H1 2026 crypto hacks totaled $1.32B across 224 incidents, with access control failures and phishing as the primary vectors.
Security & Exploits ·
Cryptocurrency thefts during the first half of 2026 totaled approximately $1.32B across 224 reported incidents, according to security tracking data. The largest individual losses stemmed from three primary attack vectors: compromised access controls, phishing and social engineering, and oracle manipulation. Kelp DAO and Drift Protocol sustained the most severe damage at $292M and $280M respectively, both tied to permission and privilege breaches.
Permission-based exploits dominated the loss figures, with eight major incidents ranging from $21M to $292M. A single social engineering campaign caused $282M in losses, while oracle vulnerabilities affected three protocols—Ostium ($24M), Blend Protocol ($10.86M), and Bonzo ($9M)—for combined damages of roughly $43.86M. Smaller incidents within each category included Step Finance ($30M), Humanity Protocol ($31M), and several others totaling under $30M per occurrence.
The data reveals a concentration dynamic: a small subset of breaches represented the majority of total losses, with access control failures and compromised privileges underlying the costliest events. The relative scale and incident count of phishing attacks versus structural vulnerabilities in protocol design remain incompletely characterized in available public disclosures.