The Half-Year Ledger: 207 Hacks, $972M, and a Rising Machine Tempo

The first half of 2026 closed with 207 recorded hacks and roughly $972 million lost, per TRM Labs — the worst half-year in the firm's dataset. By August, with the $116M Coldcard drain and a run of follow-on incidents, the running annual total had already passed $1.2 billion across 276 incidents.

What the composition says

Totals make headlines; composition makes policy. Three shifts inside the number matter more than the number. First, the victim profile is widening — this year's marquee losses hit individual self-custody users, not just protocols and exchanges, which changes the political salience of crypto crime. A drained DeFi protocol is an industry story; thousands of individuals losing retirement-sized sums from devices marketed as safe is a constituent-services story.

Second, supply-chain and infrastructure compromises — firmware, vendor databases, bridge permissions — are displacing the classic smart-contract exploit. The attack surface is migrating from code that gets audited to operational plumbing that doesn't. Third, tempo: TRM's 40% year-over-year rise in AI adoption across crypto crime means H1's record was set by attackers still mostly working at human speed.

A second firm counted the same six months and got a third of a billion more

Since this piece first ran, a competing tally has landed, and the two do not agree. CertiK's Hack3D report put H1 2026 at $1,315,676,432 across 344 incidents, as Forbes reported in July. TRM's figure, above, is about $972 million across 207. Same industry, same half-year, a gap of roughly $344 million and 137 incidents.

Neither firm is wrong, and the divergence is not sloppiness. It is the accumulation of methodological choices that each firm makes defensibly and in public: what threshold makes an event an "incident" at all; whether phishing of individual users is counted alongside protocol breaches; whether a loss later frozen or returned still belongs in the total; and how you value a theft denominated in a token whose price was being manipulated at the moment it was taken. Each choice is arguable. Stacked together they produce a 35% spread.

The practical consequence is that "crypto lost $X in 2026" is a sentence without a fixed referent. Any figure quoted without naming the firm behind it — and the cut-off rules that firm used — is offering a precision that does not exist. This desk has now published both numbers, and will keep naming the counter each time.

The year-over-year figure is a trap

CertiK's own numbers contain a warning about reading any of this too quickly. On its face, H1 2026 came in 46.8% below H1 2025 — a headline that reads like the industry is getting safer. It isn't quite that. The 2025 comparison base included the single $1.45 billion Bybit theft, an event large enough to dominate a half-year on its own. Remove it and, per Forbes's read of the data, comparable losses in H1 2026 were roughly 28% higher than the year before.

The incident count tells the same story without the arithmetic. CertiK logged 194 incidents in Q2 2026 against 145 in Q2 2025. More attempts, more of them landing, with the aggregate flattered by the absence of one catastrophic outlier in the numerator. CertiK chief executive Ronghui Gu's summary of the half-year was that the shape mattered more than the size: "What stood out most was the shape of the losses. A huge share of H1's damage came down to just two incidents."

That is the same distortion in miniature, and it recurs monthly. August closed at about $215 million — but a single incident, the Tectonic drain on Cronos, accounted for 56% of it. A loss total dominated by one event describes that event. The incident count is the more honest measure of how much is being attempted, and it has been rising all year.

Related The contracts held. The prices didn't

Eight months in, the composition thesis holds — and sharpens

The prediction this piece made in August was that composition would matter more than the total. At the eight-month mark, the data has done something stronger than confirm it. According to crypto.news's September 4 review of Forbes and CertiK figures, DeFi protocols have lost at least $1.3 billion through August — and for the first time on record, compromised private keys and access credentials have overtaken smart-contract bugs as the leading mechanism of theft.

That is not a marginal reordering. The year's two largest incidents — Drift Protocol at $285 million and KelpDAO at $290 million — account for $575 million between them, and neither turned on a flaw in contract code. Both involved social engineering or session hijacking: the attacker did not defeat the software, they became someone allowed to use it. CertiK's Ronghui Gu put the implication bluntly, noting a protocol "can pass a flawless code audit and still lose millions" through a compromised admin key.

The concentration warning from earlier in this piece applies here with force. Two incidents make up roughly 44% of the year's losses, and both are attributed to North Korea's Lazarus Group, operating as TraderTraitor. Strip those two events out and 2026's remaining loss curve describes a different, smaller, more diffuse problem. Leave them in and the year looks like a state actor's fiscal calendar. Both readings are true; neither survives being compressed into a single dollar figure.

The same door, left open

The most uncomfortable finding in the eight-month data is not the size of any loss. It is the repetition. Bridge infrastructure remains the industry's most durable weak point — both KelpDAO and AFX Trade involved compromised verifiers or validators on cross-chain systems — and CertiK's audit of the surrounding ecosystem found that 47% of LayerZero applications still run single-verifier configurations, despite multi-verification being available to them. Nearly half the deployments have declined a safety option that exists, is documented, and costs them almost nothing.

That is the same pathology this desk documented in Friday's Notional drain, where a safety library sat imported at the top of the file and unused on the line that mattered. Availability is not adoption. The defensive tooling in this industry is, on the whole, ahead of its deployment — the fixes exist, they are published, they are frequently free, and they are routinely not switched on. The rekt.news leaderboard counted more than thirty individual exploits above $3 million this year. The recurring theme across them is not novel technique. It is a known mitigation that somebody chose not to enable.

The regulatory read

Loss curves precede rulemaking; it has happened after every major loss cycle since Mt. Gox. If the pattern holds, expect pressure in three places: disclosure timelines for custody-adjacent vendors (SafePal's breach is the exhibit), security standards for consumer key-management devices, and scrutiny of agent-money products as exchanges wire AI tools to trading rails. The industry can write those standards itself first, or read them in a rule later.