Crypto Hacks Hit Record 207 in H1 2026, but Losses Tell a Different Story

The first half of 2026 saw a record-breaking 207 cryptocurrency hacking incidents, according to blockchain security firm TRM Labs. Yet the headline number masks a more nuanced picture: total losses across all breaches reached only $972 million, and the average loss per incident has declined compared to previous periods. The data suggests the crypto industry is winning on defense, even as attackers are becoming more prolific.

The 207 incidents represent a significant jump in attack frequency. Smart contract exploits dominated the attack surface, accounting for 125 of the 207 cases (60%). These are vulnerabilities in the code of decentralized applications and protocols that allow attackers to drain funds directly from blockchain-based systems. Despite representing the majority of incidents, smart contract exploits generated only a fraction of total stolen funds, indicating that most of these attacks targeted smaller protocols or generated minimal returns for attackers.

This divergence between incident count and total losses points to a structural shift in the threat landscape. Rather than pursuing single, high-value heists like the 2022 Ronin Bridge hack (which netted $625 million), attackers are now casting wider nets with lower-value exploits. The shift reflects both improved security practices across the industry and a growing recognition among attackers that massive, high-profile targets now have robust defenses. Smaller protocols, by contrast, often lack the resources for comprehensive audits and real-time monitoring.

The North Korean threat remains disproportionately significant. Entities linked to North Korea accounted for approximately $643 million of the $972 million in total losses (66%), cementing the country's position as the crypto market's biggest adversary. This aligns with years of documented state-sponsored activity, including operations attributed to the Lazarus Group, the cybercriminal unit believed to be affiliated with North Korea's government. Unlike scattered opportunistic hackers, North Korean operations are well-funded, highly coordinated, and explicitly targeting crypto assets to circumvent international sanctions.

The concentration of losses in North Korean attacks suggests that most of the 207 incidents were relatively low-value exploits. If North Korea accounted for $643 million of the $972 million total, the remaining incidents generated only $329 million combined. This implies that the average non-North Korean hack stole far less than the $4.7 million average across all incidents. Many smart contract exploits likely yielded five or six figures, not millions.

Several factors explain the record incident count despite declining average losses. First, improved detection and reporting mechanisms mean more breaches are now being caught and documented. Security firms have expanded their monitoring capabilities, and exchanges and protocols are more transparent about disclosing incidents. Second, the proliferation of DeFi protocols has expanded the attack surface exponentially. There are now thousands of smart contracts deployed across Ethereum, Solana, Arbitrum, and other blockchains, each a potential target. Third, automation tools and exploit templates have lowered the barrier to entry for attackers, enabling less sophisticated actors to attempt breaches.

The data also reflects successful incident response and mitigation. The fact that smart contract exploits represent 60% of incidents but generate minimal losses suggests the industry is rapidly patching vulnerabilities once they're discovered. Many exploits are caught and contained before attackers can extract significant value. Protocols are increasingly using bug bounty programs, formal verification, and multi-signature controls to prevent large-scale theft. These measures appear to be working.

However, the North Korean concentration reveals a critical gap. While the industry has improved defenses against opportunistic hackers and low-skill attackers, state-sponsored actors with advanced capabilities remain a persistent threat. North Korea's focus on crypto theft reflects its isolation from traditional financial systems and its need for hard currency to fund its weapons programs. As long as that incentive exists, the country will continue targeting crypto with sophisticated, well-resourced operations.

For the broader market, the H1 2026 data offers cautious optimism. A record number of incidents sounds alarming, but it reflects the industry's expanding surface area and improving transparency rather than a collapse in security. Average losses per incident declining despite record incident counts suggests that defensive measures are outpacing offensive capabilities for most actors. The real concern is not the 207 incidents or the $972 million in total losses, but the $643 million stolen by North Korea and the likelihood that state-sponsored actors will continue evolving their tactics. Until crypto's regulatory and technical defenses can meaningfully impede nation-state operations, that threat will remain the market's most serious vulnerability.