Crypto is being hacked more often than ever in 2026 — but each hack is getting smaller. Our analysis of DeFiLlama’s incident data counts 158 separate crypto hacks in the first seven months of 2026, already more than the 97 recorded in all of 2025. Yet total funds stolen ($1.08B) are running below last year’s $2.55B, and the average hack has shrunk from $26.3M to $6.8M.
Key findings
- 158 hacks in 7 months — a record pace, ~23/month vs ~8/month in 2025.
- Average haul collapsed to $6.8M from $26.3M in 2025.
- Private key compromise is the #1 vector by frequency — 13 incidents.
- The two biggest — Drift Trade ($295M) and Kelp ($293M) — are over half of 2026’s total.
The analyst’s read
So here’s what the numbers actually say, and it’s not the headline everyone will run with. The story of 2026 isn’t the dollar figure — it’s the frequency. Attackers have industrialized. One hack every 32 hours, on average, and climbing.
My read: the mega-target era is fading. The soft $300M bridges that defined 2022–2024 got hardened, audited, or drained already — so the average haul cratered from $26M to under $7M. What’s left is grind. A long tail of small DeFi protocols, hot wallets, and — over and over — private keys that should never have been exposed. That’s not clever cryptography getting broken. That’s opsec: phishing, leaked seed phrases, compromised admin machines. The boring stuff still writes most of the checks.
Strip out April’s two outliers (Drift and Kelp, ~$290M each) and 2026 reads as death by a thousand cuts. Which is arguably worse for the space than one spectacular bridge exploit — because you can’t patch a vector that’s really just human hygiene across a thousand teams.
What I’m watching next: if frequency keeps climbing while the average haul stays low, this stops being a ‘DeFi is risky’ story and becomes a security-culture problem for the whole industry. The exchanges that survive won’t be the ones with the best contracts — they’ll be the ones that treated key management like the crown jewels it is. Yes, really.
Crypto hacks by year (2020–2026)
| Year | Incidents | Total stolen | Avg per hack |
|---|---|---|---|
| 2020 | 17 | $3.68B | $216.7M |
| 2021 | 71 | $2.36B | $33.2M |
| 2022 | 67 | $3.34B | $49.8M |
| 2023 | 97 | $1.52B | $15.6M |
| 2024 | 94 | $1.27B | $13.5M |
| 2025 | 97 | $2.55B | $26.3M |
| 2026 (Jan–Jul) | 158 | $1.08B | $6.8M |
Biggest crypto hacks of 2026
| Protocol | Amount | Date | Method |
|---|---|---|---|
| Drift Trade | $295M | Apr 01 | Compromised Admin + Fake Token Price Manipulation |
| Kelp | $293M | Apr 18 | LayerZero OFT bridge exploit |
| Step Finance | $40M | Jan 31 | Private Key Compromised |
| Humanity | $32M | Jun 08 | Private Key Compromised |
| Truebit | $26M | Jan 08 | Bonding Curve Exploit |
| Resolv USR | $24M | Mar 21 | Private Key Compromised |
| AFX Bridge | $24M | Jul 22 | Private Key Compromised |
| Ostium | $24M | Jul 15 | Price Oracle Manipulation |
Attack vectors in 2026
| Technique | Incidents | Stolen |
|---|---|---|
| Compromised Admin + Fake Token Price Manipulation | 1 | $295M |
| LayerZero OFT bridge exploit | 1 | $293M |
| Private Key Compromised | 13 | $140M |
| Price Oracle Manipulation | 5 | $47M |
| Bonding Curve Exploit | 1 | $26M |
| Hot Wallet Compromise | 2 | $25M |
| Malicious Governance Proposal | 3 | $24M |
| Bridge Verification Bypass | 3 | $20M |
Methodology
Based on DeFiLlama’s public crypto hacks dataset (on-chain exploits, private-key compromises, protocol breaches). Data as of July 29, 2026; 2026 covers January–July and will rise. Analysis and charts by BullpenBrief — free to cite with a link to this page.
