KoinlyticsBlockaid counted 212 onchain exploits in the first half of 2026, with total losses crossing $1.1 billion, the highest tally for any first half on record. The security firm released its H1 2026 report on July 29, 2026, and the headline numbers tell a story that is worse than 2022's Ronin Bridge era in incident count, even if not quite as bad in total dollars.
The four hacks that account for most of the damage
The top four in dollar terms were KelpDAO ($292 million), Drift Protocol ($285 million), Resolv, and CowSwap. Combined, those four incidents drained approximately $707 million from users, protocols, and liquidity pools. Blockaid attributed the majority of the top tier attacks to actors linked to the Lazarus Group, the North Korean state affiliated threat cluster.
Lazarus linked attackers accounted for approximately 55% of all H1 2026 losses. That is a concentration ratio that should trouble every operator building on public infrastructure.
The vector shift, from smart contract to signer
The most important line in the report is not the dollar total. It is this: 74% of stolen funds resulted from operational security failures rather than exploited smart contract code. In practice that means the attackers are not finding zero days in Solidity or Anchor programs. They are compromising the humans who hold the signing keys.
Cross chain bridges remain a preferred point of attack. EVM Layer 2 exploits made the top three vector list as well, driven by immature governance keys and admin escape hatches.
Chain level breakdown
Ethereum and Solana absorbed the bulk of the damage at the network level. Ethereum saw approximately $332 million in stolen funds, driven mostly by smart contract exploits and cross chain bridge failures. Solana came in at approximately $326 million, driven by signer infrastructure flaws rather than program bugs.
What to watch
Whether any of the top four protocols publish full post mortems with clear root cause analysis and remediation. And whether restaking and liquid staking protocols tighten their signer arrangements.
Source: The Block