Web3 losses hit $1.32 billion across 344 incidents in H1 2026

CertiK and other researchers said losses fell year over year, but Q2 was the worst quarter by hack count, with wallet compromises, Drift and Kelp driving concentrated damage.

21d ago

Fact Check

The Cointelegraph article confirms CertiK's $1.32 billion H1 2026 losses, 46.8% YoY decline, and $807.5 million Q2 losses. BlockBeats independently corroborates the same figures ($1.32B, 46.8% decline, Q2 $807.5M up 59% QoQ). PANews cites CertiK's Hack3d H1 2026 report directly with '344 incidents' and ~$1.32 billion. All numeric claims in the headline are corroborated across multiple sources reporting the same CertiK report. The claim's characterization of intensifying attack activity despite lower dollar losses matches CertiK's stated warning.

Summary

Web3 projects recorded 344 security incidents and about $1.32 billion in losses in the first half of 2026, according to CertiK, which said losses were down 46.8% from a year earlier mainly because there was no repeat of the $1.4 billion Bybit exploit. Researchers said attack activity remained elevated: Q2 2026 was described as the worst quarter on record by hack count with 99 exploits, while TRM Labs said it logged 207 crypto-related incidents in H1 2026, the highest six-month total it has recorded. Phishing led losses in Q1 at $508.2 million, but wallet compromises became the biggest attack method in Q2 at $807.5 million. Drift and KelpDAO accounted for more than 70% of Q2 wallet-compromise losses and were cited as driving more than 80% of second-quarter losses overall.

Terms & Concepts

wallet compromises: Attacks in which hackers gain unauthorized access to crypto wallets, often through stolen credentials or keys.
multisignature: A wallet control setup that requires approvals from multiple parties before funds can be moved.
smart contract exploits: Attacks that abuse flaws in blockchain-based code to steal funds or manipulate a protocol.