North Korea-linked attackers accounted for more than half of all stolen crypto funds in the first half of 2026.
The first half of 2026 was the most active six months for crypto exploits on record.
This is according to a new report from Blockaid, which shows hackers stole $1.1 billion across 212 incidents.
Crypto Hacks Top $1.1B in H1 2026
The Blockaid report found that four major incidents involving KelpDAO, Drift, Resolv, and CoW Swap made up roughly $707 million of the total losses.
KelpDAO suffered the largest loss, after hackers stole $292 million worth of crypto by faking a cross-chain message that siphoned off the protocols Ethereum reserves. Drift Protocol, a perpetuals exchange built on the Solana chain, also suffered a similarly huge hit, as it was exploited for $285 million within 12 minutes.
Blockaid linked both cases to TraderTraitor, a state-sponsored North Korean subset of the larger Lazarus Group. Humanity Protocols $32 million loss was also connected to the same attacker cluster, bringing DPRK-linked losses to $609 million, which is about 55% of all funds stolen during the period.
The pace of attacks also increased through the year, with monthly incidents going from 18 in January to 57 in June. April proved to be the most painful month, as the KelpDAO and Drift Protocol hacks wiped out a combined $577 million to push total losses in that month to $635 million.
Privileged key misuse was the most costly attack type in the first half of 2026, with losses of approximately $790 million, or close to three-quarters of all funds stolen in the period, said Blockaid. Unbacked mint exploits came second in value, led by the $80 million Resolve breach. But the hacks at the code level caused the most casualties, accounting for nearly four out of five attacks by count.
You may also like:Attack Vectors Change as New Threats Emerge
The report named AI agents as a new target after hackers in May used a prompt injection attack to fool Bankrs AI agent into approving an unauthorized transaction for about $216,000.
Cross-chain bridges also took a major hit, with attackers breaching the verification systems of KelpDAO and Taiko through forged proofs and attestations accepted by the destination chains.
In addition, security teams faced newer attack methods in 2026, with Blockaid identifying four incidents involving EIP-7702 wallet delegation attacks, where a wallet can hand control to a smart contract. Legacy smart contracts also continue to be a common vulnerability, with data showing around five cases in May and June, including two involving Aztec Connect and one targeting Raydiums AMM V3.
Recent incidents outside the report period showed the same pressure on crypto infrastructure. For instance, on July 23, AFX Trade, BSquaredNetwork, and Verus were hit in separate attacks on the same day that collectively caused more than $35 million in losses. Recall that Verus had already suffered another exploit about two months earlier, and Blockaid linked both incidents to the same bridge contract and bug class.
Recovery results varied depending on the type of attack. Per the report, code-related incidents sometimes allowed teams to freeze funds or negotiate returns, while attacks involving stolen keys usually ended with the money moving through mixers or cross-chain routes.