Crypto Exploit Tracker 2026

The year so far

• 212 verified exploits and more than $1.1 billion lost in the first half of 2026.
• Past $1.2 billion across 276 incidents by the end of July.
• About $643 million, roughly 66 percent of first-half losses, attributed to North Korea linked groups.
• April was the worst month for value at about $631 million, close to 68 percent of the first half.
• August set a record for frequency, not size: 50 incidents, $136.3 million lost, down 49.5 percent from July's roughly $270 million.

Last updated 10 September 2026. Covers incidents from 1 January 2026. Figures are the loss reported at the time and are revised when better accounting appears.

What actually causes the losses

The most common cause is not the most expensive one

Smart contract vulnerabilities were the most common attack vector by count. They are also the risk that audits are built to find, and the losses tend to be smaller. The money went somewhere else. Roughly 76 percent of the value lost came from infrastructure and operational compromise: stolen keys, breached cloud accounts, a multisignature backup sitting on one laptop, an engineer talked into approving something.

That gap matters when you are judging a protocol. An audit report tells you about the contract. It tells you almost nothing about who can sign what, where those keys live, and how many people have to be wrong at once for the money to leave. Our guide to decentralised finance covers how to read those controls, and multi-party computation wallets explains one common way teams split them.

2026 incidents

Every major exploit, newest first

Recovery

Recovery is rare, and the exceptions are revealing

Most of these losses were permanent. Funds reached a mixer within minutes and the trail stopped. But four of the recoveries in this table did not come from law enforcement or from clever tracing. They came from someone with the power to intervene deciding to use it.

Cronos validators halted a live chain and rolled back its state. Harmony rewrote seventeen blocks' worth of history, discarding more than 109,000 unrelated transactions in the process. Tether froze USDT at the issuer. Stellar validators froze roughly $7.2 million. Each of those is a genuine recovery, and each is also evidence that the system had a control point that could be used against a holder rather than for one.

That is the uncomfortable trade every reader should sit with. The property that saves you when the attacker is someone else is the same property that exposes you when the intervention is aimed your way. We worked through this in The Quiet Ledger on finality after a chain rollback.

How to use this

The questions worth asking before you deposit

• Who can move the money? Name the signers, the threshold, and where the keys are held. If nobody can answer, that is the answer.
• What is the price of my collateral, and who says so? Tectonic, YieldBlox and Venus were all price manipulation on a thin market, not contract bugs.
• What does the bridge actually verify? The Verus bridge checked a state root but never the amounts inside it. Kelp DAO's attacker forged a message by taking out the nodes that would have disputed it.
• Does the vendor's supply chain reach my keys? Coldcard's loss came from firmware shipped five years before anyone noticed. Read our cold storage guide for what you can verify yourself.
• Is there an intervention point? If yes, decide whether you want it. Do not discover it during an incident.

Method and limits

Rows are added when an incident has a named target, a loss figure, and a cause stated by the affected project or a security firm rather than inferred from chain activity alone. Aggregate totals come from published first-half reviews and PeckShield's monthly counts; different trackers set different thresholds for what counts as an incident, so totals from different sources will not reconcile exactly, and we do not blend them into a single number.

Dollar amounts are the value at the time of the incident, which is why token-denominated losses such as Liquid's are given in both. Where a chain rolled back or an issuer froze funds, the outcome column reflects what was actually restored, not what was announced. If you have documentation that corrects a row, tell us and we will amend it with a note.

New incidents are covered as they happen in The Daily Ledger, and the structural questions behind them are taught in Academy School.

Sources

• Crypto Briefing: 212 exploits and $1.1 billion stolen in the first half of 2026
• FinanceFeeds: the 15 biggest crypto exploits of the first half of 2026
• TRM Labs: inside the $116 million Coldcard hack
• PeckShield via CryptoRank: August 2026 set a record for incident count
• Crypto.news: August 2026 losses of $136.3 million
• Blockstream: Liquid security incident status page
• CoinOtag: the Tectonic exploit and Cronos rollback
• Blockonomi: Harmony's August exploit and rollback

Disclaimer: This page is for education and information only. It is not financial, investment, legal, tax, or security advice. Incident details reflect public reporting at the time of writing and may be revised.