Crypto hacks hit a record count but the biggest threat isn’t smart contracts

An important story is making waves across the blockchain ecosystem. Crypto hack counts just set a record. The warning in TRM Labs' latest data is where the money is actually being lost. In its H1 2026 crypto hack review, TRM Labs said attackers carried out 207 separate hacks in the first half of the year, the most the firm has recorded in any six-month period.

Yet total losses fell to $972 million, less than half the $2. 3 billion stolen during the first half of 2025. That split changes the security story.

Market Dynamics

More protocols, tokens, and decentralized applications are being hit, but the losses that still define the year are concentrated in operational systems: keys, custody, signing infrastructure, approval flows, and other controls around the code rather than the code alone. For DeFi teams, smart-contract audits remain necessary because smart-contract exploits accounted for most incidents. The losses that can erase hundreds of millions of dollars increasingly come from systems that decide who can move funds, how signatures are approved, and how infrastructure around a protocol is trusted.

More incidents, smaller typical losses TRM said the number of hacks more than doubled from 83 incidents in H1 2025 to 207 in H1 2026. Q2 alone produced 123 incidents, after a record-setting first quarter. Most of that increase came from smart-contract exploits, which accounted for 125 of the 207 incidents.

The typical loss, however, was much smaller than the headline total suggests. TRM put the median hack at about $219,000, while the mean was $4. That gap shows how a few very large incidents can dominate aggregate losses, even as the day-to-day threat environment becomes more crowded with smaller exploit attempts.

Market Impact

The result is a split security picture. On the one hand, DeFi is still dealing with code-level vulnerabilities, complex protocol logic, and multi-step manipulations that lead to frequent losses. On the other hand, the largest damage is coming from failures in the systems that hold or authorize control of funds.

Related Reading DeFi hacks are turning high yields into a hidden liquidity tax DeFiLlama data shows $780. 3 million in Q2 known losses as bridges, keys and protocol logic turn security into a live cost of participation. Jun 30, 2026 Liam 'Akiba' Wright TRM said infrastructure and operational compromises accounted for only about 15% of incidents in H1 2026 but roughly 76% of stolen value.

That ratio turns the report from a hack-count story into a security-priority story. If a protocol treats audits as the whole security program, it is defending only part of the risk. An attacker can skip the core contract by compromising a signer, manipulating a bridge validation path, poisoning an operational dependency, or obtaining approval for a malicious transfer.

Crypto markets are watching this development closely as investors weigh its potential impact on prices.