Crypto Exploits Reach Record High in First Half of 2026, $1.1 Billion Stolen
The first six months of 2026 have marked the most active period for cryptocurrency exploits on record, with hackers pilfering $1.1 billion across 212 incidents, according to a new report from Blockaid.
Major Incidents Drive Significant Losses
Four substantial exploits involving KelpDAO, Drift, Resolv, and CoW Swap accounted for approximately $707 million of the total losses. KelpDAO experienced the most significant single loss, with hackers stealing $292 million in cryptocurrency by fabricating a cross-chain message that drained the protocol’s Ethereum reserves. Drift Protocol, a perpetuals exchange operating on the Solana chain, also sustained a major blow, losing $285 million in a mere 12 minutes.
North Korean Nexus Identified
Blockaid has linked both the KelpDAO and Drift Protocol incidents to TraderTraitor, a state-sponsored North Korean faction operating under the broader Lazarus Group. The theft of $32 million from Humanity Protocol was also attributed to this same attacker cluster, bringing the total losses linked to North Korea to $609 million, representing about 55% of all funds stolen during the period.
Escalating Attack Frequency
The pace of attacks accelerated throughout the first half of the year, with monthly incidents increasing from 18 in January to 57 in June. April proved to be the most devastating month, as the KelpDAO and Drift Protocol hacks alone resulted in a combined loss of $577 million, pushing the total for that month to $635 million.
Privileged Key Misuse Dominates Costly Attacks
Privileged key misuse emerged as the most financially damaging attack vector in the first half of 2026, with losses reaching an estimated $790 million, or nearly three-quarters of all funds stolen during the period, Blockaid reported. Unbacked mint exploits ranked second in terms of value, highlighted by the $80 million breach at Resolv. However, code-level hacks were the most frequent, responsible for nearly four out of every five attacks by count.
AI Agents Emerge as New Targets
Artificial intelligence agents have become a new frontier for attackers. In May, hackers employed a prompt injection attack to trick Bankr’s AI agent into authorizing an unauthorized transaction valued at approximately $216,000.
Cross-Chain Bridges Under Siege
Cross-chain bridges also faced significant challenges, with attackers compromising the verification systems of KelpDAO and Taiko by submitting forged proofs and attestations that were accepted by the destination chains.
Evolving Attack Methods
Security teams encountered novel attack methodologies in 2026. Blockaid identified four incidents involving EIP-7702 wallet delegation attacks, a technique where a wallet can transfer control to a smart contract. Legacy smart contracts continue to present a persistent vulnerability, with data indicating around five such cases in May and June, including two targeting Aztec Connect and one affecting Raydium’s AMM V3.
Continued Pressure on Crypto Infrastructure
Recent incidents occurring outside the reporting period underscore the ongoing pressure on crypto infrastructure. On July 23, AFX Trade, BSquaredNetwork, and Verus were targeted in separate attacks on the same day, collectively resulting in losses exceeding $35 million. Verus had previously experienced another exploit approximately two months prior, with Blockaid linking both incidents to the same bridge contract and bug class.
Recovery Varies by Attack Type
The success of fund recovery differed based on the nature of the attack. According to the report, code-related incidents sometimes enabled security teams to freeze assets or negotiate their return. In contrast, attacks involving compromised keys typically resulted in funds being laundered through mixers or routed across different blockchains.
Leave a Reply