Crypto Hack Statistics 2026: Biggest Heists, Losses and Attack Methods

For comparison, TRM Labs told Reuters that attackers stole $2.9 billion across nearly 150 attacks in 2025. Finbold puts the 2025 total at $2.78 billion.

The gaps come from method. Trackers differ on which incidents they count and when they record a value.

Finbold notes that its figures show the gross value affected at the time of each incident. Funds that were later returned, frozen or recovered can still appear in the total.

This article ties each number to its source. For trends, it is safer to compare figures from the same tracker than to mix sources.

The Biggest Crypto Heists of All Time

Reuters lists five thefts as the largest since bitcoin was created in 2008. The most recent one sits at the top.

In February 2025, about $1.5 billion worth of ether was stolen from the exchange Bybit. Researchers called it the largest crypto theft so far.

---

---

The FBI said North Korea was responsible. It said the funds were quickly converted into other cryptocurrencies and spread across thousands of addresses on several blockchains. North Korea has denied organizing crypto heists.

Poly Network was hit in August 2021. The hackers later returned nearly all of the money. The case showed weak spots in decentralized finance, where users lend, borrow and save without banks.

The Ronin attack in March 2022 targeted a network that moves coins between blockchains. The Coincheck theft in January 2018 hit a “hot wallet,” which is a digital folder stored online. South Korea’s intelligence agency said a North Korean group may have been behind it.

Mt. Gox lost bitcoin worth close to $500 million between 2011 and 2014. About 24,000 customers lost access to their funds.

These amounts are values at the time of each theft. Price swings in crypto mean the dollar value today could be very different.

A recent case is Bitget, which said in September 2026 that about $350 million was stolen, according to Reuters. Finbold records the Bitget hack at $387.5 million, so reports differ on the final number.

First Half of 2026: More Hacks, Less Money

TRM Labs recorded 207 hacks in the first half of 2026. That is the most it has seen in any six-month period.

Losses came to $972 million. That is less than half of the $2.3 billion stolen in the first half of 2025.

The number of incidents more than doubled from 83 a year earlier. Q2 2026 set a record with 123 incidents, after a record first quarter. By subtraction, Q1 had about 84.

The rise was steady through the half. It was not driven by a single month.

Smart contract exploits made up 125 of the 207 incidents. TRM says these attacks increasingly combine several manipulations into one exploit instead of relying on one coding flaw.

Most stolen funds came from financial services and crypto-native platforms. Smart contract attacks drove incident counts but caused only a small share of the money lost.

TRM says the number of incidents keeps rising because the attack surface keeps growing. Thousands of DeFi protocols, tokens and smart contracts give attackers more targets.

The lower total reflects the lack of a theft as large as the biggest ones in 2025. TRM does not read it as a sign that risk has fallen.

Q3 2026: Losses Climb Again

CertiK counted 247 security breaches between July and September 2026. Losses totaled $1.26 billion.

September was the worst month of the year so far, with 99 incidents. That was the most in a single month since February 2025. In September alone, $768.5 million was stolen from exchanges, accounts and wallets.

Finbold, using SlowMist data, puts Q3 losses at more than $1.17 billion. That is about 23% more than the $955 million it records for the entire first half.

Finbold’s monthly numbers show how uneven the quarter was. July had 35 incidents and more than $224 million in damage. August had nearly 40 attacks and almost $188 million.

September had 50 known incidents and roughly $762 million. The month alone made up about 65% of Finbold’s quarterly total.

The two trackers disagree most on incident counts. They agree on the pattern: September was the peak, and a handful of large attacks drove the dollar totals.

The rise in thefts came while crypto prices were also rising. CertiK notes that Bitcoin gained 42% in Q3 and that investors put billions into spot Bitcoin and Ethereum ETFs.

CertiK wrote that “with both losses and incident count reaching their highest levels of 2026, the month’s data reinforces the need for security across every layer.”

The Five Largest Hacks of Q3 2026

A small group of attacks shaped the quarter. Finbold found that the five largest affected a combined $952 million, or 81% of the three-month total.

The headline values do not always match what attackers kept. The Liquid Network funds were mostly returned. Tectonic’s chain was rolled back before most of the money left.

Several other Q3 attacks left criminals with nothing. These include the August Oraichain exploit, the August Zeus infrastructure compromise and the July Across signal spoofing attack.

The Coldcard case stands out for another reason. It involved a hardware wallet, which has long been seen as one of the safest ways to store crypto.

The AFX Bridge exploit shows a pattern also seen in larger cases. Attackers went after signing keys rather than flaws in code.

Reuters reported that Bitget said the theft was about $350 million. The gap with Finbold’s $387.5 million is a reminder that early and final figures can differ.

North Korea and State-Sponsored Theft

TRM assesses that about $643 million, or 66% of all funds stolen in H1 2026, came from North Korea-linked activity. That is down from roughly $1.7 billion in the first half of 2025.

North Korea was still the largest source of stolen value in both periods.

Nearly all of the 2026 total came from two attacks in April. The Drift Protocol breach cost about $285 million. The KelpDAO exploit cost about $292 million.

KelpDAO was the largest single incident of the half. By itself it made up just under 30% of all funds stolen.

Earlier this year, TRM said the two incidents made up 71% of hack losses through April. The share fell to about 66% by the end of June as other incidents added up and North Korea’s total stayed the same.

TRM does not describe this as slower activity. It says the rest of the ecosystem simply saw fewer large thefts than in 2025.

TRM assesses these attacks as state-directed financial operations that involve compromises of infrastructure. It does not see them as opportunistic code exploits.

The $643 million counts only hacks and exploits. North Korea also earns crypto through phishing, social engineering, fraud, scams and covert IT worker schemes, so the real total is higher.

North Korea-linked groups have been named in earlier cases as well. The FBI blamed North Korea for Bybit, and South Korea’s intelligence agency said a North Korean group may have been behind Coincheck.

Attack Methods: Why Infrastructure Matters Most

TRM’s data shows a split between what drives the number of hacks and what drives the dollars lost.

Infrastructure and operational compromises were about 15% of incidents but about 76% of funds stolen. These attacks target the systems, credentials and signing tools that control assets, not flaws in on-chain code.

Smart contract exploits were the opposite. They made up the majority of incidents, 125 of 207, but only a small share of losses.

TRM’s FAQ says the infrastructure losses were chiefly private-key and seed-phrase theft. The remaining losses came from a handful of other attack types, including a $24 million “wrench” attack, which is physical coercion.

The typical hack is far smaller than the average one. The median hack cost about $219,000, while the mean was $4.7 million, more than 20 times higher.

A few very large incidents pull the average up. The median better reflects the everyday threat.

TRM’s advice for organizations holding assets is to keep funding smart contract audits. It also says to give equal attention to key management, signing systems, approval workflows and custody, using hardware-backed signing and multi-party approval for large transfers.

On the exchange side, stolen funds usually move through cross-chain bridges and no-KYC swap services before reaching exchanges. TRM says checking only the first hop is not enough and that institutions need multi-hop monitoring.

TRM also points to its Beacon Network, which has more than 70 members. It says members can cut response times from days to minutes once attacker addresses are known.

Wallet Drainer Statistics: Losses and Victims

A wallet drainer is a phishing tool. It tricks a user into approving a harmful transaction or signature.

It usually does not need a seed phrase or password. It abuses approvals such as approve, Permit and Permit2, so the attacker can move assets later.

Scam Sniffer’s data shows wallet-drainer phishing losses of $494 million across more than 332,000 wallets in 2024. In 2025, losses fell to about $83.85 million across 106,106 wallets.

That is a drop of 83% in losses and 68% in affected wallets. The data covers observed EVM wallet-drainer and signature-phishing cases. It is not a full count for every blockchain or every kind of wallet theft.

The top of the range also shrank. Scam Sniffer recorded 30 drainer incidents above $1 million in 2024, and the largest was $55.4 million. In 2025 the largest was $6.5 million.

Drainer campaigns depend on getting links in front of users. Common routes include fake airdrops and mints, cloned websites, malicious ads, and hijacked X, Discord and Telegram accounts.

Wallet drainers are one slice of a wider problem. Personal-wallet compromise also includes malware, seed theft, impersonation and address poisoning. Drainer figures should not be added to other totals unless the categories are known not to overlap.

Drainer Groups and Loss per Wallet

Losses fell faster than victim numbers. DeepStrike calculated that the implied loss per affected wallet was about $1,488 in 2024 and $790 in 2025, a drop of about 47%.

The 2024 wallet count is reported as “more than 332,000,” so the 2024 figure is best read as an upper-bound estimate.

Many campaigns ran on a service model called drainer-as-a-service. Operators supply scripts, phishing templates, hosting and support, and affiliates share revenue with them.

The model lowered the technical barrier. Affiliates could run campaigns without writing wallet-draining code, while a few providers held most of the capability.

Retirements disrupted affiliate networks but did not end the business. Affiliates could move to other services or rebranded kits.

Several factors may explain the 2025 decline. DeepStrike lists major brand exits, stronger wallet warnings, faster takedowns, market conditions and a possible shift to tactics outside the drainer category.

The dataset does not measure how much each factor contributed, so the link is correlation rather than proven cause.

Address poisoning is a related scam but is not a drainer. It plants a look-alike address in a victim’s transaction history and does not rely on a signature, so it is left out of drainer totals.

Outlook for Q4 2026 and How to Reduce Risk

Finbold says Q3 pushed the 2026 total to about $2.1 billion. That is less than $700 million short of the $2.78 billion it records for all of 2025.

Unlike 2025, the total passed $2 billion without one giant theft like the $1.5 billion Bybit hack.

The start of Q4 points to more activity. Finbold counted 11 known hacks in the first nine days of October.

Finbold also says reporting delays can raise totals long after a quarter ends. It adds that rising prices increase the value of every stolen coin and give criminals more reason to attack.

It also points to a rise in self-described activist hackers, including the group behind the Liquid Network case. It cites reports of AI firms using agent tests against competitors or governments as a possible new tool for attackers.

TRM reaches a similar view. It says the conditions behind the record 2025 losses remain in place and that both large infrastructure attacks and smaller code exploits will keep shaping the industry.

DeepStrike lists steps users can take against drainer-style attacks:

• Reach projects through bookmarks or verified official channels.
• Treat unsolicited links, ads, direct messages and reply-thread links as untrusted.
• Read every signature request and check broad approvals.
• Use wallets that simulate transactions and warn about malicious signatures.
• Revoke old token and NFT approvals.
• Keep daily-use funds apart from long-term holdings.
• Check the full destination address, not just the first and last characters.

Sources

1. Reuters: Crypto’s biggest hacks and heists (September 25, 2026)
2. TRM Labs: H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion
3. CertiK security data, as reported by Cryptoprowl: Crypto Industry Lost $1.26 Billion To Hacks In Third Quarter (October 1, 2026)
4. Finbold: Over $1.17 billion stolen in crypto hacks in Q3 2026 (October 9, 2026)
5. DeepStrike: Crypto Wallet Drainer Statistics 2026: Losses, Victims and Major Operations
6. Scam Sniffer: wallet drainer reports
7. SlowMist: Blockchain Security and AML Reports
8. Group-IB: Inferno Drainer investigation