In the first half of 2026, hackers stole approximately $940 million from cryptocurrency projects, with a significant majority of these losses stemming from vulnerabilities that security audits failed to cover. According to data compiled by security research house ack3, 94.4% of the stolen funds originated from code or infrastructure that was not examined during audits.
Across the first six months of the year, 135 exploits were verified, resulting in an average loss of $6.96 million per incident. The findings highlight a critical gap between the perceived security offered by audits and the actual protection they provide against prevalent threats.
Key Attack Vectors Beyond Smart Contracts
Many of the most substantial losses were not due to complex smart contract bugs, but rather compromised private keys and social engineering tactics. Two major incidents alone accounted for $577 million, or roughly 61% of the total losses. In April, Kelp DAO’s rsETH lost $292 million after attackers forged a LayerZero cross-chain message by compromising the protocol’s message verifier. Shortly before that, Drift lost $285 million when operatives, linked by researchers to North Korea, successfully compromised admin keys through social engineering.
This pattern of compromised keys and signing infrastructure also affected other projects. Step Finance reported losses of $40 million, Humanity Protocol lost $32 million, and Resolv’s USR stablecoin saw $24.5 million drained. Cross-chain bridges also remained a significant target, with Verus losing $11.5 million, Syscoin $8 million, and Taiko $1.7 million.
Even established projects were not immune. Polymarket experienced two separate incidents in May and June, including a $700,000 internal wallet drain and a $3.1 million front-end supply-chain attack. The MEV bot jaredfromsubway.eth was also exploited for $7.5 million by a honeypot token.
Projects that had not undergone audits also suffered considerable losses. Truebit, for instance, lost $26.4 million due to an integer-overflow error in its mint pricing.
Outdated Audits and Limited Scope
Furthermore, the timeliness and scope of existing audits were frequently insufficient. Ack3 reported that 17 of the 20 nearest relevant audits were at least six months old by the time the attacks occurred. Josef Gattermayer, CEO and Founder of ack3, stated that “‘Audited’ is a marketing word until you ask three questions: what exactly was reviewed, how long ago, and who controls the keys today.” He added, “The auditors can read every line of the code. They can’t read the developer’s mind when clicking a link from ‘HR’.”
The analysis by ack3 underscores that while audits may examine code, they often fail to address the human element, key management, and the broader infrastructure that attackers exploit. The significant financial losses in the first half of 2026 serve as a stark reminder of the ongoing security challenges within the cryptocurrency ecosystem.
Why This Matters
The materials describe a narrow update: In the first half of 2026, hackers stole approximately $940 million from crypto projects. The exact identity of all hackers involved.
Broader Context
Source materials place the factual news in this context: Crypto investors were fleeced of almost a billion dollars in the first half of 2026, and the industry’s favorite comfort blanket did little to stop it.
Leave a Reply