Attackers stole more than $1.1 billion across 212 verified exploits in the first half of 2026, the highest incident count on record for any half-year, according to Blockaid's H1 2026 Onchain Security Report, published Tuesday.
The record count lands even as dollar losses came in below the same period last year, when the $1.5 billion Bybit theft alone dwarfed every other incident. The 2026 data points to a different problem: attacks are multiplying, and most of the money is walking out through operational failures rather than buggy code.
Blockaid verified 3.4 times as many high-threshold exploits in the first six months of 2026 as in all of 2025, Ido Ben-Natan, co-founder and CEO of Blockaid, said in a post on X on Tuesday. Operational security attacks — compromised keys, signing infrastructure and privileged access — drained 74% of stolen funds, while a North Korea-linked cluster accounted for 55% of all losses, he said.
The two largest incidents of the half both traced back to operational failures rather than smart contract bugs. On April 18, KelpDAO lost $292 million in rsETH — more than a quarter of its total value locked — after a single compromised LayerZero decentralized verifier network signed off on a malicious bridge transaction, according to Blockaid's incident analysis. Weeks earlier, on April 1, Drift Protocol, Solana's largest perpetuals exchange at the time, was drained of $285 million in under 12 minutes through a privileged key compromise at the governance layer.
