Crypto Losses Exceed $1 Billion in H1 2026, Ethereum and Solana Most Affected

Crypto losses surpassed $1 billion in the first half of 2026, marking the highest number of hacks recorded within a six-month period, according to onchain security platform Blockaid. Ethereum and Solana experienced the most significant losses, with approximately $332 million and $326 million in stolen funds, respectively.

Blockaid’s H1 2026 security report, released on Tuesday, detailed 212 security incidents during this timeframe. The largest single exploit, targeting KelpDAO, accounted for $292 million, and the platform noted a 3.4-fold increase in high-threshold exploits compared to the entirety of 2025.

Code exploits were the primary cause of incidents on Ethereum, while key and signing infrastructure breaches were responsible for the majority of Solana’s losses. Ethereum’s losses reflected the inherent risks associated with high-value protocols, with attackers predominantly targeting vulnerabilities within applications built on the network.

Blockaid stated that code exploits were the most frequent type of incident on Ethereum, with substantial losses also resulting from key compromises involving Humanity Protocol and StablR. CoWSwap, an Ethereum-based decentralized exchange, was identified as the sole major Ethereum incident in the report attributed to user error.

Blockaid identified common attack methodologies targeting Ethereum, including flaws in bridges and smart contracts, unauthorized access to privileged accounts, and market manipulation tactics. The report indicated that Ethereum remains a prominent target due to its hosting of numerous high-value crypto applications, such as restaking platforms, stablecoins, and decentralized exchanges.

Solana’s losses nearly matched Ethereum’s in the first half of 2026, representing a significant increase from the approximately $127 million in stolen funds recorded on the network in 2025. The shift in attack patterns on Solana did not stem from an increase in smart contract exploits.

Instead, compromised keys accounted for over 98% of Solana’s losses, largely driven by incidents involving Drift Protocol and Step Finance, which Blockaid linked to cyber groups associated with North Korea. Unlike Ethereum, where attackers primarily exploited vulnerabilities in protocol code, Solana incidents focused on signer infrastructure and organizational security. A limited number of code exploits involving Raydium and Volo constituted the remaining losses.