Crypto▼ Bearish
Crypto security losses hit $1.1B in H1 2026, Blockaid report says
Blockaid verified 212 crypto security incidents in H1 2026 totaling $1.1B. Operational attacks drove 74% of losses; a DPRK-linked cluster accounted for 55%. Drift and KelpDAO recovery plans are next catalysts.
Continue with
Crypto security losses reached $1.1 billion across 212 verified incidents during the first half of 2026, according to an H1 report published by Blockaid on July 28.
Blockaid called the six-month incident count a record and said it verified more exploits during the first half than it did across all of 2025. Operational security attacks produced 74% of the stolen value. One cluster linked to the Democratic People's Republic of Korea accounted for 55% of the total, the security firm said.
The incident count was 3.4 times the 2025 full-year number, Blockaid said. Security companies use different definitions and coverage methods when compiling industry loss estimates, so comparisons across reports need to account for those differences.
Blockaid's numbers reflect a shift away from attacks that rely only on faulty smart-contract code. Compromised devices, privileged credentials, private keys, signing systems and off-chain infrastructure generated most of the measured losses. These attacks can produce valid-looking blockchain transactions because authorized credentials approve them.
That pattern limits the protection code audits can provide. Audits identify contract flaws. They cannot stop a compromised administrator from signing a malicious transaction or prevent a bridge verifier from relying on poisoned infrastructure, Blockaid said. New attack vectors emerged during the first half, the firm said, and some could expand during the second half.
Ethereum-related projects lost about $332 million, according to Blockaid's report. Code vulnerabilities accounted for much of that total. The largest Ethereum-linked case was KelpDAO, where attackers released 116,500 rsETH worth roughly $292 million from a bridge contract after falsifying a source-chain message.
Chainalysis linked the April 18 KelpDAO attack to North Korea's Lazarus Group. Its investigation found that attackers compromised internal RPC nodes and disrupted external nodes, causing a single-verifier system to accept a false burn event. The Ethereum-side bridge then released rsETH even though no corresponding tokens had been destroyed on the source chain.