Key highlights:
- Crypto hack losses reached at least $1 billion in the first half of 2026.
- Ethereum and Solana saw the highest stolen funds among all blockchains.
- Blockaid tracked 212 security incidents during the six-month period.
- Infrastructure attacks and North Korea-linked groups accounted for most of the losses.
The crypto industry suffered a difficult first half of the year, not only due to the bear market but also because bad actors continued to terrorize blockchain projects.
Blockchain security firm Blockaid shared in a report that the number of attacks hit a record high in the first six months of the year. They also said that Ethereum and Solana saw the most losses during the period.
Crypto hack losses hit record levels in H1 2026
Blockaid’s H1 2026 Security Report reported 212 security incidents. This made it the busiest six-month period for blockchain attacks on record.
The crypto hack losses topped $1.1 billion overall, with April recording the most hacks. The attacks ranged across different sectors of crypto. This included DeFi platforms, bridges and wallet infrastructure.
Source: Blockaid
Ethereum saw the largest losses, with around $332 million stolen during the first half of the year.
Solana followed with hackers stealing about $326 million.
The report also revealed that Blockaid verified 3.4 times more high-value exploits during the first half of 2026 than it saw in the whole of 2025.
The biggest attack happened with KelpDAO. Here, hackers moved $292 million in crypto.
Meanwhile, Q2 alone set another record, with 123 security hacks hitting blockchain projects.
Most incidents involved smart contract exploits. According to Blockaid, 125 of the 207 analyzed attacks were linked to vulnerabilities in smart contracts.
Ethereum and Solana faced different security challenges
Ethereum and Solana were at the top of the list for the most losses between chains. They had similar losses in terms of numbers, but the attacks on the network were conducted in unique ways.
Source: Blockaid
On Ethereum, hackers took advantage of the flaws in the decentralized applications on the network. Blockaid said the attackers frequently targeted smart contracts, blockchain bridges, privileged administrator accounts, and market manipulation opportunities.
For instance, the Humanity Protocol and StablR hacks were caused by compromised private keys. Blockaid said Ethereum has kept attracting attackers because it hosts many of the crypto industry’s largest applications, including stablecoins and others.
Solana projects, on the other hand, were hacked using its private keys and validator infrastructure. Compromised keys were responsible for more than 98% of the network’s total losses.
One of the largest incidents involved Drift Protocol, which Blockaid tied to cyber groups in North Korea. Only a small number of Solana attacks were due to vulnerabilities in protocol code.
TRM Labs estimated in its report that $643 million, which is 66% of all funds stolen were linked to North Korean hacking groups.
This figure is lower than the estimated $1.7 billion attributed to North Korean activity during the first half of 2025, but it suggests these groups are a major source of concern for crypto.