Half-Year Hack Report Card: 207 Breaches, $972M Stolen, and DeFi Still Doing Group Projects With North Korea 📝

Blockchain security firm TRM Labs recorded 207 crypto hacks in the first half of 2026, the highest six-month total on record and more than double the 85 incidents reported in the first half of 2025. The second quarter accounted for 126 of those breaches, with notable exploits targeting KelpDAO, Humanity, and Rhea Lend.

Smart contract exploits made up 125 of the 207 incidents, a 60% share, though TRM Labs global head of policy Ari Redbord stressed that the heaviest losses stemmed from operational rather than code-level failures. "What I find most concerning is how concentrated these losses are in infrastructure failures. Three-quarters of all stolen value came from compromises of keys, custody systems, and signing infrastructure, not from smart contract bugs. The industry has improved at auditing code, but our operational security has not kept pace with our on-chain complexity," Redbord told AMBCrypto.

Despite the record incident count, the dollar value lost was lower than the prior year. Approximately $972 million was stolen through June, compared with about $2.3 billion over the same stretch of 2025. North Korea-linked actors were responsible for 66% of the stolen funds, a share that peaked above 75% before being diluted by activity from other groups, according to TRM Labs.

The damage has been disproportionately felt across decentralized finance. The $293 million KelpDAO exploit saw the attacker deposit fake tokens into the Aave lending protocol and borrow $190 million in legitimate assets, specifically wETH, triggering a liquidity crunch and a bank run that pushed Aave pools to full utilization and left some late depositors unable to withdraw. The episode added to broader DeFi risk concerns, with TRM Labs reporting $55 billion in capital outflows during the first half of 2026 and total DeFi TVL falling to a two-year low of $70 billion, down from $120 billion earlier in the year.