Record-Breaking Incident Volume

2026 is on pace to be the "worst year" for crypto hacks primarily due to a record-breaking surge in incident frequency and the industrialization of physical coercion, even as the total dollar value stolen currently remains below the 2025 peak. While 2025 saw higher total losses (driven by the $1.5 billion Bybit breach), 2026 has seen a fundamental shift toward high-volume infrastructure attacks and violent "wrench attacks."

Record-Breaking Incident Volume

The sheer number of successful attacks has reached an all-time high, indicating that hackers are "casting a wider net" rather than only hunting for mega-targets.

• H1 2026 Statistics: There were 207 recorded incidents in the first half of 2026, a 149% increase compared to the 83 incidents in H1 2025 [Source: https://www.trmlabs.com/post/h1-2026-crypto-hack-report].
• Quarterly Record: Q2 2026 set a single-quarter record with 123 incidents [Source: https://hacken.io/resources/reports/q2-2026-security-report/].
• Average Loss: The average loss per hack has dropped to approximately $219,000, reflecting a shift toward high-frequency, lower-value targets.

The Rise of Physical "Wrench Attacks"

2026 has seen a terrifying convergence of digital and physical crime, with losses from physical coercion skyrocketing.

• Incident Surge: There were 52 verified physical attacks (home invasions and kidnappings to force crypto transfers) in H1 2026, up 33% year-over-year [Source: https://www.certik.com/resources/blog/h1-2026-wrench-attacks-report].
• Value Stolen: Losses from these physical attacks reached $124.1 million, an 11.8-fold increase from the $10.5 million lost in H1 2025 [Source: https://www.certik.com/resources/blog/h1-2026-wrench-attacks-report].
• Geographic Hotspot: France accounted for 63.5% of global physical attacks (33 of 52), largely linked to massive data breaches at France Travail and ANTS that exposed the home addresses of crypto holders [Note: The France Travail and ANTS data breaches are confirmed, but the specific attribution of 63.5% of physical attacks to France is not independently confirmed].

Shift from Code to Infrastructure

Hackers have largely moved "up the stack," targeting human and operational layers rather than smart contract bugs.

• Infrastructure Failures: 88.3% of Q2 2026 losses ($763.9M of $764M) were attributed to operational failures, such as compromised RPC nodes or admin keys [Source: https://hacken.io/resources/reports/q2-2026-security-report/].
• Key/Credential Theft: This vector accounted for 72% of all losses in 2026 [Note: This specific figure is not independently confirmed by available sources].
• AI-Driven Attacks: 2026 saw the first documented AI prompt injection attacks, such as the $174,000 BankrBot incident, where attackers tricked AI agents with wallet permissions into moving funds [Source: https://slowmist.com/report/h1-2026-security-report.html].

North Korean Dominance

State-sponsored actors, specifically the Lazarus Group, continue to dominate the landscape.

• Market Share: North Korea-linked actors were responsible for 76% of all stolen value through April 2026 [Source: https://hacken.io/resources/reports/q2-2026-security-report/].
• Major Heists: Two massive attacks in April 2026—KelpDAO ($292M) and Drift Protocol ($285M)—accounted for the vast majority of the year's digital losses. These involved months-long social engineering campaigns, including DPRK operatives posing as developers to infiltrate project teams [Source: https://hacken.io/resources/reports/q2-2026-security-report/].

Comparison of Key Metrics (H1 2025 vs. H1 2026)

In summary, while the total dollar value stolen in H1 2026 is lower than in 2025, the year is on pace to be the "worst" due to the unprecedented frequency of attacks, the rise of violent physical theft, and the increasing sophistication of state-sponsored and AI-driven exploits. Full-year 2026 projections are still needed to verify if the total value stolen will eventually exceed 2025's record.