
Blockaid reports $1B lost to crypto hacks in H1 2026, already surpassing 2025's full-year incident count. North Korea-linked groups lead via social engineering and multisig compromises.
Onchain security firm Blockaid said Tuesday that hackers stole more than $1 billion from crypto projects in the first half of 2026. The six-month total already exceeds the number of verified exploit incidents recorded across all of 2025, the company's H1 report shows.
North Korea-linked actors drove the financial losses, using social engineering and multisig key compromises to hit protocols including Drift and KelpDAO. Ethereum and Solana accounted for the bulk of the damage, with $332 million and $326 million stolen on each network respectively. Smart contract exploits were the main vector on Ethereum, while Solana suffered from signer infrastructure flaws, Blockaid said.
The $1 billion figure is a new high for a six-month period, the report noted. The previous record for a full year was set in 2025, and the current pace suggests 2026 could double that total if the second half follows the same trajectory.
Blockaid projected a surge in attacks targeting artificial intelligence agents and autonomous solutions in the second half of the year. The firm warned that projects will need to strengthen code audits and custody setups to keep pace with increasingly sophisticated threats.
The report comes as the broader crypto security landscape faces mounting pressure. A separate incident last week saw Russian exchange Grinex suspend trading after a $13 million hack. Poland detained four individuals over SIM-swap attacks linked to crypto theft, with onchain investigator ZachXBT connecting one suspect to a known threat actor. Injective said it blocked an npm supply chain attack before any funds were compromised.
The Blockaid data covers verified onchain exploits only and does not include losses from rug pulls, phishing campaigns, or centralized exchange hacks, which would push the total significantly higher.
Prepared with AlphaScala editorial tooling from the source reporting linked above. Indexable analysis may include a cited Alpha Score value. Publishing checks screen each story before release. Educational coverage, not personalized advice.