Crypto attackers stole more than $1.1 billion across 212 verified exploits in the first half of 2026, the highest incident count ever recorded for any half-year, according to Blockaid’s H1 2026 Onchain Security Report released Tuesday.
The record number of cases came even though dollar losses were lower than in the same period last year. Blockaid noted that the comparison is skewed by the $1.5 billion Bybit theft, which by itself exceeded every other incident in that earlier stretch. This year’s figures point to a different issue: the number of attacks is rising, and most stolen funds are being lost through operational failures rather than buggy code.
Ido Ben-Natan, Blockaid’s co-founder and CEO, said in a post on X on Tuesday that the company verified 3.4 times as many high-threshold exploits in the first six months of 2026 as it did in all of 2025. He said operational security attacks, including compromised keys, signing infrastructure, and privileged access, accounted for 74% of stolen funds. A North Korea-linked cluster was responsible for 55% of all losses, he added.
Operational failures drove the biggest incidents
According to the report, the two largest attacks in the first half both stemmed from operational failures, not smart contract bugs.
On April 18, KelpDAO lost $292 million in rsETH after a single compromised validator in LayerZero’s decentralized verifier network signed a malicious bridge transaction, based on Blockaid’s incident analysis. The loss amounted to more than a quarter of KelpDAO’s total value locked.
Weeks earlier, on April 1, Drift Protocol, which Blockaid described as Solana’s largest perpetuals exchange at the time, lost $285 million in less than 12 minutes. The attack was traced to a privileged key compromise at the governance layer.
Ethereum and Solana led network losses
Ethereum and Solana posted the largest losses among networks in the report, at roughly $332 million and $326 million, respectively.
Blockaid said code exploits drove most incidents on Ethereum. On Solana, losses were concentrated in breaches involving keys and signing infrastructure.
North Korea-linked groups accounted for 55% of losses
Blockaid attributed the KelpDAO and Drift attacks, along with the Humanity Protocol exploit, to groups linked to North Korea. It said TraderTraitor, a subgroup of Lazarus, was the most active.
Those attacks together accounted for about $609 million in losses, or roughly 55% of all funds stolen in the first half of 2026.
Attack pace continued into late July
The pace did not ease at the start of the second half, according to the report. DefiLlama’s hacks database listed nine exploits in the last week of July alone, including a $24.15 million key compromise at AFX Bridge and a second $7.53 million drain affecting the Verus-Ethereum bridge.