207 crypto hacks were recorded in H1 2026 as total stolen funds drop by 57% to $972 million

The crypto industry’s security record for the first half of 2026 tells two very different stories. On the surface, things appear to be improving. Hackers stole approximately $972 million between January and June, according to TRM Labs, which is less than half the $2.3 billion lost during the same period in 2025. Look a little closer, however, and the picture changes dramatically. While the industry’s financial losses fell sharply, the number of successful attacks surged to an unprecedented level. TRM Labs recorded 207 hacks and exploits in the first six months of 2026, more than double the 83 incidents reported in the same period a year earlier and the highest number recorded in six months. The momentum accelerated in the second quarter alone, which saw a record-breaking 123 incidents after an already historic first quarter. Put the two numbers side by side, and a blunter truth emerges: the crypto industry didn’t get safer in 2026. It simply avoided a repeat of the single catastrophic event, the $1.5 billion Bybit hack, that inflated 2025’s total almost single-handedly. Strip that one incident out of last year’s ledger, and the year-on-year “improvement” looks far less convincing. “The numbers tell two very different stories at once,” said Ari Redbord, Global Head of Policy and Government Affairs at TRM Labs. “We recorded more crypto hacks in the first six months of 2026 than in any prior half-year period on record, but total losses fell sharply, almost entirely because North Korea did not execute another operation on the scale of last year’s $1.5 billion Bybit hack. The underlying threat has not diminished. In fact, it has gotten more sophisticated and more dangerous.” Q1: A quiet start built on phishing, not code At the onset, the year didn’t look like it would end in a record. Data from blockchain security firm Hacken’s Q1 2026 Blockchain Security & Compliance Report put Q1 losses at $482.6 million across 44 incidents, a comparatively modest start and one driven overwhelmingly by human error rather than broken smart contracts. Phishing and social engineering alone accounted for $306 million of that figure, nearly two-thirds of the quarter’s damage, with a single hardware-wallet social engineering scam in January being responsible for $282 million of it after a victim handed over recovery credentials during a fake IT-support call. Smart contract exploits, by contrast, contributed just $86.2 million in Q1, even as such exploits surged 213% year-on-year in raw incident count. Hacken’s analysts flagged this as the defining shift of the quarter. Attackers were increasingly bypassing well-audited code entirely and going after the people and processes around it, employees, recovery flows, and cloud credentials, rather than the contracts themselves. For a few weeks, that looked like good news. Then April happened.