Crypto records most hacked half-year ever with 212 exploits and $1.1 billion stolen

The first half of 2026 has earned a distinction nobody wanted: the most-hacked six-month period in crypto history by incident count. Blockaid’s H1 2026 report, released on July 28, tallied 212 verified exploits that drained over $1.1 billion from protocols, wallets, and infrastructure across the ecosystem.

The number of attacks hit a record, but the dollar figure actually dropped. H1 2025 saw roughly $2.3 billion vanish, largely because of the Bybit catastrophe that alone wiped out $1.5 billion. Remove one mega-hack from the equation, and this year’s losses would look far worse by comparison.

North Korea’s outsized role

DPRK-linked actors were responsible for approximately 66% of total losses in H1 2026, according to TRM Labs, which independently tracked 207 incidents totaling $972 million stolen in the same period.

Two breaches dominated the landscape. The KelpDAO exploit resulted in losses of roughly $292 million, while the Drift Protocol incident cost around $285 million. Combined, those two hacks accounted for nearly $577 million, or more than half of all funds stolen during the period. Both incidents were attributed to DPRK-linked groups.

Infrastructure compromises, which include social engineering attacks, were responsible for about 76% of the total value lost, even though they represented a smaller share of total incidents.

Smart contracts remain the soft underbelly

While infrastructure breaches drove the biggest dollar losses, smart contract vulnerabilities were the most common attack vector by far. TRM Labs attributed approximately 125 of its 207 recorded incidents to smart contract exploits.

Ethereum and Solana bore the heaviest losses by chain, with $332 million and $326 million stolen respectively. The two chains combined accounted for roughly $658 million in losses, or about 60% of the total.

The gap between incident count and dollar losses

Blockaid counted 212 incidents. TRM Labs counted 207. Divide $1.1 billion by 212 incidents and you get roughly $5.2 million per exploit. In H1 2025, the average was nearly double that, inflated by the Bybit mega-breach.

The attack surface is expanding as more protocols launch, more bridges connect chains, and more capital flows into DeFi. At 212 exploits in six months, the industry is averaging more than one breach per day.

The North Korea dimension adds regulatory complexity. DPRK-linked groups funneling $643 million from crypto protocols gives governments additional ammunition for stricter oversight. The 125 smart contract exploits recorded by TRM Labs represent vulnerabilities that better engineering practices could meaningfully reduce, while infrastructure breaches linked to North Korean social engineering tend to target a smaller number of high-value targets.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.