Web3 recorded 344 security incidents in the first half of 2026, with total losses of about $1.32 billion, according to a Foresight News report that cited data from CertiK, TRM Labs and interviews with SlowMist and CertiK senior security engineer Yuannan Yang.
CertiK said in its July Hack3d report that, excluding Bybit’s $1.46 billion single loss from last year, the number of incidents in H1 still rose 28% from 2025. In the second quarter alone, cases climbed from 145 a year earlier to 194, up 34% year over year. The median loss per incident also increased 60.6% to about $169,000, a sign that even smaller day-to-day attacks were becoming more destructive.
On a like-for-like basis, the $1.32 billion lost in H1 2026 was about 28% higher than the same period a year earlier, based on CertiK’s figures.
The report said the heaviest losses were increasingly concentrated at the operational layer. Attackers were targeting key management, identity credentials and supply-chain dependencies rather than relying only on flaws in smart contract code. Those incidents were not the most numerous, but once critical permissions were compromised, they could directly expose core assets and produce outsized damage.
The biggest losses did not come from smart contract bugs
On April 1, 2026, about $285 million was drained from Drift Protocol, one of the largest perpetuals platforms on Solana, in 12 minutes. According to the report, the attackers spent six months posing as a quantitative trading firm, building trust before persuading a multisig signer to pre-sign a transaction with hidden authorization.
That same month, cross-chain restaking protocol KelpDAO lost about $292 million after attackers breached third-party validation infrastructure used by the project and forged cross-chain messages. In June, Humanity Protocol lost $36 million because of a phishing email.
Foresight News noted that none of the three largest security incidents in H1 stemmed from a vulnerability in smart contract code itself.
In an exclusive interview with Foresight News, the SlowMist security team said that among 182 incidents it tracked through the first half of 2026, operational failures including key leaks, social engineering and supply-chain attacks accounted for 53 cases, or 29.1% of the total, but produced $732 million in losses, equal to 76.6% of the total damage.
TRM Labs reported a similar pattern. Infrastructure and operational weaknesses represented only about 15% of incidents in H1, yet they were responsible for about 76% of total losses, far exceeding the impact from more than 100 smaller smart contract exploits.
Against that backdrop, Foresight News interviewed SlowMist and Yuannan Yang to understand what was driving the numbers and what new problems were emerging across crypto security.
The answer, the report said, was not a single trend. AI was changing the economics of attacks in a fundamental way, making attempts that once looked uneconomic suddenly worthwhile. At the same time, attackers were moving from code to people. Social engineering and key management failures were displacing contract exploits as the leading source of losses, and the security stack built around code audits was under strain.
AI is lowering costs and compressing the response window
Several independent studies over the past year have tried to measure AI’s effect on smart contract attacks. Their findings pointed in the same direction: lower cost, faster execution and a broader set of reachable targets.
Anthropic’s SCONE benchmark tested 405 real smart contracts that had previously been exploited. For vulnerabilities in contracts dated after the model’s knowledge cutoff, or after March 2025, it reported a 55.8% exploit success rate, an average scan cost of about $1.22 and simulated attack value of $4.6 million. Even on contracts the model had never seen before, it still identified exploitable flaws worth $4.6 million.
In the simulation, returns generated from stolen mock funds doubled about every 1.3 months, according to Anthropic’s data.
At University College London, Professor Arthur Gervais and Liyi Zhou built an agent system called A1 that can turn any large language model into an end-to-end exploit generator. In tests covering 36 real historical vulnerabilities, including access control flaws and logic or signature verification issues, A1 extracted about $9.33 million in attack value during validation. One vulnerability alone yielded as much as $8.59 million.
The same research highlighted a severe economic asymmetry between attackers and defenders. The paper said attackers needed only about $6,000 to break even and move into profit, while defenders needed about $60,000 to reach breakeven or profitability, a 10:1 gap. Targets that once looked unattractive because the payoff did not justify the effort were becoming worth pursuing.
Foresight News said those quantified trends were already visible onchain. Groth16, a cryptographic algorithm used by many zero-knowledge proof protocols to verify transaction validity, saw one configuration flaw exploited onchain for the first time in H1 2026. Just five days later, a larger attack using the same class of weakness appeared. Aztec Connect, shut down for three years, was also exploited twice by different attackers within five days.
Cryptographic exploits are materially more complex than ordinary business-logic bugs and have historically taken specialist researchers weeks to understand and reproduce. The appearance of copycats within five days suggested that the spread of exploit knowledge was speeding up. UCL’s paper also found that success rates for immediate exploitation after public disclosure ran as high as 86% to 89%, then dropped to 6% to 21% a week later.
For projects without real-time monitoring, that kind of window can be fatal.
AI is widening the target set, including closed-source and abandoned contracts
Yuannan Yang said exploit chains tied to cryptographic implementations are, in technical terms, more complex than conventional accounting-style bugs once code volume and mathematical operations are taken into account.
He said AI can process decompiled code and even raw bytecode, infer a protocol’s core logic without high-level semantic information and identify vulnerabilities. “With AI’s assistance, attackers can learn these exploit mechanisms in just a few days, locate new vulnerable contracts and apply new attack techniques,” he said.
Contracts without public source code were once close to black boxes for attackers. Yang said attacks against that category were growing quickly: 19 out of 186 exploit cases in the first half of 2025, 17 out of 176 in the second half of 2025 and 37 out of 257 in the first half of 2026.
That shift has exposed a batch of abandoned contracts that still hold funds. More than 1,400 positions were drained from DxSale’s old lockup contracts, and Truebit contracts that had gone unmaintained for three years were attacked as well. Those teams had already disbanded, the contracts were not upgradeable and no one was left to patch them.
Yang said it remained difficult to quantify exactly how much AI was participating in real-world attacks in 2026 compared with the prior two years, whether measured by time from discovery to exploitation or by level of automation. In many incidents, the attacker was the first to find the vulnerability and may have been the only party aware of that window. Even so, he said this year had produced unprecedented examples showing how quickly attackers were learning and deploying new attack vectors.
SlowMist said AI-assisted attacks had already become fairly common, especially during social engineering and preparation. The firm said it had seen AI used to generate phishing pages, fake websites, recruitment materials, scripts for social engineering and malicious code, making lures more realistic and more personalized. In some public attack samples, traces of AI-generated content were visible. Deepfake voice and video were also beginning to appear in social engineering campaigns aimed at high-value targets.
One of the clearest public examples, the report said, was a fake hiring campaign run by HexagonalRodent, an organization linked to Lazarus Group. The attackers used AI tools including ChatGPT and Cursor to build fake corporate websites, recruitment materials and communications, and to generate part of the code. The campaign then used high-paying job offers to lure Web3 developers into installing malware or disclosing sensitive information.
The rise of AI coding among developers is also creating new openings. In May, Socket.dev disclosed a supply-chain poisoning campaign across npm, PyPI and Crates.io called TrapDoor. The operation involved more than 34 malicious packages and 384 released versions, targeting developers working in cryptocurrency, DeFi, Solana, AI and security.
The attackers used each ecosystem’s native execution path to trigger malicious logic automatically during installation or compilation, including npm postinstall hooks, PyPI import entry points and Crates.io build.rs scripts. The goal was to steal SSH keys, blockchain wallet configurations, cloud credentials and browser sessions.
The structural imbalance is simple: attackers need one opening, defenders have to cover every surface. Both sides are moving faster, but the attacking side starts with the edge.
The biggest weakness remains the human layer
Over the past few years, DeFi has built a relatively mature code-security industry. Projects commonly run smart contract audits, fuzz testing and formal verification before launch, then rely on bug bounties and onchain monitoring afterward. Capital has gone heavily into preventing code failures. Yet even with AI reshaping that workflow, the report said asset safety often still comes down to a handful of people and a handful of processes.
CertiK data showed phishing incidents fell 52.3% year over year in H1 2026, which looked positive on the surface. Losses, however, declined only 10.8%, suggesting attacks were concentrating into fewer but higher-value targets.
Yang said these operations differ from traditional mass phishing. Attackers identify high-value wallets in advance, conduct background reconnaissance and tailor the lure to the target. If a wallet holds hundreds of millions of dollars, spending weeks on one person makes economic sense from the attacker’s perspective.
Drift Protocol was the clearest example. In the fall of 2025, a group claiming to represent a quantitative trading firm began interacting with the Drift team. They spent more than $1 million trading on the platform, took part in community discussions and used six months to build trust. On April 1, 2026, they persuaded a multisig signer to pre-sign hidden authorization within what appeared to be a normal transaction.
Roughly $285 million in user assets was drained in 12 minutes.
The post-incident investigation attributed the attack to UNC4736, which the report described as a threat group linked to the North Korean government. According to the report, the group has targeted cryptocurrency and fintech since 2018 through supply-chain attacks, social engineering and malware delivery. Known large incidents tied to the group include the 2023 3CX supply-chain attack, the roughly $50 million Radiant Capital theft in 2024 and the roughly $285 million stolen from Drift. Based on countable public figures, the report put the group’s cumulative theft at about $335 million.
Drift was an extreme social-engineering case, but operational security failures took many forms in H1. Attackers in the Kelp DAO case breached third-party RPC infrastructure relied on by the project and moved about $291 million by forging cross-chain message validation. Resolv Labs had completed 18 security audits, yet still lost about $26.85 million after its AWS cloud key management service was compromised. In mid-July, Ostium lost more than $23.75 million after an administrator private key was exposed, allowing hackers to breach offchain infrastructure tied to the protocol’s pricing system.
Social engineering, infrastructure breaches, cloud key leaks and exposed code repositories have expanded the attack surface to nearly every point where people are involved.
SlowMist, which has tracked North Korea-linked threat groups for years, said it had observed a clear tactical shift. Social engineering was moving away from quick privilege grabs toward long-term trust cultivation, with longer attack cycles, heavier resource commitments and stronger concealment.
The crypto industry still lacks a universal operational security standard, the firm said. Many teams continue to treat security as a one-time code audit before launch while underinvesting in key management, permission isolation and staff awareness. Some mature projects have built stronger systems, but many smaller teams still lack even basic multisig setups and key rotation.
SlowMist said key management should sit at the top of the minimum standard for DeFi operational security. Critical assets and admin authority should use multisig architecture, supported by defined procedures for key generation, storage, backup and rotation. “Operational security is, at its core, also about human security. The most fundamental change in Web3 security in the first half was that the center of gravity in attacks moved from finding code bugs to breaking people and processes,” the team said. With social engineering continuing to evolve, projects need recurring security training and attack-defense drills so staff can better identify phishing and AI-generated attack content.
CertiK has already turned that line of work into a standalone OpSec audit service covering key management architecture, multisig configuration and employee device security policies, along with authorized phishing simulations and incident response drills. Yang said demand from projects for those services was continuing to rise.
The security industry itself is being reshaped
As the main battlefield moves from code to operations, the broader security stack built around code audits is being reassessed.
Analysis from security research group SigIntZero found that 89.2% of attacked projects had previously been audited. Hacken’s Q1 report also said at least six audited protocols were successfully attacked in the first half, including Resolv Labs, which had undergone 18 audits while the exploited weakness sat outside the areas those audits covered.
Both organizations interviewed by Foresight News pointed to the same direction: move beyond one-off reviews and toward continuous security operations. That means minimizing critical privileges, using multiple signers, setting onchain limits for minting and withdrawals, maintaining continuous monitoring with automatic pause mechanisms and reviewing every code change as it happens.
That upgrade costs money. Many projects are already struggling to survive in a bear market. In February 2026, decentralized lending protocol Zerolend announced that it was shutting down. The report described its condition as broad-based financial bleeding: declining liquidity, lost oracle support, compressed lending profitability and rising security pressure all at once.
Yang said, “As revenue and liquidity fall, the cost of audits, bug bounties, monitoring and incident response becomes harder to sustain. Projects cut spending, operate without coverage and even migrate onchain deployments. That silently amplifies security risk. Then an attack happens, the gap can’t be closed, and the project finally shuts down.”
The bear market is also pushing the security industry into a sharper split. Institution-grade projects are increasing security spending under heavier attack pressure and compliance demands, and are more likely to embed audits directly into the development cycle. Small and midsize projects face the opposite situation: thin liquidity, harder fundraising and security budgets that are often among the first to be reduced. Demand for audits from new projects has slowed as well.
SlowMist said market cycles do affect demand for security services, though mostly through a shift in the structure of that demand. In bear-market conditions, for example, demand for audits from new projects tends to soften. Cash-constrained startups may reduce or delay audits, or pick cheaper and smaller audit firms, though some teams also use the downturn to build.
When a project is attacked, the first response is usually to establish the current state and the blast radius as quickly as possible: whether the attack is still ongoing, which systems or contracts are affected and how much money has been lost. Teams then take emergency steps based on that assessment, such as restricting risky operations, changing permissions, protecting remaining assets and coordinating analysis with internal staff and external security firms.
Preparedness still varies widely. Some mature teams have monitoring, alerting, response procedures and coordination mechanisms in place before an incident. Others only start building those systems after they are attacked.
Old problems are returning at a new scale
Phishing, social engineering and key leakage are not new to crypto. What changed in the first half of 2026, according to the report, was the economics behind them. AI has reduced both the cost and the barrier to attack. Once attacks become cheaper, old weaknesses can reappear more often and at larger scale.
Key storage, cloud permissions, employee awareness and third-party dependencies now sit squarely inside the security perimeter. Protecting code alone is no longer enough. The industry is moving from code audit toward full-stack defense, and the speed of that transition may shape how many familiar weaknesses return in the second half, only with bigger consequences.