Crypto Hacks Hit Record 212 Incidents in H1 2026: Blockaid

Attackers stole more than $1.1 billion across 212 verified exploits in the first half of 2026, the highest incident count on record for any half-year, according to Blockaid's H1 2026 Onchain Security Report, published Tuesday.

The record count lands even as dollar losses came in below the same period last year, when the $1.5 billion Bybit theft alone dwarfed every other incident. The 2026 data points to a different problem: attacks are multiplying, and most of the money is walking out through operational failures rather than buggy code.

Blockaid verified 3.4 times as many high-threshold exploits in the first six months of 2026 as in all of 2025, Ido Ben-Natan, co-founder and CEO of Blockaid, said in a post on X on Tuesday. Operational security attacks — compromised keys, signing infrastructure and privileged access — drained 74% of stolen funds, while a North Korea-linked cluster accounted for 55% of all losses, he said.

Opsec, Not Code

The two largest incidents of the half both traced back to operational failures rather than smart contract bugs. On April 18, KelpDAO lost $292 million in rsETH — more than a quarter of its total value locked — after a single compromised LayerZero decentralized verifier network signed off on a malicious bridge transaction, according to Blockaid's incident analysis. Weeks earlier, on April 1, Drift Protocol, Solana's largest perpetuals exchange at the time, was drained of $285 million in under 12 minutes through a privileged key compromise at the governance layer.

Ethereum and Solana absorbed the largest losses of any networks, at roughly $332 million and $326 million respectively, according to the report. Code exploits drove most Ethereum incidents, while key and signing infrastructure breaches accounted for the bulk of Solana losses.

The DPRK Cluster

Blockaid attributed the KelpDAO and Drift attacks, along with the Humanity Protocol exploit, to North Korea-linked groups, with the TraderTraitor subgroup of Lazarus the most active. Those attacks alone account for roughly $609 million, or about 55% of all first-half losses.

The pace has not slowed into the second half. DefiLlama's hacks database lists nine exploits in the last week of July alone, including the $24.15 million AFX Bridge key compromise and a second $7.53 million drain of the Verus-Ethereum bridge.