Overview
- Blockaid’s H1 report released July 28 recorded 212 verified incidents that drained roughly $1.1 billion from crypto projects in the first half of 2026.
- Operational security failures such as compromised private keys, stolen admin credentials, and poisoned off‑chain systems accounted for about three quarters of the stolen value.
- Two large breaches dominated totals: KelpDAO’s cross‑chain exploit on April 18 cost about $292 million and Drift’s privileged‑access attack on April 1 cost roughly $285 million.
- Blockaid attributed around 55% of losses to a single DPRK‑linked cluster, and independent trackers like TRM Labs report slightly lower but comparable totals, highlighting methodological differences.
- Affected teams have proposed recovery measures including Drift’s recovery pool and KelpDAO’s restorations while on‑chain movements of stolen funds continue, increasing pressure for isolated signing devices, key segregation, and tighter infrastructure monitoring.