Crypto Hacks Top $1 Billion in 2026: Why Losses Keep Rising

You wake up, check your project’s Discord, and everything is on fire. Treasury paused. Withdrawals halted. Wallet permissions under review. Another nine-figure exploit just hit, and the market barely flinches anymore.

That’s where crypto is in 2026. Depending on who you ask, we crossed the one billion dollar mark in stolen funds before the year was half over. Wallets have been the soft spot, and a couple of brutal April incidents did most of the damage.

So why are losses still rising when everyone swears they’re “doing security” now? Let’s pull the lens back and walk through it without the spin.

Across the first half of 2026, multiple trackers logged record hack counts and eye-watering losses. TRM Labs counted 207 hacks in H1 with about $972 million stolen and a median loss around $219,000, which says a lot of these events are small to mid-sized hits, not just headline megabreaches (TRM Labs).

CertiK painted an even grimmer picture: roughly $1.316 billion lost across 344 incidents, with about $1.2 billion net after frozen or recovered funds. Crucially, they flagged wallet compromise as the costliest vector, driving about $444.5 million in losses across just 33 incidents. Two April blowups, KelpDAO and Drift, accounted for almost 44% of H1 losses on their tally (CertiK).

Blockaid’s analysis, reported by The Block, lined up with the “over one billion” conclusion and attributed nearly $600 million to DPRK-linked operations, including the same April incidents (The Block / Blockaid).

Attackers don’t need a bull market. They just need liquidity, weak keys, and someone in a hurry.

What’s behind the 2026 spike in hacks?

Two big forces are colliding. On one side, crypto keeps scaling horizontally. New rollups, appchains, and liquidity layers mean more bridges, more relayers, more oracles, more operational keys. On the other side, attackers have professionalized, industrialized even, with state-linked crews and polished ransomware-style playbooks sliding into crypto’s public surface area.

Conflicting tallies are a feature, not a bug

It’s normal for incident trackers to disagree. TRM’s H1 2026 count comes in lower on total dollars than CertiK’s because they bucket events and recoveries differently. TRM says 207 hacks and ~$972 million stolen (TRM Labs). CertiK logs 344 incidents and ~$1.316 billion gross, ~$1.2 billion net (CertiK). Meanwhile Blockaid highlights that a large share ties back to DPRK-linked operations, pegging those at nearly $600 million (The Block / Blockaid).

The takeaway isn’t which dashboard “wins.” It’s that all three agree on the direction: more incidents, larger absolute losses, and a chilling concentration in a few vectors and a few months.

Liquidity concentration and time pressure

When liquidity concentrates in a handful of protocols and L2s, the blast radius grows. During volatile weeks, teams rush hotfixes, rotate keys, and deploy patches in production. That’s prime time for attackers who live for misconfigurations and human error.

How attackers are breaking in now

Let’s keep the mechanics plain. Most high-dollar hits in 2026 haven’t been fancy cryptographic breaks. They’ve been control-plane failures: keys, permissions, and front-ends.

Wallets and key infrastructure

Per CertiK, wallet compromise was the costliest vector in H1, driving about $444.5 million across 33 incidents. Two April cases, KelpDAO and Drift, alone accounted for close to 44% of H1 losses on their dataset (CertiK). That tracks with what many security teams see: the most dangerous bug is still a leaked, phished, or mis-scoped key.

Governance and operator privileges

On-chain governance sounds decentralized until you check the actual thresholds and time locks. Power often funnels through multisigs, guardians, or emergency pause keys with broad authority. A single compromised signer, rushed upgrade, or bad timelock config can be enough.

Bridges and cross-chain dependencies

Bridges are improving, but they remain complex systems with many moving parts: validators, relayers, oracles, state proofs, and time-sensitive assumptions. You can harden one component and still get clipped by an off-chain credential or a dependency that isn’t version-locked.

Front-end phishing and dangerous approvals

We’ve also seen the “quiet” drain: poisoned websites, malicious ads, and spoofed interfaces that trick users into signing toxic approvals. These may not make nine-figure headlines by themselves, but in aggregate they produce steady, repeatable loss.

A typical kill chain

1. Recon: Map multisigs, guardians, deployers, bots, and emergency roles. Scrape repos and docs for process clues.
2. Initial access: Phish a signer, compromise a vendor account, or target a shared device. Sometimes it’s just a bad VPN.
3. Privilege escalation: Lift session tokens, abuse CI/CD secrets, or exploit weak access boundaries between staging and prod.
4. Execution: Push a malicious config, reroute a withdrawal queue, or trigger a permissioned upgrade with subtle parameter tweaks.
5. Cash out: Fan the funds across chains, semi-automate with scripts, and race sanctions and surveillance.

Where the money went: incidents and patterns

Let’s make the differing views concrete. Each source carves the data a bit differently, but they’re all describing the same storm.

Source Period Incidents Gross losses (USD) Adjusted/net (USD) Notes TRM Labs H1 2026 207 ~972,000,000 N/A stated Median loss ≈ $219k; mean ≈ $4.7M CertiK H1 2026 344 1,315,676,432 ~1,200,364,925 Wallet compromise leads; KelpDAO & Drift ≈ 44% of H1 The Block / Blockaid H1 2026 Not specified >1,000,000,000 N/A stated ~$600M linked to DPRK operations

Interpreting the gaps

Why the spread? Definitions. Some trackers count rug pulls and exit scams; others focus on technical exploits. Some net out frozen and recovered funds; others report gross. Timing and attribution vary too. None of this means the data is unreliable. It just means you have to compare like with like.

Concentration risk is now obvious

Two April wallet incidents helped tip the scales for H1. Whether you follow CertiK’s tallies or Blockaid’s attributions, the point is the same: a handful of high-permission failures can dominate a year’s loss curve (CertiK, The Block / Blockaid).

Why losses keep rising despite “better security”

Security spend isn’t the same as security outcomes

Teams are buying audits, bug bounties, and monitoring. Good. But the biggest checks are happening in code paths that aren’t fully public or aren’t covered by typical audits: governance scripts, deploy pipelines, signer devices, emergency upgrade levers. Attackers know that’s where the power lives.

Operational complexity keeps outpacing controls

New chains and products multiply secrets and endpoints. One hot wallet for an allowlist turns into five. One multisig becomes three with overlapping signers. Every new partner integration adds another API key, webhook, and dashboard. Most orgs don’t rotate or scope those well under pressure.

Rollups and appchains compress timelines

Shipping fast is great for users. It’s also great for adversaries. Shorter governance windows and quicker deployment cycles narrow the chance to catch a malicious parameter or a confused-deputy pattern before it’s live.

Professionalized adversaries with patience

State-linked crews treat crypto like a revenue line. Blockaid’s H1 snapshot attributes nearly $600 million in losses to DPRK-linked operations, including marquee incidents (The Block / Blockaid). They will wait months to phish the right signer or to map a vendor stack. That is not the same threat model as a weekend rug pull.

Users are still signing first, thinking later

Even with better wallet UX, harmful approvals remain too easy. Phishing isn’t glamorous, but it’s steady income for attackers, and it piles up into eight figures across a quarter.

TRM Labs chart (quarterly stolen value vs. incident count, 2022–H1 2026) showing incident counts rising while dollars stolen concentrate in April — visualizes the split between more frequent, smaller hacks and a few catastrophic infrastructure compromises. — Source: TRM Labs

What teams can do this quarter

No silver bullets, but here’s a compact, realistic plan that moves the needle without freezing product velocity.

1. Scope keys like code. Inventory every key, token, signer, and admin role. Write it down. If you can’t list them, you can’t secure them.
2. Isolate and minimize. Separate deployers, pausers, and guardians. Remove blanket approvals. Narrow contract roles to the fewest addresses needed.
3. Raise governance thresholds. Increase multisig quorum for high-value actions and add a visible delay for upgrades. Make exceptions rare and documented.
4. Hardware-first for signers. Enforce hardware wallets or secure enclaves for operators, with phishing-resistant auth for dashboards.
5. Rotate secrets on a schedule. Quarterly minimum for sensitive keys. Automate revocation on offboarding. Enforce unique device policies.
6. Split staging and prod for real. No shared keys, no shared RPCs, no shared credentials. Block prod signers from staging domains and vice versa.
7. Simulate emergency drills. Run a live-fire tabletop: key lost, front-end poisoned, bridge paused. Time your response and assign owners.
8. Kill toxic approvals. Add an approvals dashboard in-app, nudge revocations, and surface risks clearly. Consider allowance-limiting by default.
9. Vendor due diligence that isn’t a checkbox. Ask for their key policy, incident response time, and isolation model. Make them show you.
10. Don’t skip postmortems. Publish what went wrong and what changed. You’ll recruit better talent and deter repeat vectors.

And for users and funds: treat hot wallets like cash in your pocket, not the vault. Segment exposure. Revoke often. Pause when front-ends behave oddly.

Risks & What Could Go Wrong

• Key reuse or signer compromise across multiple protocols, amplifying impact across chains.
• Bridge or oracle dependencies breaking during network congestion, leading to mispriced liquidations or stuck withdrawals.
• Front-end supply chain attacks via ad networks, analytics scripts, or package managers.
• False sense of safety from audits that don’t cover governance or operational keys.
• Sanctions or enforcement actions that freeze liquidity mid-incident, complicating recovery plans.
• Copycat campaigns reusing successful phishing kits tuned to crypto UX.

The riskiest period is right after a fix ships. Attackers know teams relax once the fire is out.

If you want an ongoing pulse on the big incidents, vectors, and policy shifts shaping security outcomes, Crypto Daily tracks those crosscurrents with a blend of news and analysis. You can follow our reporting here: Crypto Daily.

Frequently Asked Questions

Are hacks actually increasing, or are we just seeing them more?

Both. The count of incidents is up, and so are absolute dollar losses. TRM tallied 207 hacks and about $972 million stolen in H1 2026, while CertiK logged 344 incidents with about $1.316 billion in gross losses and roughly $1.2 billion net after recoveries. Even if you pick the lowest number, it’s a lot for six months.

Why do different sources report different totals?

They define events differently. Some include scams or rug pulls, others stick to technical exploits. Some net out frozen or returned funds; others report gross loss. Reporting windows and attributions also vary. The key is trend alignment, which all major trackers share for H1 2026.

What made April so bad with KelpDAO and Drift?

Concentration of privilege. CertiK says wallet compromise drove the largest losses in H1, and those two April incidents alone represented close to 44% of the half’s losses on their dataset. When high-permission keys or wallets are touched, outcomes scale fast.

How can protocols reduce wallet compromise risk without killing velocity?

Scope roles tightly, enforce hardware-backed signers, raise multisig quorums for high-value actions, add timelocks for upgrades, rotate keys on a schedule, and separate staging from production. It’s not zero risk, but it moves the odds.

Are retail users mostly safe if they avoid new tokens?

Not necessarily. Front-end phishing and malicious approvals hit veterans too. Use hardware wallets for anything meaningful, verify URLs, use allowlist bookmarks, keep allowances low, and revoke approvals regularly. If a dapp suddenly asks for broad permissions, stop and check.

What role are state-linked actors playing?

A large one. Blockaid’s H1 view, reported by The Block, attributes nearly $600 million in losses to DPRK-linked operations. These actors are patient, target operators and vendors, and treat crypto exploits as systematic revenue, not one-off crimes.

What should teams watch for in the second half of 2026?

More key-focused campaigns, targeted vendor compromises, and bridge dependency edge cases during network stress. Expect more polished phishing hitting mobile wallets and signer dashboards. Strengthen key hygiene and incident drills now, before the next volatility spike.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.