Crypto security incidents hit record $1B losses

TLDR

Recent data shows crypto security incidents stole over $1 billion in the first half of 2026, the highest losses and incident count ever recorded for a six month period.

1. Blockaid reports 212 onchain exploits and around $1.1 billion stolen in H1 2026, with a single quarter alone topping $1 billion in losses.
2. Most losses now come from key theft and operational failures, driven heavily by North Korea linked groups, rather than classic smart contract bugs.
3. Users and projects face rising risks from compromised wallets, governance and AI tools, making operational security and verification as important as contract audits.

Deep Dive

1. Scale Of Losses

Security firm Blockaids H1 2026 Onchain Security Report finds 212 verified exploits in the first half of 2026, a 3.4 times increase over all of 2025, with total losses around $1.1 billion and June alone seeing 57 incidents. The two largest attacks, on KelpDAO and Solana perpetual DEX Drift Protocol, accounted for roughly $577 million combined, while four major incidents made up about 64 percent of all stolen funds. Ethereum and Solana were the most affected networks, with losses estimated at about $332 million and $326 million respectively, according to reporting on Blockaids findings.

Separate analysis from Immunefi suggests 2026 hacks have already cost about $972 million, reinforcing that losses are near or above the $1 billion mark even with differing methodologies. TradingView coverage of Blockaids data notes Q2 2026 as the worst quarter on record for crypto security, with hacks at a record high and losses topping $1 billion.

Confidence: high because multiple independent security firms and media reports converge on a $1 billion plus loss figure for 2026 security incidents.

2. How Attacks Changed

Blockaid attributes about 74 percent of H1 2026 losses to operational security issues such as compromised keys, signing infrastructure and privileged access, not to exploitable contract code. The North Korea linked Trader Traitor cluster, associated with the Lazarus Group, is reported to have driven approximately $609 million in losses, including the KelpDAO and Drift exploits that abused bridge infrastructure and governance multisigs rather than pure protocol bugs.

Immunefis review of 425 hacks between 2021 and 2025 shows a similar pattern where a small share of operational failures, especially centralized exchange and custody compromises, account for most value lost. At the same time, code is not solved; long lived programs almost always surface critical vulnerabilities, and even heavily audited protocols have suffered large thefts, highlighting that audits alone are insufficient.

3. What To Watch Next

Blockaid flags three emerging attack surfaces for H2 2026: Ethereums EIP?7702 wallet delegation mechanics, AI prompt injection against trading or wallet agents and off chain bridge infrastructure used for cross chain transfers. At the same time, security vendors are rolling out mitigations such as Safes Safenet, an onchain security network that performs real time transaction checks before funds leave smart accounts.

On the user side, job related malware campaigns like the fake Relay interview app show that Web3 professionals are being targeted through social engineering to exfiltrate browser and wallet credentials. Regulators and law enforcement are also reacting; FBI data and Consumer Federation of America estimates suggest tens of billions of dollars in broader crypto related scams annually, putting more pressure on platforms and developers to harden security.

Conclusion

Crypto security incidents have reached record levels in both value and frequency, with more than $1 billion stolen in early 2026 and hundreds of exploits clustered around key and governance compromises. The headline number matters, but the deeper shift is that attackers are moving up the stack to human and operational weak points, while defenders begin deploying onchain protections and more rigorous operational practices. How quickly projects and users adapt their security culture will do as much to reduce future losses as any single audit or upgrade.