TRM Labs, a blockchain security firm, reported 207 crypto hacking incidents in the first half of 2026; this was the highest number in any six-month period. The majority of crypto hacking incidents occurred in the second quarter (126 incidents), led by KelpDAO, Humanity, and Rhea Lend exploits.
85 crypto hacking incidents were reported in the first half of 2025. In other words, the first half of 2026 has seen more than double the number of crypto hacking cases in the same period. according to reportThe majority of attacks were smart contract exploits, accounting for 125 of the 207 incidents: a 60% dominance share of breaches.
Commenting on the same, Ari Redbord, head of global policy at TRM Labs, told AMBCrypto:
What concerns me most is how concentrated these losses are from infrastructure failures. Three-quarters of the stolen value did not result from smart contract errors but from compromise of keys, storage systems, and signing infrastructure.
He concluded:
The industry has improved in auditing code, but our operational security has not kept pace with our on-chain complexity.
North Korea-linked actors carry out 66% of crypto attacks
Despite the record number of breaches, the total value stolen in 2026 was relatively small compared to 2025.
The report stated that 972 million dollars were lost as of June, which is less than half of the approximately 2.3 billion dollars lost in the same period of 2025. Yet 66% of stolen funds are North Korea affiliated organizations.
By the end of the second quarter of 2026, North Korea-linked attackers’ share of stolen crypto funds was over 75%. However, the intensified activities of other organizations during the quarter reduced the dominance of these organizations to 66% at the time of writing. The impact of the attacks was more devastating for the DeFi industry. wider in the middle feeling of declineIntensifying crypto hacks have further alienated investors from the DeFi sector.
In fact, in the $293 million hack of KelpDAO, the attacker used fake tokens, deposited them into the Aave lending protocol, and borrowed $190 million in legitimate assets (wETH). As investors feared the worthless collateral deposited by the attacker, Aave experienced a sudden liquidity crisis and subsequent bank run. In conclusion, Aave pools have reached full capacity, preventing some late depositors from withdrawing their funds.
This has increased broader DeFi security risk, which has triggered $55 billion in capital outflows in the first half of 2026. At the time of this writing, total DeFi TVL (total value locked) has increased from $120 billion seen at the beginning of 2026 to $70 billion, a two-year low.
Final Summary
- Crypto hacking cases reached a record high of 207 in the first half of 2026, but the value stolen was less than $1 billion
- North Korea-based threat actors accounted for $643 million, or 66% of stolen funds, during the same period.
