The cryptocurrency industry recorded 207 hack incidents in the first half of 2026, the highest six-month count ever tracked, according to Immunefi's H1 report published in early July. Total losses reached $972 million — below the symbolic $1 billion threshold and less than half the H1 2025 figure...
"Discovery scales faster than responsibility. That single asymmetry is driving a crisis that will reshape how the internet is secured, or left exposed." — Mitchell Amador, CEO, Immunefi
The cryptocurrency industry recorded 207 hack incidents in the first half of 2026, the highest six-month count ever tracked, according to Immunefi's H1 report published in early July. Total losses reached $972 million — below the symbolic $1 billion threshold and less than half the H1 2025 figure. The paradox is structural: attacks are more frequent but individually less destructive, with median losses per hack falling 75% from $6 million in 2022 to $1.5 million in 2025-era ranges. The improvement is real, but it masks a more consequential shift: the threat has moved from smart contract bugs to infrastructure failures, private key compromises, and state-sponsored social engineering campaigns that no code audit can prevent.
Two incidents define the period. North Korea's Lazarus Group drained $285 million from Solana's Drift Protocol in April after a six-month social engineering operation that culminated in 12 minutes of execution. Days later, attackers exploited KelpDAO's LayerZero bridge — configured with a single verifier — for $292 million, triggering a $13 billion withdrawal cascade across DeFi. Together, these two DPRK-attributed attacks accounted for roughly 60% of H1 losses. Chainalysis attributes 76% of all crypto hack losses in 2026 to state-backed actors linked to North Korea's Reconnaissance General Bureau.
The security industry is consolidating in response. Code4rena, the competitive audit platform backed by Paradigm, shut down in May; Immunefi absorbed its clients and researchers. Immunefi now protects over $180 billion in assets across 650+ protocols, paid researchers $13.45 million in H1, and claims to have prevented $25 billion in cumulative losses. CEO Mitchell Amador warns of a "vulnerability apocalypse" — AI tools are accelerating vulnerability discovery faster than the industry can triage and fix them.
Immunefi's mid-year data paints a mixed picture. The headline figures:
| Metric | H1 2026 | H1 2025 | Change | |--------|---------|---------|--------| | Total incidents | 207 | ~150 | +38% | | Total losses | $972M | ~$2.0B | -51% | | Q2 incidents | 83 (record) | — | — | | Smart contract exploits | 125 of 207 | — | — | | Bug bounties paid | $13.45M | — | — | | Valid bugs surfaced | 837 | — | — |
Q2 2026 alone registered 83 incidents — the most-hacked quarter by count in crypto history, according to Cointelegraph. Losses in Q2 totaled $755.3 million, with cross-chain bridge vulnerabilities accounting for $351 million (46%) of that figure.
Monthly data shows the damage concentrated in April: over $634 million stolen, the highest monthly total since the Bybit breach helped drive losses to $1.4 billion in February 2025. By contrast, June recorded $75.87 million across 40 incidents, a 7% decline from May's $81.7 million, according to PeckShield.
DeFi-specific exploit losses have fallen 74% from their 2022 peak of $2.62 billion to $680.3 million annually, per Immunefi's longitudinal data. Bridge exploits dropped from 73% of DeFi losses in 2022 to 3% in 2025. Flash loan attacks fell from 54% to under 1%. These vectors are being replaced by operational and infrastructure-layer compromises.
On April 1, 2026, Solana-based perpetual exchange Drift Protocol lost $285 million — over 50% of its TVL — in 12 minutes. The attack's preparation took six months.
According to Chainalysis's post-incident analysis, the operation was attributed with medium confidence to UNC4736, a DPRK-linked group also tracked as AppleJeus and Citrine Sleet. Attackers deployed third-party intermediaries — technically fluent individuals with verifiable professional backgrounds — to build relationships with Drift's team through Telegram conversations about trading strategies and vault integrations.
The endgame exploited Solana's "durable nonces" feature: Drift Security Council members unknowingly pre-signed transactions that handed over admin control. The attackers whitelisted a worthless fabricated token (CVT) as collateral, deposited 500 million units, and withdrew $285 million in USDC, SOL, and ETH, according to Drift's post-mortem.
On April 18, KelpDAO's LayerZero-powered bridge was exploited for $292 million. The root cause, per Halborn's technical analysis: a 1-of-1 verifier configuration. A single node was responsible for validating cross-chain messages before releasing funds.
Attackers launched a coordinated DDoS against the protocol's RPC nodes, isolated the lone verifier, and fed it fraudulent messages authorizing the release of 116,500 rsETH across 20 chains. LayerZero's incident statement attributed the attack to TraderTraitor, a Lazarus Group subunit.
The cascading fallout was severe. Aave experienced $6.2 billion in withdrawals within 48 hours. Total DeFi TVL shed $13 billion. The "DeFi United" relief effort, led by Aave founder Stani Kulechov, raised 132,650 ETH (approximately $303 million) from seven protocols to backstop bad debt. Contributors included ConsenSys (30,000 ETH), Mantle (30,000 ETH credit facility), Kulechov personally (5,000 ETH), EtherFi (5,000 ETH proposed), and Lido (2,500 stETH proposed), according to the DeFi United tracker.
The concentration of losses is stark. According to Crypto Briefing, North Korean hackers stole $643 million in crypto during H1 2026. In April alone, DPRK-linked groups carried out 12 attacks on crypto protocols, siphoning $635 million — the Drift and KelpDAO exploits accounting for the vast majority.
TRM Labs reported that Lazarus Group and its subgroups accounted for 66% of all crypto stolen in 2026 through mid-year. Chainalysis puts the figure at 76% when including all state-backed actors under the DPRK umbrella. U.S. Treasury and UN assessments indicate stolen funds are laundered through mixers, DeFi swaps, and layered wallets before supporting North Korea's nuclear and missile programs.
The scale poses a question that extends beyond crypto: a single nation-state apparatus is responsible for two-thirds to three-quarters of all hack losses in a $2.25 trillion asset class.
The structural composition of attacks has shifted measurably. Smart contract exploits remain the most common category by count — 125 of 207 H1 incidents — but they account for a diminishing share of total value stolen.
June 2026 data from Cryip illustrates the disconnect: protocol logic bugs caused 66.7% of incidents but infrastructure failures generated 46.6% of dollar losses. The highest-value breaches — Drift ($285M), KelpDAO ($292M), Humanity Protocol ($31M) — all involved infrastructure, access control, or social engineering failures, not code vulnerabilities.
Cross-chain bridge vulnerabilities accounted for $351 million in Q2 alone — nearly half the quarter's losses. Compromised admin accounts drove 37% of Q2 losses. Private key theft accounted for 5.66%.
The implication for the security industry: code audits are necessary but insufficient. The attack surface has expanded to include human trust chains, governance mechanisms, RPC infrastructure, and bridge verification architectures.
Immunefi CEO Mitchell Amador coined the term "vulnerability apocalypse" to describe what happens when vulnerability discovery outpaces remediation capacity. Speaking at the WAIB Summit in Monaco, Amador stated that newer AI models have tilted cybersecurity toward attackers, contributing to the 2026 resurgence in crypto hacks, according to Cointelegraph.
The dynamic extends beyond crypto. CVE submissions rose 263% between 2020 and 2025, per Amador's analysis. In April 2026, NIST acknowledged it could no longer keep up, announcing that only 15-20% of incoming CVEs would receive full analysis under its revised model. The cURL project closed its bug bounty program after AI-generated reports consumed maintainer time without producing useful fixes. Linux kernel maintainer Linus Torvalds described the private security mailing list as "almost entirely unmanageable" due to AI-assisted duplicate submissions.
Amador warned of a three- to four-year asymmetry period before defenders can match attacker-side AI capabilities.
The threat environment is forcing consolidation. Code4rena, the competitive smart contract audit platform that raised $6 million from Paradigm in 2023 and was acquired by Zellic in 2024, shut down in May 2026. Immunefi absorbed its clients, researchers ("wardens"), and bounty programs, according to The Block.
Immunefi's current footprint, per its H1 disclosures:
The concentration raises its own questions. A single platform now dominates crypto bug bounty infrastructure. If Immunefi's triage capacity becomes a bottleneck — precisely the vulnerability apocalypse scenario Amador describes — the consequences compound.
Despite $972 million in H1 losses, the DeFi insurance market remains negligible. Nexus Mutual holds nearly all of the sector's $123.5 million in TVL — roughly 0.14% of DeFi's broader market, per CoinInsider. Less than 2% of DeFi's $83 billion TVL carries any form of insurance coverage.
Hacks and protocol exploits account for over 65% of paid decentralized insurance claims since 2020. The decentralized insurance market is projected at $3.5 billion by end-2025, growing at a 48% CAGR, according to CoinLaw. Total insurance TVL could reach $5-8 billion by late 2026. Even at the upper bound, that covers a single-digit percentage of DeFi assets.
The gap between losses and coverage is widening, not narrowing.
The H1 2026 data tells two stories simultaneously. The optimistic reading: total losses are down 51%, DeFi exploit losses are 74% below their 2022 peak, and bridge hacks have been reduced from 73% of damage to 3%. The security stack is maturing. The pessimistic reading: a single nation-state is responsible for three-quarters of all losses, attack frequency is at an all-time high, the most damaging exploits bypass code entirely, and AI is widening the gap between discovery and remediation.
Both readings are correct. The honest assessment is that crypto security has improved significantly at the protocol logic layer while remaining structurally exposed at the infrastructure, governance, and human layers. The KelpDAO incident — a $292 million loss caused by a 1-of-1 verifier configuration — is a design failure, not a code failure. The Drift hack — $285 million via six months of relationship-building and pre-signed transactions — is a social failure, not a technical one.
For institutional capital evaluating DeFi exposure, the calculus has shifted. The question is no longer "has this contract been audited?" but "who controls the keys, how is the bridge verified, and what happens when a state-sponsored actor spends six months earning your team's trust?" The security industry has not yet built scalable answers to these questions. Until it does, H1 2026's $972 million is a floor, not a ceiling.