$1.26B+ GONE IN 2026
Hackers pulled $1.26 billion across 219+ incidents by late August. And that's just what we can track publicly.
H1 alone: ~$972M across 207 hacks (Immunefi)
July: ~$110M
August: $13M+ confirmed (plus Moonwell $8.79M, more after)
BIGGEST HITS:
$KelpDAO ~$290M
$Drift ~$280M
Coldcard ~$112M
Step Finance ~$27–40M
$AFX ~$24M
Humanity Protocol ~$36M
Resolv USR ~$23M
$BONK DAO ~$21M
Ostium ~$23.75M
$THORChain ~$10.7M
Some incidents still disputed or unverified (e.g., unknown user $282M, OneKey, FOMO app).
The scary part?
Most hacks aren't even smart-contract bugs anymore.
Private keys
Dev machines
Infrastructure
Governance
Bridges
Supply-chain
One compromised key = hundreds of millions at risk.
2026 is proving audits aren't enough. If your OpSec is weak, you're exit liquidity for hackers.
Hackers pulled $1.26 billion across 219+ incidents by late August. And that's just what we can track publicly.
H1 alone: ~$972M across 207 hacks (Immunefi)
July: ~$110M
August: $13M+ confirmed (plus Moonwell $8.79M, more after)
BIGGEST HITS:
$KelpDAO ~$290M
$Drift ~$280M
Coldcard ~$112M
Step Finance ~$27–40M
$AFX ~$24M
Humanity Protocol ~$36M
Resolv USR ~$23M
$BONK DAO ~$21M
Ostium ~$23.75M
$THORChain ~$10.7M
Some incidents still disputed or unverified (e.g., unknown user $282M, OneKey, FOMO app).
The scary part?
Most hacks aren't even smart-contract bugs anymore.
Private keys
Dev machines
Infrastructure
Governance
Bridges
Supply-chain
One compromised key = hundreds of millions at risk.
2026 is proving audits aren't enough. If your OpSec is weak, you're exit liquidity for hackers.
