Blockchain intelligence firm TRM Laboratories It published its analysis of cryptocurrency attacks and exploits in the first half of 2026, painting a picture of increased activity alongside decreasing financial impact. There were a record 207 separate incidents during this period (the highest number in any six-month period tracked by the firm) but total losses reached only $972 million.
Accordingly opinions According to information from TRM Labs, this figure represents less than half of the $2.3 billion stolen in the same period of 2025.
The increase in incidents reflects a clear shift towards smaller-scale attacks.
Typical to cut While the average resulted in a loss of $219,000, the average (average) was around $4.7 million, heavily impacted by a handful of major breaches.
123 incidents were recorded in the second quarter alone, setting a new record for a three-month period and continuing a steady upward trend throughout the first half of the year.
Smart contract exploits accounted for the majority of incidents, with 125 cases targeting decentralized finance protocols, exchanges, and token projects.
These attacks often involved complex combinations of manipulation rather than isolated coding errors.
Backwards, infrastructure and operational risks (such as breaches involving private keys, credentials, or signing systems) accounted for only 15% of cases but caused 76% of all losses.
A single incident of physical force, sometimes called a “wrench attack,” added nearly $24 million to the totals.
Two major incidents in April marked the casualty figures and were attributed to North Korea-linked actors.
Drift Protocol The breach resulted in the theft of approximately $285 million, while the KelpDAO exploit led to losses of approximately $292 million.
These events totaled approximately $577 million; this accounted for almost 59% of all funds received in the first half of 2026.
TRM Labs considered both to be complex, state-directed operations involving infrastructure compromises rather than opportunistic smart contract flaws.
north korea The groups overall were linked to losses of approximately $643 million, or 66% of the first half total; This rate was lower than 74% in the first half of the previous year.
The low overall losses despite the record number of attacks is largely due to the fact that there has not been a single theft on the scale of 2025’s biggest cases. Losses were concentrated in April due to two major North Korea-related breaches, while other months saw more modest numbers.
Expanding ecosystem DeFi Protocols, tokens, and smart contracts have expanded the attack surface, enabling more frequent but generally smaller exploits.
TRM Labs states that the underlying conditions in 2025 remain. Both large-scale threats infrastructure The rising tide of compromises and smaller smart contract attacks is expected to continue shaping the landscape.
The firm emphasizes that organizations must prioritize comprehensively smart contract robust infrastructure protections as well as controls, including secure key management, multi-party approval processes for critical transfers, and comprehensive incident response planning.
Monitoring and monitoring of multi-hop transactions over cross-chain bridges for compliance teams decentralized Swap services continue to be critical for tracking stolen funds.
The report underlines that the decrease in total stolen value should not be interpreted as a decrease riskBecause its offensive capabilities remain strong and the potential for devastating single events remains.
first half 2026 highlights An evolving threat landscape where the volume of attacks is rising to unprecedented levels and overall financial damage is decreasing. Crypto projects and platforms are advised to be careful both technically and operationally security As the ecosystem grows, layers form.
