Crypto hacks hit a record count but the biggest threat isn’t smart contracts
TRM Labs reported a record 207 crypto hacks in H1 2026, more than double H1 2025’s 83, but total losses fell to $972 million from $2.3 billion. Most incidents were smart-contract exploits, yet most stolen value came from operational and infrastructure failures: keys, custody, signing systems, approval workflows, and other controls around fund movement. Infrastructure/operational compromises were about 15% of incidents but 76% of value lost. Median loss was about $219,000, showing many small attacks alongside a few huge ones. North Korea-linked activity was responsible for about $643 million, led by major April incidents involving Drift Protocol and KelpDAO. The key takeaway is that audits remain necessary, but catastrophic losses increasingly come from compromised fund-control systems, so security must expand to signing, governance, access control, monitoring, and rapid incident response.
