Crypto Hacks H1 2026: Ethereum and Solana Suffer Highest Losses as Total Crosses $1 Billion

Financial losses from cryptocurrency security breaches passed $1 billion during the first half of 2026. According to new data published by onchain security platform Blockaid, the industry recorded more than 200 distinct exploits between January and June-marking the highest volume of security incidents ever logged in a six-month period.

Ethereum and Solana accounted for the vast majority of stolen funds, suffering $332 million and $326 million in losses, respectively. The figures demonstrate a sharp shift in hacker tactics, moving beyond simple smart contract code bugs toward targeted key management compromises and sophisticated social engineering campaigns.

Main News Details

Blockaid’s H1 2026 security assessment verified 212 major security incidents across decentralized protocols, exchanges, and private wallet infrastructure. While total stolen value in early 2025 was dominated by singular mega-events-such as the $1.5 billion Bybit exchange breach-the first half of 2026 was characterized by a high frequency of persistent, high-threshold exploits. Blockaid confirmed that high-threshold attacks grew 3.4 times compared to the full-year total for 2025.

Together, Ethereum and Solana absorbed nearly two-thirds of all financial damage across the Web3 ecosystem. Smart contract vulnerabilities dominated losses on Ethereum-based applications, while infrastructure breaches and compromised private signing keys caused over 98% of total damage on Solana.

Attribution analysis reveals that state-sponsored cybercrime organizations played a massive role in driving these totals. Groups linked to North Korea captured the largest share of stolen capital, executing massive breaches against restaking platforms and decentralized perpetual exchanges.

H1 2026 Crypto Loss Breakdown by Primary Network
 ├── Ethereum Network: ~$332 Million (Code Exploits & DeFi Bugs)
 ├── Solana Network: ~$326 Million (Key Compromises & Infrastructure)
 └── Other Blockchain Networks: ~$342 Million (Bridges, Exchanges, Wallets)

Key Highlights

Detailed Explanation

Ethereum: High-Value Protocol Vulnerabilities

Ethereum maintained its position as the primary network target for dollar losses and total attack attempts. Because Ethereum hosts the industry’s densest concentration of capital-including liquid restaking protocols, cross-chain bridges, and collateralized stablecoins-attackers focused heavily on smart contract logic bugs.

The single largest exploit recorded on Ethereum in H1 2026 involved liquid restaking provider KelpDAO, which suffered a $292 million breach. Other major incidents included access control breaches on Humanity Protocol and StablR. Aside from protocol-level vulnerabilities, decentralized exchange CoWSwap recorded an exploit stemming from privileged parameter errors.

Ethereum Attack Profile (H1 2026)
 ├── Primary Target: Liquid Restaking, Bridges, DEXs
 ├── Main Attack Vectors: Smart Contract Bugs, Arbitrage Manipulation, Access Control
 └── Impact: $332M Lost Across High-Value Smart Contracts

Solana: Infrastructure and Key Compromises

Solana experienced a sharp surge in losses during the first six months of 2026. Total stolen funds on Solana jumped to $326 million-a steep climb from the $127 million recorded across the network throughout all of 2025.

Unlike Ethereum, where attackers mainly targeted application code, Solana’s smart contract security remained relatively resilient. Instead, attackers bypassed protocol code entirely by targeting private key storage, signer infrastructure, and organizational operational security.

The $285 million hack of Solana-based perpetual protocol Drift Protocol accounted for the majority of these losses, alongside a severe key breach at Step Finance. Onchain investigators attributed both attacks to sophisticated state-backed threat actors who targeted administrative signers.

Solana Attack Profile (H1 2026)
 ├── Primary Target: Signer Infrastructure & Multi-Sig Vaults
 ├── Main Attack Vectors: Private Key Theft, Phishing, Operational Security Breach
 └── Impact: $326M Lost (Over 98% via Key Compromises)

Rise of Social Engineering and Multi-Sig Exploits

A key trend emphasized in Blockaid’s analysis is the growing reliance on spear-phishing and social engineering attacks aimed at core developers and protocol administrators. Threat actors increasingly utilize professional networking platforms like LinkedIn to target individuals possessing multi-signature wallet access.

By compromising individual signer devices or credentials, bad actors gain administrative authorization to bypass audited smart contracts entirely. This shift has rendered traditional code audits insufficient on their own without rigorous organizational access controls.

Timeline

     Jan – June 2026                 Mid-July 2026                  July 28, 2026
────────────┬─────────────────────────────┬──────────────────────────────┬─────────────
            │                             │                              │
   212 Security Exploits        Cross-Chain Bridge Attacks      Blockaid Releases
   Surpass $1 Billion           (AFX $24M & Verus $7.5M)        Official H1 Report

• January – June 2026: Security breaches hit 212 confirmed incidents, pushing total ecosystem losses beyond $1 billion.
• Mid-July 2026: Subsequent exploits hit cross-chain infrastructure, including a $24.15 million breach on Arbitrum-based perpetual exchange AFX and a $7.5 million exploit on the Verus Ethereum Bridge.
• July 28, 2026: Onchain security provider Blockaid officially publishes its H1 2026 Security Report detailing network-level losses.

What is Confirmed

• $1 Billion Loss Threshold: Multiple cybersecurity firms-including Blockaid, Global Ledger, and Immunefi-confirm total industry losses exceeded $1 billion in the first six months of 2026.
• Record Attack Frequency: H1 2026 set a historic record for the sheer volume of distinct hacking incidents in a six-month window.
• Solana Vector Focus: Over 98% of Solana’s financial losses resulted from compromised private keys and signer infrastructure rather than smart contract coding errors.
• North Korean Attribution: Advanced persistent threat (APT) groups linked to North Korea orchestrated the two largest exploits of the period (KelpDAO and Drift Protocol).

What is Not Confirmed

• Exact Aggregated Loss Totals: Minor discrepancies exist between security firms due to differing tracking methodologies (Blockaid reports ~$1.05 billion, Immunefi estimates $972 million, and Global Ledger cites $1.32 billion).
• Full Recovery Offsets: While onchain tracking reveals enhanced asset tracing, the exact percentage of stolen funds successfully frozen or recovered from North Korean-linked wallets remains unconfirmed.
• Upcoming Regulatory Directives: Reports have not confirmed whether regulatory bodies will mandate strict hardware-level key security rules for decentralized protocol operators in response to the rise in key leaks.

Why This News Matters

The H1 2026 security figures highlight an evolving threat landscape for decentralized finance (DeFi) and institutional crypto adopters. Historically, protocol developers prioritized smart contract code audits to protect capital. However, the sharp rise in Solana losses proves that attackers are pivoting toward human engineering, key interception, and operational weaknesses.

For everyday investors and institutional asset managers, these exploits underscore the risks associated with liquid restaking platforms and cross-chain bridges. Persistent security breaches also create headwinds for broader market sentiment, dampening retail participation and influencing prediction markets regarding full-year industry recovery.

What Happens Next

In response to the H1 2026 findings, blockchain security firms are pushing for mandatory implementation of multi-party computation (MPC) hardware modules and automated key-rotation protocols for decentralized applications. Protocol teams are expected to shift resources toward monitoring off-chain employee vectors and social engineering attempts.

Market prediction platforms currently price a 79% probability that full-year crypto hack losses will top $1.2 billion before the end of 2026. Security teams continue to monitor cross-chain bridges and restaking pools as high-priority targets for the second half of the year.

Conclusion

The first half of 2026 has exposed critical operational vulnerabilities across the cryptocurrency ecosystem. While smart contract security on networks like Ethereum continues to face persistent code-level testing, the massive surge in Solana key compromises demonstrates that human operational security is now the primary battleground. Protecting the next trillion dollars in digital assets will require protocol teams to secure their signing infrastructure just as rigorously as their onchain code.

Data & Source Attribution: Figures and network-level exploit analyses are sourced from Blockaid’s H1 2026 Security Report, originally reported by Cointelegraph. Supplementary comparative data provided by Immunefi and Global Ledger.