Crypto Hacks Surpass $1.1B in First Half of 2026
North Korea-linked hackers accounted for 55% of total stolen funds across 212 incidents.
1Record-Breaking Half-Year
The first six months of 2026 marked the most active period for crypto exploits on record. According to Blockaid's report, hackers stole $1.1 billion across 212 incidents. Just four major attacks on KelpDAO, Drift, Resolv, and CoW Swap accounted for $707 million in losses. KelpDAO's $292 million cross-chain message forgery stands as the single largest theft to date.
2North Korean Connection
55% of attacks ($609 million) were linked to North Korea's TraderTraitor group. Drift Protocol on Solana lost $285 million in just 12 minutes. Humanity Protocol's $32 million loss was also connected to the same hacker cluster. This Lazarus Group subunit specializes in state-sponsored cyber operations.
3Monthly Escalation
Monthly incidents rose from 18 in January to 57 by June. April became the worst month with $577 million stolen from KelpDAO and Drift Protocol alone, pushing total monthly losses to $635 million. Privileged key misuse caused $790 million in damages, representing nearly 75% of all stolen funds.
4New Target: AI Systems
In May, hackers used prompt injection to trick Bankr's AI agent into approving $216,000 in unauthorized transactions. Novel methods like EIP-7702 wallet delegation attacks emerged in 2026. Cross-chain bridges proved vulnerable when destination chains accepted forged proofs. Legacy smart contracts like Aztec Connect and Raydium also suffered breaches.
5Code-Level Vulnerabilities
80% of attacks exploited code-level weaknesses. Unbacked mint exploits ($80 million at Resolve) ranked second by value. July attacks on AFX Trade, BSquaredNetwork and Verus caused over $35 million in combined losses. Verus' earlier exploit was traced to the same bridge contract vulnerability.
6Recovery Efforts
Teams successfully froze funds or negotiated returns in code-related incidents. However, stolen-key attacks saw funds disappear through mixers or cross-chain routes. Blockaid noted security teams struggling to adapt to new threats, particularly state-sponsored groups' technical capabilities.
7Industry Impact
The attacks eroded trust in crypto exchanges while driving up insurance premiums. Regulators are increasing scrutiny of DeFi protocols. Security firms are developing new standards for cross-chain solutions. 78% of users now employ multi-factor authentication.
8Future Projections
Blockaid warns of increasing AI-powered attacks in H2 2026, particularly targeting trading bots and smart contract auditors. The industry is investing in advanced encryption like zero-knowledge proofs. Experts emphasize the critical need for user education amid evolving threats.