security firm Blockaid put losses at $1.1 billion across 212 verified incidents, calling H1 2026 “the most-hacked half-year on record” by incident count, 3.4 times the exploit volume it tracked in all of 2025. CertiK’s Hack3D report counted 344 on-chain incidents totaling $1.32 billion, while QuillAudits tracked $935.3 million across 87 DeFi-specific hacks. The gap between these figures comes down to inclusion rules, thresholds, categories, and whether phishing or CeFi breaches count, but the direction is the same across every source: incident volume up sharply, total dollar losses down from 2025.

The average loss per incident fell accordingly. Median loss per hack has dropped from around $6 million in 2022 to roughly $1.5 million in 2025, a 75% decline, even as DeFi’s total value locked kept growing. DeFi protocol losses specifically have fallen 74% from their 2022 peak.

By attack surface, Blockaid’s data shows compromised keys, privileged credentials, and off-chain infrastructure, not smart contract bugs, accounted for about 74% of stolen value in H1 2026. Ethereum and Solana were the most targeted chains, losing roughly $332 million and $326 million respectively; more than 98% of Solana’s losses traced back to compromised signing keys rather than code exploits.

 

1.KelpDAO, $292 million (April 2026). The largest hack of the half began with social engineering that compromised a LayerZero developer’s credentials, followed by poisoning of RPC infrastructure to forge a cross-chain attestation. No smart contract bug was needed. Attribution points to North Korea’s Lazarus-linked TraderTraitor group. Recovery has been limited.

2.Drift Protocol, $285 million (April 2026). Attackers gained admin control of the Solana lending protocol through social engineering of multisig signers and drained funds in under 12 minutes. Combined, KelpDAO and Drift accounted for roughly $577 million, more than half of all H1 losses, and both are attributed to North Korea-linked actors.

3.Humanity Protocol, $32–36 million (June 2026). An employee’s laptop, compromised via phishing malware disguised as a Bithumb email, held several of the multisig keys controlling the identity project’s bridge contracts on Ethereum and BNB Chain. Attackers used the stolen keys to take over the bridge’s admin functions and mint tokens, crashing the H token roughly 80–89%. Quantstamp linked the malware’s digital signature to patterns associated with DPRK-linked intrusions.

4.Resolv, $23–25 million (March 2026). A single compromised private key controlling an off-chain “SERVICE_ROLE” account let an attacker mint 80 million unbacked USR stablecoins from a $100,000–$300,000 deposit, collapsing USR’s peg to a few cents before it partially recovered. No smart contract bug was involved, the flaw was structural trust in an off-chain signer with no on-chain amount validation.

5.CowSwap, approximately $50.4 million. A single malicious signature approval was enough to drain funds, underscoring how much value now sits behind one signing action rather than a chain of exploitable code.

6.Solana key-compromise incidents (Step Finance and related cases).Beyond Drift, several smaller Solana protocols lost funds to compromised signing infrastructure in the same pattern, reinforcing that key management, not contract logic, was Solana’s dominant weakness this half.

 

Several factors explain the divergence between rising incident counts and falling totals. Smart contract auditing has become more rigorous and widespread, closing off many of the code-level bugs that drove the largest thefts of 2021–2022. Bug bounty programs, including white-hat return arrangements, have recovered meaningful sums in individual cases. On-chain monitoring firms like Blockaid and Cyvers now flag anomalies, including stablecoin depegs, in real time, sometimes within minutes of an exploit starting. Multi-signature wallets, circuit breakers, and protocol pause functions have limited the damage window even when an attack succeeds.

Just as importantly, there was no single catastrophic breach on the scale of 2025’s roughly $1.5 billion Bybit hack, which alone skewed last year’s total upward. The absence of one outlier event, more than any systemic improvement, explains much of the year-over-year decline.

 

The center of gravity has shifted from exploitable code to exploitable people and processes. CertiK found phishing attacks alone caused roughly $508 million in H1 2026 losses. Compromised private keys and admin credentials, often obtained through social engineering, malware-laced phishing emails, or poorly separated multisig setups, now account for a majority of DeFi attacks by incident count, overtaking traditional logic bugs for the first time. Attackers increasingly target the “operational security” layer: who can sign, upgrade, pause, or move funds, rather than the Solidity code itself. North Korea-linked groups, particularly Lazarus’s TraderTraitor unit, were tied to an estimated 55–66% of H1 losses, concentrated in a handful of large, highly coordinated operations.

 

The shift toward frequent, smaller, operationally-driven attacks suggests DeFi’s code is maturing faster than its human and organizational security. Institutional players will likely read the falling loss total as a sign of progress, even as the record incident count signals a wider attack surface across thousands of live protocols. Expect security spending to keep shifting toward key management, signer separation, and real-time monitoring rather than audits alone, and expect nation-state actors to remain the single biggest driver of catastrophic losses when they do occur.

 

H1 2026 set a record for attack frequency and, unusually, a multi-year low for total losses. Better audits, monitoring, and incident response have made the average hack smaller, but attackers have adapted by targeting people, keys, and infrastructure instead of code. Crypto remains a target simply because of the value flowing through it. Increasingly, security itself, not just as a defensive necessity but as a demonstrable practice, is becoming a competitive advantage for the protocols that get it right.