Crypto hacks hit record high in H1 2026 – What’s fueling the surge?

ambcryptoPublished on 2026-07-02Last updated on 2026-07-02

Abstract

According to TRM Labs, crypto hacks reached a record high in the first half of 2026 with 207 incidents, more than double the 85 reported in H1 2025. While the number of breaches surged, the total value stolen fell to $972 million, less than half the $2.3 billion lost in the same period the previous year. Smart contract exploits were the most common attack type, constituting 125 cases. However, TRM Labs' Ari Redbord noted that three-quarters of the stolen value came from infrastructure failures like compromised keys and custody systems, highlighting a gap between improved code auditing and lagging operational security. Notably, North Korean-linked actors were responsible for 66% of the stolen funds. Major exploits, such as the $293 million attack on KelpDAO, triggered liquidity crises in protocols like Aave and contributed to a broader loss of confidence in DeFi, leading to significant capital outflows and a drop in Total Value Locked to a two-year low of $70 billion.

TRM Labs, a blockchain security firm, reported 207 crypto hacks in the first half of 2026, the most in any six-month period. The bulk of the crypto hack cases happened in Q2 (126 incidents), led by KelpDAO, Humanity, and Rhea Lend exploits.

In the first half of 2025, 85 crypto hacks were reported. In other words, H1 2026 saw more than double the number of crypto hack cases over the same period. According to the report, most of the attacks were smart contract exploits, which accounted for 125 of the 207 incidents: a 60% dominance share in breaches.

Commenting on the same, Ari Redbord, global head of policy at TRM Labs, told AMBCrypto,

What I find most concerning is how concentrated these losses are in infrastructure failures. Three-quarters of all stolen value came from compromises of keys, custody systems, and signing infrastructure, not from smart contract bugs.

He concluded that,

The industry has improved at auditing code, but our operational security has not kept pace with our on-chain complexity.

North Korea-linked actors drive 66% of crypto hacks

Despite the record number of breaches, the overall value stolen in 2026 was relatively small compared to 2025.

The report noted that $972 million was lost as of June, which was below half of about $2.3 billion lost over the same period in 2025. Still, 66% of the stolen funds were driven by North Korean-linked entities.

By the end of Q2 2026, North Korea-linked attackers’ share of stolen crypto funds was over 75%. However, intensified activity from other entities during the quarter reduced their dominance to 66% at press time. The impact of the hacks has been more devastating for the DeFi sector. Amid the broader bearish sentiment, the intensified crypto hacks further drove investors from the DeFi sector.

In fact, in the KelpDAO’s $293 million hack, the attacker used fake tokens and deposited them in the Aave lending protocol and borrowed $190M in legitimate assets (wETH). There was a sudden liquidity crunch and subsequent bank run in Aave as investors feared the worthless collateral deposited by the attacker. As a result, Aave pools reached full utilization, preventing some late depositors from withdrawing their funds.

This added to broader DeFi security risk, which has triggered $55 billion in capital outflows in H1 2026. At the time of writing, the total DeFi TVL (total locked value) has hit a two-year low of $70 billion, up from $120B seen earlier in 2026.

Final Summary

Crypto hack cases hit a record high of 207 in H1 2026, but the stolen value was below $1B
North Korea-based threat actors accounted for $643M, or 66% of stolen funds over the same period.

The Verdict in Choi Tae-won's Divorce Case: Revealing the Inheritance Undercurrent Behind SK Hynix's Trillion-Won Empire

SK Group Chairman Chey Tae-won's high-profile divorce case, involving a record 1.38 trillion won settlement, has drawn attention to the succession plans for Korea's second-largest conglomerate, especially its crown jewel, SK hynix. Unlike traditional chaebol scripts centered on the eldest son, Chey's three children from his marriage to former President Roh Tae-woo's daughter, Roh Soh-yeong, are carving distinct, non-traditional paths. Eldest daughter Chey Yun-jung (b. 1989) is seen as the most evident successor. With a scientific and consulting background, she holds executive roles at SK bioscience and SK Inc.'s growth support department, focusing on future strategy and biopharma. Her marriage is to an AI infrastructure entrepreneur, not a traditional business alliance. Second daughter Chey Min-jung (b. 1991) took a unique route, voluntarily serving as a South Korean naval officer, including an anti-piracy deployment. She later worked on policy and strategy for SK hynix in Washington D.C. before co-founding an AI-driven healthcare startup. She married a former U.S. Marine Corps officer, connecting her to U.S. defense and policy circles—networks crucial for a global semiconductor giant. The only son, Chey In-geun (b. 1995), who studied physics like his father, worked briefly at SK E&S before joining McKinsey. Despite fitting the traditional "heir" profile as the eldest son, he remains silent and holds no public position or shares in SK, suggesting the old succession playbook is obsolete. As SK hynix's valuation soars, becoming a geopolitical asset in the AI era, the heirs' legitimacy is no longer automatic. They must prove themselves in fields like AI biotech, global policy, and strategic consulting. Their marriages also reflect new elite networks in tech and defense, not old political alliances. Their inheritance is the complex challenge of navigating a globalized, tech-driven world, not just a corporate throne.

marsbitYesterday 09:06

The Verdict in Choi Tae-won's Divorce Case: Revealing the Inheritance Undercurrent Behind SK Hynix's Trillion-Won Empire

marsbitYesterday 09:06

Banks oppose stablecoin yield deal – Can CLARITY Act find 60 votes?

The Bank Policy Institute (BPI) has opposed the latest draft of the CLARITY Act, criticizing its provisions on stablecoin yield and illicit finance. The banking industry sought a total ban on stablecoin yield, but the bill's compromise only prohibits passive yield on idle balances. This opposition has influenced lawmakers, reducing tentative Republican Senate support to potentially 49 votes. With the 60-vote threshold needed, securing sufficient Democratic support appears difficult as some pro-crypto Democrats also oppose the bill due to ethics and illicit finance concerns. Senate Majority Leader John Thune expressed doubt the bill can pass before the August recess. Market odds for the bill's passage in 2026 have fallen, leaving its future uncertain.

ambcryptoYesterday 09:02

Banks oppose stablecoin yield deal – Can CLARITY Act find 60 votes?

ambcryptoYesterday 09:02

2 Months, Valuation Soars from $8.8B to $68B! The Largest AI Model Hub OpenRouter May Be Acquired

Stripe is reportedly in talks to acquire AI model marketplace OpenRouter for a price nearing $10 billion, a dramatic increase from its $1.3 billion valuation just two months prior. The deal, which could be announced within a month, would see the payment giant absorb a key "router" or aggregation layer in the AI infrastructure stack. OpenRouter provides developers with a single API to access over 400 large language models (LLMs), automatically routing queries to the most suitable model based on cost, capability, and speed. This allows AI applications to optimize expenses while maintaining user experience. Founded in 2023 by ex-OpenSea co-founder Alex Atallah and Louis Vichy, OpenRouter has grown rapidly, reaching $50 million in annualized revenue by April and serving over one million developers. For Stripe, the acquisition of OpenRouter follows its late-2025 purchase of usage-based billing platform Metronome. The combined strategy aims to create an integrated suite for the AI economy: OpenRouter would handle model selection and routing, Metronome would manage granular usage-based billing, and Stripe's core platform would process payments. This positions Stripe to control a critical part of the AI application value chain, influencing which models get used while simplifying cost management for enterprise customers.

链捕手Yesterday 08:59

2 Months, Valuation Soars from $8.8B to $68B! The Largest AI Model Hub OpenRouter May Be Acquired

链捕手Yesterday 08:59

From OpenSea to OpenRouter: Is Alex Atallah Repeating His 'Exit at the Peak' Playbook?

From OpenSea to OpenRouter: Is Alex Atallah Repeating His "Exit at the Peak" Playbook? According to the Wall Street Journal, payments giant Stripe is in talks to acquire the AI model aggregation platform OpenRouter in a potential deal valuing the company near $100 billion. This would mark founder Alex Atallah's second creation of a company reaching a $100 billion valuation, following his co-founding of NFT marketplace OpenSea. OpenRouter, founded just over three years ago, has grown rapidly by acting as a unified gateway for developers to access over 400 AI models. It currently has about 10 million users and processes over 200 trillion tokens monthly. While the platform's annualized revenue is around $50 million, its valuation has skyrocketed from $1.3 billion in March 2026. The potential acquisition by Stripe, a company OpenRouter's founder once likened it to, represents a major expansion into AI infrastructure for the payments leader. This move echoes Atallah's previous timing with OpenSea, where he departed before the NFT market's significant downturn. For OpenRouter, selling now may be strategic. Despite its scale, its business model—charging a 5-5.5% fee on AI inference calls—faces pressure from competition, open-source models, and potential price wars among model providers, limiting its profitability narrative for an IPO. A key asset for potential acquirers like Stripe is OpenRouter's vast repository of real-world AI usage data, which offers unique insights into model performance and developer preferences that are difficult to replicate. Whether this potential deal signifies a new valuation benchmark for AI infrastructure or another market peak signal remains to be seen.

链捕手Yesterday 08:42

Pons V2 brings RWA trading pairs as Robinhood Chain broadens its ambitions

Pons, a key launchpad on Robinhood Chain, has launched its V2 upgrade. The update aims to boost liquidity, remove trading restrictions for most users via an ETH-denominated bonding curve, and introduces support for custom tokenized real-world asset (RWA) trading pairs. This aligns with Robinhood Chain's broader RWA focus. The upgrade also allows creators to collect fees in ETH by default. The network itself is growing rapidly, surpassing $300 million in Total Value Locked. Its cumulative DEX volume has exceeded $9 billion, with about 80% coming from speculative memecoin trading. However, data shows 63% of traders are at a loss, with profits concentrated in a small number of wallets. The introduction of RWAs could help drive more organic adoption for the chain, which is positioning itself as a major player for speculative trading, challenging networks like Base and Solana.

ambcryptoYesterday 08:26

Trading

Spot