In the first half of 2026, a total of 344 security incidents occurred in the Web3 ecosystem, with cumulative losses amounting to approximately 1.32 billion US dollars. Although this figure represents a 46.8% decline year-on-year compared to the same period last year, excluding the impact of the $1.45 billion loss from Bybit, the scale of losses in the first half of this year actually rose by around 28% year-on-year.
In other words, there has been no substantial improvement in the overall security environment of the industry.
In the first quarter alone, Web3 projects lost $464.5 million across 43 incidents, with phishing and social engineering attacks inflicting the heaviest losses. Wallet theft was the costliest attack vector, causing $445 million in losses via 33 incidents in the first half of the year; phishing led to $366 million in losses through 63 incidents.
The latest case involves DeFi platform Summer. fi (formerly Oasis. app), which was exposed to an attack on July 6,2026, with approximately 6 million US dollars siphoned off. Security firm Blockaid detected that the vulnerability bypassed existing protection measures. In June, crypto platforms lost 75.87 million US dollars in 40 hacking attacks, and the vulnerability of Humanity Protocol was the largest single loss.
User Rants: A hacked user said — “I chose DeFi because of the principle 'not your keys, not your coins'. Now I get it — 'it' s your keys, but the coins could still belong to someone else'. ”
CertiK also warned of a vulnerability dubbed “Ill Bloom”, which has affected thousands of wallets across multiple platforms including Bitcoin, Ethereum and Solana, with at least 5 million US dollars stolen in recent security incidents. The total value locked in DeFi has dropped by 39% year-to-date.
Code vulnerabilities on the project side, hacking tactics, and user negligence — when these three factors combine, your funds may vanish even faster than the project team itself. And while you can at least vent your anger when a project team runs off with your money, you won't even know who to curse at when a hacker strikes.
