The crypto industry lost an estimated $9.5 billion to theft in 2026 through October 30, with infrastructure and supply chain compromises accounting for the vast majority of dollar losses. Smart contract exploits, once the dominant attack vector, have collapsed as a share of total damage even as t...
"Infrastructure compromises made up roughly 15 percent of incidents but drove approximately 76 percent of losses." — TRM Labs, H1 2026 Crypto Hacks Report
The crypto industry lost an estimated $9.5 billion to theft in 2026 through October 30, with infrastructure and supply chain compromises accounting for the vast majority of dollar losses. Smart contract exploits, once the dominant attack vector, have collapsed as a share of total damage even as they remain the most frequent incident type. Of the 288 documented attacks through October, smart contract bugs produced a median loss of $219,000. Infrastructure breaches — compromised laptops, poisoned software dependencies, hijacked signing systems — produced median losses in the hundreds of millions.
October 2026 crystallized the shift. A single compromised DevOps laptop enabled the $6.3 billion Binance hot wallet drain. A poisoned JavaScript monitoring script extracted $2.7 million from Polymarket traders. A self-propagating npm worm infected 444 packages with 2 billion monthly downloads. A trojanized Python release of LiteLLM shipped credential stealers to 92 million monthly downloaders. None of these incidents exploited a smart contract bug. All exploited the humans, build pipelines, and third-party dependencies surrounding on-chain code.
The data implies a structural inversion: the code on-chain has gotten meaningfully safer; everything around it has not.
TRM Labs recorded 207 crypto hacks in H1 2026, a record for any six-month period. Total losses came to $972 million — less than half the $2.3 billion stolen in H1 2025. Two patterns explain the divergence.
Smart contract exploits accounted for 125 of 207 incidents (~60%) but a shrinking share of stolen value. The median smart contract exploit produced approximately $219,000 in losses, according to TRM Labs. DeFi smart contract exploit losses collapsed 89% year-over-year in Q1 2026, per security analytics firm DeepStrike.
Infrastructure compromises made up roughly 15% of incidents but drove approximately 76% of total losses. Two North Korea-linked operations against Drift Protocol ($285 million, April 1) and KelpDAO ($292 million, April 18) accounted for $577 million of the H1 total.
The full-year picture through October 30 is worse. According to CoinLaw's aggregated tracker, the crypto industry has suffered over $3.4 billion in confirmed losses across 288 attacks in 2026, with the $6.3 billion Binance breach on October 29 pushing the October single-month total past every previous annual record. Infrastructure and supply chain vulnerabilities account for over $1.8 billion of the pre-Binance total, according to CoinGecko's 2026 State of Crypto Security Report.
| Attack Vector | Share of Incidents (H1) | Share of Losses (H1) | Median Loss | |---|---|---|---| | Smart contract exploits | ~60% | ~24% | ~$219K | | Infrastructure compromises | ~15% | ~76% | $100M+ | | Other (phishing, rug pulls, etc.) | ~25% | Remainder | Varies |
Source: TRM Labs H1 2026 Crypto Hacks Report
October 2026 produced four major infrastructure-layer attacks within a single month, none involving smart contract vulnerabilities.
An attacker compromised a Binance DevOps engineer's laptop and pivoted into internal service containers with access to hot wallet signing infrastructure. The attacker deployed a single transaction containing 50 malicious EIP-7702 authorizations — a feature introduced in Ethereum's Pectra upgrade — each pointing to attacker-controlled sweeper contracts. Funds were drained across nine chains in approximately 20 minutes. Approximately $2.7 billion has been frozen, according to Bitquery. TRM Labs and blockchain investigator ZachXBT attributed the attack with "high confidence" to North Korea's TraderTraitor unit.
No private keys were leaked. No smart contracts were exploited. The signing infrastructure itself was the target.
A compromised third-party JavaScript file from DebugBear, a UK-based website performance monitoring service, was injected into Polymarket's international exchange frontend. According to blockchain security firm GoPlus, the malicious script searched for active trading sessions, checked account balances, and used the platform's existing trading tools to move assets. Trading was halted for approximately one hour. Polymarket pledged reimbursement for all affected traders, with losses under $10,000 paid by October 30. The company referred the matter to UK law enforcement.
The attack vector was a third-party monitoring dependency — standard software supply chain compromise applied to a crypto frontend.
A self-propagating worm compromised the GitHub account of the Keyv npm package maintainer and spread to over 444 packages with a combined 2 billion monthly downloads. According to Palo Alto Networks' Unit 42 analysis, the worm deployed via a malicious preinstall hook that harvested npm tokens, GitHub credentials, AWS keys, Kubernetes tokens, SSH keys, and Vault credentials, then reused stolen tokens to self-propagate across packages and repositories.
The adversary used Ethereum smart contract storage as a dead-drop command-and-control channel, reconfiguring the worm's entire C2 infrastructure through a single on-chain transaction without requiring any update to deployed malware. Affected organizations included Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
LiteLLM version 1.107.0, a Python package for connecting to AI model providers with 92 million monthly downloads, shipped with credential-stealing code in PyPI wheels and Docker images. According to Chainguard's analysis, the malicious release targeted AWS, Azure, Google Cloud, SSH keys, and AI provider secrets. The wheels were live on PyPI from 11:39 to 13:23 UTC on October 21; Docker Hub tags remained affected until 14:20 UTC. This was LiteLLM's second supply chain compromise of 2026.
While not a crypto-native project, LiteLLM is widely used in crypto infrastructure for AI-assisted trading, monitoring, and analytics, making the credential exposure relevant to digital asset platforms.
The decline in smart contract exploit losses reflects measurable improvements in code-level security.
Audit coverage expanded. According to Autheo's 2026 verification report, only 20% of hacked protocols had received any audit before exploitation, but audited protocols accounted for just 10.8% of total losses. The implication: audits work when they happen.
Formal verification entered mainstream adoption. Research from security firm DeepStrike found that 34.6% of on-chain exploits are attributable to input validation and verification failures — precisely the class of vulnerability that formal verification mathematically eliminates.
Battle-tested code proliferated. Major DeFi protocols increasingly fork or compose from audited, time-tested codebases rather than writing from scratch. Code reuse reduces novel vulnerability surface.
Bug bounty programs scaled. Most major protocols now operate active bounty programs, creating economic incentives for white-hat disclosure over exploitation.
The net result: the on-chain attack surface contracted. Attackers adapted by moving to the layers that did not contract — the humans, the build systems, and the dependencies.
Three structural factors explain the infrastructure vulnerability expansion.
1. Software dependency chains lengthened. Modern crypto platforms rely on hundreds of third-party packages. The ChainDrop worm demonstrated that a single compromised npm maintainer account could propagate malicious code to 444 packages within hours. According to StepSecurity's technical analysis, the Bun-loaded CI/CD credential harvester could traverse entire package dependency trees autonomously.
2. Signing infrastructure centralized. Despite the industry's decentralization ethos, hot wallet signing systems at major exchanges remain centralized points of failure. The Binance breach exploited this: one compromised laptop reached the signing service, producing valid withdrawals without any private key exfiltration. The February 2025 Bybit hack ($1.5 billion) followed an identical pattern — a compromised Safe{Wallet} developer machine enabled malicious transaction injection.
3. Third-party vendors multiplied. Crypto platforms embed analytics scripts, monitoring tools, compliance APIs, and RPC providers. Each vendor is a potential supply chain entry point. The Polymarket breach originated from DebugBear, a performance monitoring tool. The KelpDAO attack exploited compromised internal RPC nodes. According to CoinGecko's 2026 State of Crypto Security Report, 54% of surveyed crypto firms identify supply chain vulnerabilities as their top ecosystem risk.
North Korea's TraderTraitor unit (also known as Jade Sleet or UNC4899) has emerged as the most consequential actor in the infrastructure attack shift. According to TRM Labs and multiple blockchain investigators, TraderTraitor is linked with high confidence to:
The unit's tactics have evolved from simple private key compromises to sophisticated multi-month campaigns. The Drift Protocol attack combined months of social engineering — reportedly including in-person meetings between North Korean proxies and Drift employees — with exploitation of Solana's durable nonce feature. The Bybit attack involved compromising a developer machine weeks before executing the theft.
According to The Hacker News, TraderTraitor also runs persistent campaigns pushing malicious packages to npm and PyPI to harvest AWS tokens, GitHub personal access tokens, SSH keys, and environment variables from crypto developers.
The pattern is consistent: TraderTraitor does not attack smart contracts. It attacks the people and systems that control smart contracts.
The industry's defensive posture has not kept pace with the threat evolution.
Insurance coverage is contracting. Active coverage by crypto insurance platforms has fallen 20.2%, from $163.2 million to $130.2 million, according to KuCoin research, even as exploit losses climb. TVL in on-chain insurance protocols has dropped to $126 million from a peak of $1.9 billion in 2021. Over $26.8 billion in crypto assets remain at risk with no insurance coverage.
Security budgets are rising but misallocated. According to CryptoNews, security spend in the crypto sector is now rising faster than marketing budgets. However, the bulk of spending still targets smart contract auditing — the attack vector that is declining — rather than infrastructure hardening, software supply chain trust, and third-party vendor assurance.
54% of firms cite supply chain as top risk, but few act. CoinGecko's survey data shows that while a majority of crypto firms identify supply chain vulnerabilities as their primary concern, enterprise-grade supply chain security tooling — software bill of materials tracking, dependency pinning, signed build pipelines — remains uncommon outside the largest exchanges.
The crypto industry spent the 2020-2024 period hardening its on-chain code. Audits, formal verification, bug bounties, and battle-tested codebases collectively reduced the median smart contract exploit to a $219,000 event. That progress is real and measurable.
The attack surface migrated accordingly. Infrastructure compromises — compromised laptops, poisoned npm packages, trojanized Docker images, hijacked RPC nodes, and manipulated signing workflows — now represent the dominant loss vector by an order of magnitude. A single compromised DevOps engineer at Binance produced more losses than all 125 smart contract exploits in H1 2026 combined.
The economic implication is straightforward: the marginal dollar spent on smart contract auditing yields diminishing returns relative to the marginal dollar spent on infrastructure security, software supply chain hardening, and vendor risk management. Until crypto security budgets reflect this reality, the gap between on-chain safety and off-chain vulnerability will continue to widen.