Crypto attacks in the first half of 2026: US$1.3 billion lost, Drift and Kelp DAO, and the patterns behind them
Two April attacks, on Drift and Kelp DAO, made up almost 44% of the half-year's losses. CertiK's report shows wallet compromise and social engineering lead the damage.
Historical reference: July 7, 2026. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- CertiK recorded US$1.31 billion in losses and 344 incidents in the first half of 2026, down 46.8% from the same period of 2025, which included the Bybit attack.
- Drift Protocol (US$285 million) and Kelp DAO (US$291 million), both in April, accounted for almost 44% of the total.
- Wallet compromise was the costliest vector (US$444.5 million in 33 cases); phishing had fewer cases, but of higher value.
- For companies, the pattern repeats: the weak point tends to be a person, a signature or infrastructure, not the contract code.
São Paulo, July 7, 2026 — Attacks on the crypto ecosystem totaled US$1.31 billion in the first half of 2026, according to the Hack3D report from security firm CertiK, published on July 6. There were 344 incidents, practically the same number as in 2025, but with lower losses: the previous first half had recorded US$2.47 billion, driven by the theft of about US$1.45 billion from Bybit.
The drop is misleading. Without Bybit, the first half of 2025 would have had losses of about US$1.03 billion, and on that basis, 2026's losses are roughly 28% higher, according to CertiK itself. For those who use stablecoins for payments, the report offers more lessons about how money is lost than about how much.
- Losses in 344 incidents in the first half of 2026 (CertiK, 7/6/2026)
- US$1.31 bn
- Funds frozen or returned; net loss of US$1.20 billion
- US$115.3 mn
- Share of two April cases: Kelp DAO and Drift Protocol
- ~44%
- Median loss per incident, against an average of US$3.8 million
- US$138,700
The half-year's numbers, by vector and by network
| Vector | Losses | Incidents | Takeaway |
|---|---|---|---|
| Wallet or key compromise | US$444.5 million | 33 | The costliest: few cases, very high amounts |
| Phishing and social engineering | US$366.3 million | 63 | Fewer cases than in 2025 (132), with a higher average value; four incidents are about 85% of the total |
| Code vulnerability | US$151.6 million | 204 | The most frequent, but low value per case |
By network, Ethereum concentrated US$522.8 million in 153 incidents. Solana totaled US$315.1 million, almost all from the Drift attack. The US$115.3 million frozen or returned shows that a quick response still recovers part of the money. CertiK also warns that actors linked to North Korea, such as the Lazarus group, tend to step up operations over the course of the year and that the second half deserves extra attention.
The two biggest cases: Drift and Kelp DAO
The amounts vary between sources: CertiK counts US$285 million for Drift and US$291 million for Kelp DAO, while Rekt News, which gathers accounts from the projects themselves and from analysts, cites US$285.3 million and about US$290 million. The technical descriptions below come from that coverage and from the projects' statements; the attribution to North Korean groups is, in both cases, preliminary.
In both cases, the contract code worked as written. What failed was the surrounding environment: who had the power to sign, which machines and network services were trusted and how many approvals were required. It is the same pattern as the Bybit attack, described in Bybit and the US$1.5 billion theft, and the trend noted in crypto theft in 2025.
The half-year's attack patterns
- Oct. 2025A group presenting itself as a trading firm begins contacting Drift contributors, according to the project.
- Apr. 1, 2026Drift Protocol: administrative control transferred and vaults emptied within minutes.
- Apr. 18, 2026Kelp DAO: single verifier compromised, fake message signed and rsETH released.
- Jul. 6, 2026CertiK publishes the first-half Hack3D: US$1.31 billion in 344 incidents.
- Few targets, enormous amounts. Two cases explain almost half of the losses. The risk is concentrated in protocols and bridges with a lot of money and few signers.
- A person as the way in. Long-running contact, code repositories and test apps were the bait at Drift. The same warning applies to fake suppliers and bank detail swaps.
- Advance signatures with no waiting period. At Drift, pre-authorized signatures and a 2-of-5 approval threshold allowed immediate administrative changes, which critics pointed to as the lack of a security delay.
- Minimal configuration by default. At Kelp, a single verifier was enough. The discussion over who should have required more verifiers continued between the project and LayerZero.
What a company can apply
Require more than one approval to move funds. Use a dedicated device to sign transactions and do not run third-party code on it. Check the destination address through a second channel before sending. Treat requests to change a wallet or account as suspicious until confirmed by a known phone number.
For a company that only pays suppliers with stablecoins, the main risk is not the lending protocol: it is an address error, swap-of-details fraud and loss of access. There is no coverage from Brazil's deposit guarantee fund (FGC) for virtual assets, and a confirmed transfer is irreversible. For that reason, it is advisable to keep funds sitting in stablecoin for as short a time as possible and to retain the documentation of each payment.
The half-year's data show the direction of the threat: fewer contract attacks and more attacks on people, keys and infrastructure. Defense also depends on process, not just technology.
Frequently asked questions
How much was lost in crypto attacks in the first half of 2026?
CertiK counted US$1.31 billion in 344 incidents, with US$115.3 million frozen or returned, leaving the net loss at about US$1.20 billion. Other analytics firms use different methodologies and may report different totals.
What were the biggest attacks of 2026 through July?
In April, Drift Protocol, on Solana (about US$285 million, on April 1), and Kelp DAO, with rsETH (about US$290 million, on April 18). Together, they account for almost 44% of the half-year's losses, according to CertiK.
What was the costliest type of attack in 2026?
Wallet and key compromise, with US$444.5 million in 33 incidents. Phishing totaled US$366.3 million in 63 cases, and code vulnerabilities, US$151.6 million in 204 cases, the largest number of incidents.
Is North Korea behind the 2026 attacks?
The Drift and LayerZero projects preliminarily attributed April's two biggest attacks to groups linked to North Korea, and Elliptic and TRM Labs pointed to North Korean actors in the Drift case. The attribution remains subject to confirmation by authorities. CertiK warns that these groups tend to step up activity in the second half.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- CertiK Hack3D: H1 2026 Report · CertiK, Jul 6, 2026
- Drift Protocol — Rekt · Rekt News, Apr 9, 2026
- KelpDao — Rekt · Rekt News, Apr 24, 2026
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
