Crypto Hack Losses Stay Under $1 Billion in H1 2026 Despite Record Number of Attacks

Crypto projects lost roughly $972 million across 207 hack incidents in the first half of 2026, the highest number of incidents ever recorded, according to Immunefi’s June 2026 Ecosystem Update. Even so, total losses came in under $1 billion, less than half of what the industry lost during the same period in 2025.

Attacks More Frequent, Less Costly

The data points to a shift in pattern: hacks are happening more often but causing less damage per event. DeFi exploit losses have dropped 74% from their 2022 peak of $2.62 billion down to $680.3 million, with the median loss per exploit falling 75% over the same stretch. Immunefi credited the decline to ongoing security coverage, bug bounty programs, audit competitions and a growing pool of researchers catching vulnerabilities before attackers can exploit them.

Full-year DeFi losses came to $680.3 million in 2025, up slightly from $534 million in 2024, a rise Immunefi tied to the growing complexity of multi-chain deployments rather than weaker security overall.

Threats Shift Toward Infrastructure

Smart contract bugs still play a role, but the report found the most severe losses now come from infrastructure failures, stolen private keys, cross-chain configuration mistakes and weak privileged access controls. Bridge exploits, once the biggest source of DeFi losses, have largely faded, while flash-loan attacks, common back in 2020, now account for a tiny fraction of losses.

Bug Bounty Payouts Keep Growing

During H1 2026, Immunefi paid researchers about $13.45 million to flag 837 valid bugs before they could be exploited, pushing lifetime researcher payouts past $140 million in June. The platform now counts more than 92,000 registered researchers and says it protects over $180 billion in assets across more than 650 protocols. CEO Mitchell Amador said crypto security remains adversarial and constantly evolving, but called the trend a sign the industry is learning.