Add up every reported crypto hack in 2026 through late September and you get two numbers that don't seem like they should go together: 288 incidents, and roughly $2.21 billion in total losses. The attack count is a record. The dollar total, measured against how bad 2025 was, is not — and the gap between those two facts is one of the more useful ways to understand where crypto security actually stands right now.
More attacks, smaller checks
The first half of 2026 alone saw 207 hacks, compared with 83 in the first half of 2025 — attack frequency roughly two and a half times higher. Yet total H1 2026 losses came in at about $972 million, down from roughly $2.3 billion in the same period a year earlier. The median incident in H1 2026 involved about $219,000 — a real loss for whoever it happened to, but nowhere near headline-making. The mean, by contrast, was $4.7 million. That enormous gap between the median and the mean is the whole story: a large number of small, contained incidents are pulling the average loss size way down, while a small number of enormous ones are still doing almost all of the real financial damage.
The 4-percent problem
Put a number on that concentration and it's stark: roughly 4% of 2026's attacks accounted for about 75% of all stolen funds. April was one of the worst stretches, when breaches at Drift and KelpDAO together cost roughly $577 million. September added two more entries to that short, expensive list. The Liquid Network sidechain exploit drained roughly $320 million through a caching bug before about 85% was returned, and the Coldcard hardware-wallet firmware flaw cost self-custody Bitcoin holders another $116 million through a five-year-old entropy bug. Neither was a typical DeFi exploit — one was sidechain infrastructure, the other was a single hardware vendor's firmware build error.
What's actually improving, and what isn't
The frequency-versus-severity split suggests crypto security is genuinely getting better at the things it's had years of practice defending: routine smart-contract exploits, common reentrancy and price-oracle bugs, the kind of attack surface that's been audited, bug-bountied, and patched repeatedly across the industry. What isn't improving nearly as fast is resilience against structural, single-point-of-failure risk — a sidechain's validation logic, one vendor's firmware supply chain, a bridge's multisig configuration. Those are exactly the categories behind 2026's biggest losses, and they're architecturally harder to fix with an audit, because the failure isn't a bug in a specific contract — it's a single component that an enormous amount of value depends on all at once.
The takeaway for anyone holding real money in crypto
The practical lesson isn't "crypto is getting safer" or "crypto is getting more dangerous" — it's that the two risks have diverged, and they call for different responses. Garden-variety exploit risk is shrinking and increasingly something protocols catch or contain. Concentration risk — the chance that the specific sidechain, custodian, or hardware vendor you rely on turns out to be this year's chokepoint — is not shrinking at all, and no amount of general "be careful with your keys" advice addresses it. That's a case for the same instinct institutional allocators already apply elsewhere: don't concentrate critical infrastructure in a single vendor or venue, because when one does fail, it tends to fail big.
Why it matters
This piece is really the synthesizing closer for everything else in this batch: the Fed and OCC stories are about building institutional-grade rails, the Visa survey is about what makes people trust those rails, and this data is the reminder that trust has to be earned at the infrastructure level, not just the marketing level. For anyone actually holding money in crypto, the practical response isn't blanket fear of a rising attack count — it's the same discipline institutional allocators already apply to every other asset class: diversify custody across vendors, avoid concentrating funds behind a single sidechain or bridge, and treat any one piece of infrastructure, however well-regarded, as a potential single point of failure rather than a guarantee.
Further reading
- Coinpedia: Crypto Hacks 2026 — 288 Attacks and $2.2B Lost
- TRM Labs: H1 2026 Crypto Hacks Reach Record High as Losses Fall Below $1 Billion
- CryptoRank.io: August Broke 2026's Monthly Hack Record
Frequently asked
Is crypto getting safer or more dangerous overall?
Neither cleanly — the two risks have diverged. Routine smart-contract exploit risk is shrinking as auditing and bug-bounty practices mature, while structural, single-point-of-failure risk (a sidechain, a hardware vendor, a bridge's multisig) isn't improving at the same pace and now accounts for most dollar losses.
What does a 'structural' hack look like compared to a typical exploit?
A typical exploit targets a bug in one smart contract's code. A structural hack targets a single component that a huge amount of value depends on all at once — a sidechain's validation logic or one hardware vendor's firmware build process — which is why 2026's biggest losses came from a sidechain exploit and a hardware wallet bug rather than a DeFi protocol hack.
How is 'losses' being measured — gross theft or net after recoveries?
The headline figures are gross amounts stolen at the time of each attack. Some of that money is later recovered — about 85% of the Liquid Network exploit's $320 million was returned, for instance — so the real net damage to victims is smaller than the raw $2.21 billion total, though recovery rates vary enormously by incident.