Blockchain intelligence firm TRM Labs has released its analysis of cryptocurrency hacks and exploits during the first half of 2026, painting a picture of heightened activity alongside reduced financial impact. The period saw a record 207 distinct incidents—the highest count in any six-month span tracked by the firm—yet total losses reached only $972 million.
According to insights from TRM Labs, this figure represents less than half the $2.3 billion stolen in the same period of 2025.
The surge in incidents reflects a clear shift toward smaller-scale attacks.
The typical hack resulted in median losses of roughly $219,000, while the average (mean) stood at about $4.7 million, heavily influenced by a handful of large breaches.
The second quarter alone recorded 123 incidents, setting a new quarterly high and continuing a steady upward trend throughout the first half of the year.
Smart contract exploits accounted for the majority of incidents, with 125 cases targeting decentralized finance protocols, exchanges, and token projects.
These attacks often involved sophisticated combinations of manipulations rather than isolated coding errors.
In contrast, infrastructure and operational compromises—such as breaches involving private keys, credentials, or signing systems—represented just 15% of incidents but drove 76% of all losses.
A single physical coercion incident, sometimes called a “wrench attack,” added approximately $24 million to the totals.
Two major events in April dominated the loss figures and were attributed to North Korean-linked actors.
The Drift Protocol breach resulted in roughly $285 million stolen, while the KelpDAO exploit led to approximately $292 million in losses.
Together, these incidents accounted for about $577 million—nearly 59% of all funds taken in the first half of 2026.
TRM Labs assessed both as sophisticated, state-directed operations involving infrastructure compromises rather than opportunistic smart contract flaws.
North Korean groups overall were linked to around $643 million in losses, or 66% of the H1 total, down from 74% in the prior year’s first half.
Despite the record volume of attacks, the lower overall losses stem largely from the absence of any single theft on the scale of 2025’s largest incidents. Losses were heavily concentrated in April due to the two major North Korean-linked breaches, while other months showed more modest figures.
The expanding ecosystem of DeFi protocols, tokens, and smart contracts has broadened the attack surface, enabling more frequent but generally smaller exploits.
TRM Labs notes that the underlying conditions from 2025 persist. Both the threat of large-scale infrastructure compromises and the rising tide of smaller smart contract attacks are expected to continue shaping the landscape.
The firm emphasizes that organizations should prioritize thorough smart contract audits alongside robust infrastructure protections, including secure key management, multi-party approval processes for significant transfers, and comprehensive incident response planning.
For compliance teams, monitoring multi-hop transactions across cross-chain bridges and decentralized swap services remains critical for tracing stolen funds.
The report underscores that a decline in total stolen value should not be interpreted as reduced risk, as attacker capabilities remain strong and the potential for catastrophic single incidents continues.
The first half of 2026 highlights an evolving threat environment where volume of attacks has climbed to unprecedented levels while aggregate financial damage has moderated. Crypto projects and platforms are advised to maintain vigilance across both technical and operational security layers as the ecosystem grows.