Crypto Hacks Hit Record 207 Cases in H1 2026, But Losses Decline: TRM Labs

Despite the increase, financial losses remained well below 2025 levels. Total stolen funds reached $972 million compared with $2.3 billion during the first half of last year. TRM Labs said the median loss from a hack stood near $219,000. Thousands of DeFi applications and smart contracts continue to create new opportunities for attackers.

Two distinct patterns explain the divergence. Infrastructure compromises made up roughly 15% of incidents but generated around 76% of total losses. TRM Labs said these breaches targeted signing systems, credentials, and asset control infrastructure rather than vulnerabilities in on-chain code. Smart contract exploits made up most incidents but contributed a much smaller share of stolen funds.

North Korea-linked activity dominated the loss side. TRM Labs attributed about $643 million of stolen funds to North Korea-linked activity, roughly 66% of all losses recorded during H1 2026. Nearly all of those losses came from two April attacks. The breaches targeted Drift Protocol and KelpDAO and resulted in combined losses of about $577 million. The Drift Protocol incident accounted for approximately $285 million in losses. The KelpDAO exploit added another $292 million, according to TRM Labs.

The report also identified other attack types during the period. One physical coercion incident, commonly called a wrench attack, resulted in losses of around $24 million.

TRM Labs said organizations should continue auditing smart contracts while strengthening key management systems and transfer approval procedures. The firm also noted that major infrastructure compromises continue to define annual crypto theft totals even when smaller exploits occur more frequently.