"RBC-Crypto" does not provide investment advice, the material is published for informational purposes only. Cryptocurrency is a volatile asset that may lead to financial losses.
Over the period from 2016 to 2026, decentralized finance (DeFi) protocols and cryptocurrency exchanges collectively lost more than $14.27 billion due to hacker attacks and code errors, according to a report by the analytical platform CoinGecko. And in 2026, as of August, more incidents have already been recorded than in any previous period, although the total amount of losses still lags behind the peak year 2022.
According to CoinGecko, 164 separate incidents have already been recorded in 2026, which is approximately 70% more than the entire previous year—in 2025 there were 97 cases. The year with the highest total damage for the crypto industry remains 2022 at $2.77 billion, slightly ahead of the 2021 figure of $2.66 billion. As of early August 2026, the damage amounted to about $1.2 billion.
Experts attribute such a sharp spike not only to improved methods of tracking attacks but also to increased activity by malicious actors against the backdrop of the development of artificial intelligence.
When compiling the report, CoinGecko used data from the REKT Database (DeFiWatch) for 2018–2022 and the DeFiLlama hack tracker for 2023–2026. Protocols without their own tokens were excluded from the analysis—specifically, centralized exchanges, bridges without native assets, and hardware wallets.
The data for 2026 is preliminary and covers the period from January to early August. To assess the damage from the price drop of individual tokens this year, analysts used the average market capitalization for seven days before the hack and compared it with the figures as of early August 2026.
At the same time, as the authors of the study emphasize, the actual damage could be significantly higher, as this amount does not include hacks of individual wallets and other ecosystem losses.
Crypto Project Hacks of 2026
The greatest damage to the crypto industry in 2026 was inflicted in April, which accounted for nearly $645 million in losses. Key events were the hacks of the Drift and Kelp protocols for $295 million and $293 million respectively.
Both attacks, according to analysts, were carried out by different malicious actors, presumably linked to North Korean hackers. And the Kelp hack is also distinct from others in that it caused damage across the entire DeFi sector.
The attackers exploited a vulnerability in the LayerZero bridge and minted unbacked tokens of the wrapped version of Ethereum—rsETH. They then used them as collateral in the Aave protocol to obtain real assets.
The consequences for Aave were catastrophic—the situation led to users withdrawing billions of dollars in liquidity. Total deposits in the protocol fell by approximately $4 billion over two days, and by early August, the figure had dropped to $14.70 billion.
Although by the end of May, through the efforts of the crypto community, the user funds stolen from Kelp were returned and all assets were restored to the protocols affected by the incident, a huge portion of the deposits across the entire DeFi sector never returned. Sector losses by August amounted to over $20 billion.
Token Price Drops Bigger Than the Hacks Themselves
In addition to the hacks and thefts themselves, CoinGecko analysts highlighted another level of financial damage that falls on token holders of hacked protocols. They noted that the market reaction to incidents often inflicts greater damage.
Experts highlighted the case of BonkDAO, where the damage from the market reaction significantly exceeded the damage from the hack: losses amounted to $21 million in reserves, while the token BONK's market capitalization shrunk by almost $140 million. According to Coingecko, "this shows that the market reaction can be more costly than the hack itself."
The report also provides examples where the DRIFT token of the Drift protocol (renamed to Velocity) fell 80% since the hack on April 1. And Resolv (RESOLV) recorded a 70% drop since March 2026. And the worst example—Step Finance, where a vulnerability led to the protocol's bankruptcy, and their token STEP lost more than 99% of its value.
