According to TRM Labs, the first half of 2026 saw 207 separate crypto hacks, the highest number recorded in any six-month period. However, total losses reached only USD 972 million, less than half of the USD 2.3 billion stolen during H1 2025. The average hack resulted in losses of about USD 219,000. The increase in incidents was driven primarily by smart contract exploits targeting DeFi protocols, decentralized exchanges, and token projects, which accounted for 125 of the 207 incidents. Despite their frequency, these exploits contributed only a small share of total losses. In contrast, infrastructure and operational compromises represented only about 15% of incidents but accounted for roughly 76% of total losses, largely due to two North Korea-linked attacks in April on Drift Protocol (~USD 285M) and KelpDAO (~USD 292M), together totaling approximately USD 577 million. TRM assesses that about USD 643 million (66% of all stolen funds) is attributable to North Korea-linked activity. The data reveals two distinct threat patterns: a small number of large-scale infrastructure compromises driving the majority of financial losses, and a growing stream of smaller smart contract exploits increasing incident counts. The conditions that produced record losses in 2025 remain, suggesting both threats will persist.

Key facts

• 207 hacks in H1 2026, highest ever, but losses fell to $972M from $2.3B in H1 2025.
• Smart contract exploits made up 125 of 207 incidents but only a small share of losses.
• Two North Korea-linked attacks (Drift & KelpDAO) in April stole ~$577M combined.
• Infrastructure compromises were 15% of incidents but caused 76% of total losses.
• North Korea-linked activity accounted for ~$643M (66%) of all stolen funds.