Crypto theft in the first half of 2026 was still ugly, but the numbers depend on who’s doing the counting. TRM Labs says hacks and exploits hit a record 207 incidents and drained $972 million, while a separate headline claim pegs the damage at $1.1 billion across 212 security incidents.
- Record incident count
- TRM Labs: $972 million lost
- Smart contract bugs vs. operational failures
- North Korea-linked thefts still dominate losses
That gap matters. In crypto, “hack, ” “exploit, ” “breach, ” and “security incident” are not interchangeable, even if sloppy coverage treats them like the same bucket. A tracker that counts a broader set of events can easily produce a different total than one focused only on hacks and exploits. Same half-year, different bookkeeping.
TRM Labs’ H1 2026 report says the industry saw a record 207 separate hacks, but total losses came in at $972 million, less than half the $2.3 billion stolen in the first half of 2025. That does not mean the sector suddenly got safe. Attackers kept showing up. The biggest thefts were just not as catastrophic as last year’s monster blows.
The cleanest way to read the data is this: incident count went up, total dollar losses went down. Those two trends can happen at the same time. A swarm of smaller attacks can push the number of incidents to a record while a handful of giant thefts determine most of the money lost.
TRM says Q2 2026 alone set a new high with 123 incidents. That’s a lot of broken glass in three months. But the damage was uneven. TRM’s numbers show how brutally skewed crypto theft can be: many attacks are relatively small, while a few outliers do the real financial damage.
Most of the incidents were smart contract exploits. For readers newer to this corner of crypto, a smart contract is code deployed on a blockchain that automatically executes when preset conditions are met. If that code has a flaw, an attacker can sometimes abuse it to drain funds without needing to “break in” the way a traditional hacker would.
But the bigger dollar losses did not come mainly from elegant code exploits. TRM says infrastructure and operational compromises made up only about 15% of incidents, yet accounted for roughly 76% of total losses. In plain English: the worst damage often came from weak key management, sloppy custody controls, bad signing setups, or other operational failures. Not glamorous. Just expensive. Very expensive.
That’s the part the industry keeps relearning the hard way. Audits matter. Better code matters. But if the humans, systems, and approval workflows around the code are sloppy, attackers will happily take the side door and leave with the vault.
TRM also says North Korea-linked activity remained the biggest source of stolen value in H1 2026. The report attributes about $643 million, or 66%, of stolen value to that activity. Two April thefts tied to Drift and KelpDAO alone accounted for roughly $577 million.
That should bother anyone who still talks about crypto security like it’s only about code quality. State-linked or state-tolerated theft is not some minor nuisance. It is a structural threat that can distort the whole risk picture and overwhelm months of smaller incidents in one clean hit.
There is also a useful counterpoint here: the drop from $2.3 billion in H1 2025 to $972 million in H1 2026 is still real. Lower losses are better than higher losses. But it would be silly to mistake that for a victory lap. TRM’s numbers show that the number of hacks more than doubled from 83 incidents in the same period last year. The attack surface is not shrinking. If anything, it is getting busier.
That tells a blunt story about crypto security. Some parts are improving. Some are not. And the biggest losses increasingly come from the boring stuff, custody, permissions, signing infrastructure, and operational discipline, where too many projects still behave as if they’re managing a hobby wallet instead of serious capital.
So what should readers make of the $1.1 billion and 212 incidents figure in the headline claim? Treat it carefully. The verified TRM Labs numbers for H1 2026 are 207 hacks and $972 million in losses. If another tracker arrived at a higher figure, it likely used a broader definition of “security incidents, ” but that methodology is not visible here. Without that, the bigger number is just a bigger number.
Wall Street Giants Back $15M Push to Quantum-Proof Bitcoin is the kind of headline that reminds everyone the industry is no longer just fighting today’s thieves; it’s also trying to harden itself against tomorrow’s threats. Quantum resistance may sound like sci-fi today, but the long-term question is real enough that serious money is already circling it.
Key questions and takeaways
-
Did crypto hacks rise in H1 2026?
Yes. TRM Labs says the first half of 2026 saw a record 207 hacks and exploits, up from 83 in the same period last year. -
Did losses also hit a record?
No. TRM Labs puts H1 2026 losses at $972 million, which is below the $2.3 billion stolen in H1 2025. -
Why do some figures show $1.1 billion instead?
Because different trackers may use different definitions of “security incidents” and may count more than just hacks and exploits. The $1.1 billion / 212 incidents figure is not verified by the TRM Labs material provided here. -
What caused the biggest losses?
TRM says infrastructure and operational compromises caused most of the dollar damage, even though smart contract exploits made up most of the incidents. -
Why does North Korea keep coming up?
TRM attributes about $643 million, or 66% of stolen value, to North Korea-linked activity. That makes it one of the most serious and persistent threats in crypto theft. Lazarus Group is the name most often associated with that playbook. -
Does lower dollar loss mean crypto got safer?
Not really. The incident count hit a record, which means attackers are still active. Lower losses can simply mean there was no single mega-heist as large as 2025’s worst cases.
H1 2026 Crypto Hacks Reach Record High as Losses Fall Below is the blunt takeaway: more attacks, less money lost, and plenty of room for complacency to get people wrecked.
The real lesson is simple: crypto has not outgrown its security problem. It has scaled it. More protocols, more bridges, more wallets, more keys, more moving parts, and more chances for one bad decision, one bug, or one well-funded attacker to turn innovation into a cleanup bill.
That does not mean the space is doomed. It means the bar is still too low. Better audits, stronger key management, tighter custody controls, hardware-backed signing, and serious approval workflows are not nice-to-haves. They are the cost of doing business if crypto wants to handle real money without acting like a live-fire exercise.
North Korea-linked crypto hacks are a reminder that decentralization does not magically erase geopolitics. Freedom still matters. But sloppy security is not some noble sacrifice to the gods of open finance. It is just sloppy. And in crypto, sloppy gets drained.
Further reading
One more useful source for the weeds and the wallet-draining reality behind the headlines:
