The loudest number in crypto security this year is the size of the theft. The number that actually explains it is how the money left. Across 2026, the biggest crypto hacks did not turn on some exotic flaw buried in a smart contract. They turned on a stolen key or a borrowed admin session, and the coins walked out through a door the code was never asked to guard.
That reframing matters because the headline totals have been read as a worsening code problem. The data points the other way. Coinpedia's first-half review counted 207 separate crypto hacks and about 972 million dollars stolen between January and June, down from roughly 2.3 billion in the same stretch of 2025. Fewer dollars, more incidents, and a growing share of the losses tied to credentials rather than contracts.
The money moved to stolen keys
Security firms measuring 2026 crypto hacks disagree on the exact split, and the disagreement is instructive. Halborn's read of the January to May window put about 72 percent of losses on stolen keys and credential theft rather than contract bugs. Coinpedia's half-year figures are more conservative, attributing close to 40 percent of losses to private-key compromise while noting that infrastructure breaches accounted for many of the single largest hits. CertiK and TRM Labs, summarizing the year through late summer, landed on the same qualitative point: compromised keys, not broken code, now drive the majority of crypto theft by value.
None of that means contracts stopped failing. By raw count they still fail most often. Coinliva laid out that gap earlier this year, when the data showed code bugs made up about 60 percent of hacks but only a sliver of the losses. A reentrancy bug drains a mid-size pool. A stolen signing key drains a bridge. The severity lives with the keys, and that is the structural shift the year confirmed rather than introduced. It is the point Coinliva made when it argued that the biggest security problem is no longer the code.
One crew, forty-four percent
Concentration is the part most recaps skip. Two hacks in April, KelpDAO and Drift Protocol, drained somewhere near 575 million dollars between them. Investigators including Mandiant, CrowdStrike and Elliptic tied both to North Korea's TraderTraitor operation, the same cluster often filed under Lazarus. By the tally CertiK and TRM used, that single state-linked actor accounts for roughly 44 percent of the year's losses from those two breaks alone.
Coinliva tracked the pattern as it formed, when one hacking unit pulled 578 million dollars from DeFi in 18 days. The method was patient rather than clever. On Drift, the attackers spent months posing as a quantitative trading firm before a social-engineering push handed them an admin key worth about 285 million dollars. No contract was broken. A person was.
| Incident | Loss | Date | How it happened |
|---|---|---|---|
| KelpDAO | about 290 million | April 18 | Compromised developer session keys, single-verifier bridge |
| Drift Protocol | about 285 million | April 1 | Social engineering into a compromised admin key |
| Coldcard firmware | about 130 million | July 30 | Weak random seed generation left wallets guessable |
| Cosmos EVM chains | about 21 million | August | An underflow bug reused across several chains |
Why the same break keeps working
KelpDAO shows the mechanism. The attackers reached a LayerZero developer session and pushed the theft through a bridge configured with a single verifier, so one compromised signer was enough to wave the transfers through. That is not a rare setup. By CertiK's count, roughly 47 percent of LayerZero application endpoints still run in single-verifier mode, which means the failure that cost KelpDAO close to 290 million dollars is sitting live under a large slice of the messaging layer. A bridge with one guard is a bridge with one key to steal.
Audits do not catch this. An auditor reads the contract, confirms the math, signs off, and the contract behaves exactly as written while an operator's laptop hands over the keys. The gap is between what the code can prove and what the humans and their infrastructure actually protect. It showed up again in late August, when an exploit hit Injective core modules the team had called untouched, another reminder that the reassuring parts of a system are often the ones nobody re-checked.
Pick a number, then read the footnote
The running total for 2026 crypto hacks has been quoted anywhere from about 840 million to 1.3 billion dollars, and the spread is not an error. It is a window and a definition. Halborn's 840 million covers five months. CertiK and Forbes reach 1.3 billion by counting through late summer and folding in thefts that sit outside DeFi proper. TRM keeps its DeFi-only line just under a billion. Each figure is defensible on its own terms, which is exactly why quoting one without the period and the scope tells the reader very little.
What holds across all of them is the direction. The dollar losses are lower than last year, the incident count is higher, and the worst crypto hacks keep arriving through credentials and signing infrastructure rather than the contract logic that gets audited. Defenders spent the year hardening code. The attackers spent it collecting keys, and going into the fourth quarter that trade still favors the attackers.