The company called this period “the most hacked half-year in history” in terms of the number of incidents—212 successful attacks—but not in terms of the amount stolen. The number of exploits was 3.4 times higher than the figure for all of 2025, according to forklog.com.
In dollar terms, the losses were lower than a year earlier. Back then, the statistics were sharply inflated by the $1.5 billion Bybit hack.
According to Blockaid, the largest share of stolen funds—55%—was attributed to actors linked to North Korea. Analysts attributed the attacks on Drift ($285 million in losses) and KelpDAO ($292 million). They expect North Korean hackers to remain active.
Among the hackers’ key tactics, the company highlighted social engineering via LinkedIn and the subsequent compromise of multisig wallet signers. According to Blockaid, this scheme was behind two of the four largest incidents of the first half of the year.
The company’s estimates differ from Immunefi’s data in the June 2026 Ecosystem Update report. That report estimated industry losses for the first half of the year at approximately $972 million across 207 incidents. Quill Audits cited a similar figure—$935.3 million across 87 DeFi hacks in the first half of the year. At the same time, Immunefi also recorded a record number of incidents over the six-month period and noted that losses for DeFi projects in 2026 are currently 74% lower than the 2022 peak.
By network, the largest losses, according to Blockaid, were on Ethereum and Solana—$332 million and $326 million, respectively.
For Ethereum, the company pointed to a trend of “large-scale code exploits”, as the blockchain hosts the most valuable protocols, including restaking, stablecoins, and DEX aggregators. In the case of Solana, attackers more often target the infrastructure of signers rather than smart contracts.
Risks for the Second Half of the Year
A separate risk for the second half of the year is AI-related exploits. Blockaid cited the $216,000 Bankr hack as the first such incident and stated that further attacks on AI agents via prompt injection, followed by tool abuse and unauthorized signing, are possible.
