Losses from attacks in the cryptocurrency ecosystem declined sharply in the first half of 2026, dropping 46.8% year-on-year to $1.32 billion, according to new data. However, blockchain security firm CertiK cautioned that this decline alone should not be taken as a sign of a safer environment. The company observed that attackers are using increasingly sophisticated techniques, with a rising financial impact per incident.
Phishing and Wallet Compromise Dominate Trends
CertiK’s breakdown of crypto crime in the first half of the year highlights two main threats: In the first quarter, phishing attacks caused the highest share of losses, totaling $508.2 million. By the second quarter, the focus shifted to wallet takeovers, which accounted for $807.5 million in damages.
CertiK stressed that the apparent 50% drop in losses does not mean the ecosystem is materially safer, noting that last year’s Bybit attack was historically large and artificially inflated previous figures.
Pointing to last year’s Bybit incident, which alone resulted in $1.4 billion in losses, CertiK reminded that this attack ranks among the largest in crypto history. The firm argues that the dramatic annual drop in losses should not be interpreted as evidence of systemic improvement in security.
North Korea-Linked Threats Emerge as a Key Concern
Blockchain intelligence company TRM Labs earlier estimated that North Korea-linked hacker groups have stolen over $6 billion in digital assets since 2017. As an analytics provider specializing in blockchain intelligence and financial crime research, TRM Labs is monitoring continued threats from state-affiliated actors.
In response to recent events affecting KelpDAO and Drift Protocol, authorities from the United States, Japan, and South Korea convened late last month. Their discussions focused on strategies to limit North Korea’s malicious cyber activities and its capacity to generate illicit revenue.
Mini glossary: A multisignature wallet requires multiple authorized signatures to approve a transaction, reducing risks if a single key is compromised.
TRM Labs warned that the decrease in stolen crypto should not be mistaken for heightened security because the number of incidents rose markedly in the first half of 2026.
More Incidents Despite Lower Total Losses
TRM Labs’ data shows the number of crypto attacks soared to 207 in the first half of 2026, up from 83 a year earlier—setting a new six-month record. Security flaws in smart contracts underpinned 60% of all cases, representing 125 incidents.
| Indicator | Data |
|---|---|
| Total losses, H1 2026 | $1.32 billion |
| Year-on-year change | 46.8% decrease |
| Phishing-related loss, Q1 | $508.2 million |
| Wallet intrusion loss, Q2 | $807.5 million |
| Number of incidents, H1 2026 | 207 |
CertiK asserts that, excluding the Bybit attack, the sector now endures a structurally higher pace of attacks than last year, with incidents becoming increasingly targeted and resulting in heavier financial losses per breach.
Private Key Management Remains the Weakest Link
CertiK maintains that protecting private keys and managing multisignature wallets are the most critical security surfaces for attackers. As a result, protocols and institutions holding significant on-chain assets are urged to reinforce security across all layers—from hardware protection to multisig governance and geographically diverse signers.
Hardware wallet manufacturer Ledger, for example, continues to stress the importance of securely storing recovery phrases offline and never sharing them as a core defense against phishing attempts—a key element of first-line security.
