Blockaid reported a staggering 212 crypto hacks in the first half of 2026, marking the highest number of attacks ever recorded in any six-month span. The total amount stolen exceeded $1.1 billion, with North Korea-linked threat actors responsible for the largest single losses. the $292 million breach at KelpDAO and the $285 million exploit at Drift Protocol both trace back to DPRK groups, highlighting a shift in attack vectors.
Ido Ben-Natan, Blockaid's CEO, revealed on X that operational security failures are now the main culprit behind the majority of thefts. Approximately 74% of stolen funds were lost through compromised keys, signing infrastructure, and privileged access, rather than through vulnerabilities in the underlying smart contract code. This contrasts with previous years when code bugs were the primary source of exploitation.
The KelpDAO incident on April 18 saw a compromised LayerZero verifier network approve a malicious bridge transaction, draining over a quarter of KelpDAO's total value locked. Similarly, Drift Protocol suffered a $285 million loss in under 12 minutes due to a governance-layer key compromise. Ethereum and Solana networks bore the brunt of these attacks, with $332 million and $326 million lost respectively. While Ethereum's losses mostly stemmed from code-based exploits, Solana's were dominated by key and signing infrastructure breaches.
North Korea-linked groups, especially Lazarus' TraderTraitor faction, accounted for roughly 55% of all losses in H1 2026, totaling about $609 million. The trend shows no sign of slowing, with several exploits continuing into the latter half of the year. This rise in operational security attacks shows the increasing sophistication and persistence of these threat actors.
Markets reacted cautiously, with crypto prices experiencing mild volatility amid the wave of security breaches.
This content is for informational purposes only and should not be considered financial advice.
