Web3 projects recorded 344 security incidents and about $1.32 billion in losses in the first half of 2026, according to CertiK, which said losses were down 46.8% from a year earlier mainly because there was no repeat of the $1.4 billion Bybit exploit. Researchers said attack activity remained elevated: Q2 2026 was described as the worst quarter on record by hack count with 99 exploits, while TRM Labs said it logged 207 crypto-related incidents in H1 2026, the highest six-month total it has recorded. Phishing led losses in Q1 at $508.2 million, but wallet compromises became the biggest attack method in Q2 at $807.5 million. Drift and KelpDAO accounted for more than 70% of Q2 wallet-compromise losses and were cited as driving more than 80% of second-quarter losses overall.