.png){kind=logo}
Crypto projects lost more than $1 billion across 212 hacks during the first half of 2026, according to Blockaid. The firm called it the most-hacked half-year on record by incident count. Blockaid verified 3.4 times as many high-threshold exploits over six months as it did throughout 2025. However, total losses stayed below the previous year’s figure.
A $1.5 billion attack on Bybit pushed 2025 losses to $2.58 billion across 63 incidents. By contrast, 2026 produced more frequent attacks but smaller average thefts.
North Korea-linked hackers accounted for almost $600 million in stolen funds. Blockaid tied two major April attacks to those groups. The Drift Protocol exploit caused $285 million in losses, while the KelpDAO attack removed $292 million. Together, they represented more than half of the half-year total.
Attackers drained Drift in about 12 minutes after compromising multisig signers. Blockaid linked that breach pattern to LinkedIn social engineering aimed at key holders. The report said the same method produced two of the four largest incidents. It also found no structural reason for attackers to stop using it.
Ethereum projects lost $332 million, while Solana projects lost $326 million. Those figures placed both networks ahead of every other blockchain in total losses. Code exploits caused most Ethereum incidents. Blockaid said attackers targeted Ethereum because it hosts high-value restaking platforms, stablecoins, and decentralized exchanges.
Solana’s losses rose sharply from about $127 million in 2025. Key breaches and signing infrastructure failures caused more than 98% of its losses.
Also Read: Crypto Hack Losses Fall 7% in June as Humanity Protocol Leads With $36M Breach
Blockaid expects more AI agent exploits during the second half of 2026. The firm identified a $216,000 Bankr incident as the first exploit of its kind. AI agent deployment is expanding about tenfold each year, according to the report. Blockaid expects prompt injection to lead to attack methods, followed by abuse of connected tools.
Can security controls keep pace as attack frequency rises and AI agents spread? Recovery efforts at Drift and KelpDAO show the operational burden after major breaches. Drift proposed a recovery pool with exchange revenue and support from partners, including Tether. The plan includes up to $127.5 million and requires audits, dedicated signing devices, and a redesigned multisig.
KelpDAO completed the operational phase of its recovery plan on May 25. It resumed minting and redemptions, while litigation over frozen funds continued. Meanwhile, a wallet tied to the Drift exploiter moved 23,095.1 Ether into Tornado Cash between July 23 and July 24. The transfer carried an estimated value of $44.4 million. The report now points to AI agents, signer security, and prompt injection as key risks for the second half.
