More Crypto Hacks Than Ever in 2026, But Smaller Losses

Crypto attackers launched 207 separate incidents in the first six months of 2026, the most ever recorded in any half-year period, according to blockchain analytics platform TRM Labs. Yet the total value stolen in those attacks, about $972 million, came in at less than half the $2.3 billion taken from victims in the first half of 2025.

Put those two numbers side by side and a split picture emerges: attackers are trying more often, but on average they are walking away with far less than they did a year earlier.

More attempts, less to show for them

TRM Labs’ count of 207 incidents spans the January-through-June window of 2026 and is described as the highest tally the firm has recorded for any six-month stretch. That is a statement about frequency, not severity. The dollar total for the same period, roughly $972 million, is the other half of the picture, and it fell sharply from the $2.3 billion TRM Labs attributed to the first half of 2025.

The two figures moving in opposite directions is the headline here. A record incident count paired with a steep drop in stolen value suggests that whatever is happening across the industry’s security landscape in 2026, it is not simply “more of the same, but bigger.” It looks more like a larger number of smaller-scale events rather than a handful of catastrophic ones, though the underlying data does not spell out why that shift occurred.

A single source, and its limits

Both figures in this comparison trace back to one analytics firm, TRM Labs, as cited in reporting on the period. Different firms that track on-chain theft do not always use identical methodology or count the same set of incidents, so a reader comparing this half-year figure against a different tracker’s number elsewhere should expect some variation between sources. That is a general caveat about single-source hack tallies, not a suggestion that TRM Labs’ figures here are disputed.

What it means

TRM Labs’ figures do not, by themselves, explain why the pattern shifted. The firm’s tally covers a wide range of attack types across exchanges and trading platforms as well as individual wallets, and the underlying report does not break down how much of the decline in dollar losses is attributable to any single cause. Readers should treat the half-year comparison as a data point, not a verdict on whether crypto security overall got better or worse in 2026.

It is also worth remembering that self-custody carries its own risk profile. Holders who keep assets in cold storage rather than on an exchange are not automatically insulated from the incidents captured in TRM Labs’ count, since the tally spans both categories. For a sense of how the two situations differ operationally, see our explainer on what happens when an exchange gets hacked versus a breach that targets individual holders directly.

Investors weighing where and how to hold crypto assets should read half-year hack tallies like this one for what they are: a snapshot from one analytics firm, covering one period, that can and will be revised as investigations continue. Practicing sound self-custody hygiene remains a separate question from any single year’s aggregate hack statistics. A record incident count, even alongside a lower dollar total, is itself a reason for individual holders to keep their own security practices current rather than assume that smaller industry-wide losses mean lower personal risk.

Sources

• Fortune — What we know about the Coldcard exploit (cites TRM Labs half-year figures)

Nothing here is investment, legal, or tax advice. Crypto is volatile and high-risk; prices can fall as well as rise. Consult a licensed professional before making financial decisions.