Ethereum, Solana Top $1B Crypto Hack Losses in H1 2026
Crypto losses exceeded $1B in H1 2026, the most hacks in a half-year, per Blockaid. Ethereum and Solana each lost over $300M, with code exploits and key compromises as main vectors. Solana's losses surged due to North Korean-linked breaches of signing infrastructure, while Ethereum remains a prime target for DeFi exploits.
Quick Take
Over $1B in losses from 212 security incidents in H1 2026
Ethereum ($332M) and Solana ($326M) led losses, mostly from code exploits and key compromises
Solana's 2.5x increase from 2025 driven by North Korean-linked attacks on key infrastructure
Largest exploit: KelpDAO at $292M; key compromises hit Humanity Protocol and StablR
Market Impact Analysis
BearishRising hack losses and specific vulnerabilities could deter institutional and retail investors, especially on Ethereum and Solana.
Speculation Analysis
Key Takeaways
- Crypto losses exceeded $1 billion in H1 2026 from 212 security incidents, marking the most hacks in a half-year, per Blockaid.
- Ethereum ($332M) and Solana ($326M) led losses, driven by code exploits on Ethereum and key compromises on Solana.
- Solana's losses surged 2.5x from 2025, with over 98% attributed to compromised keys linked to North Korean groups.
- KelpDAO's $292 million exploit was the largest single incident, followed by key breaches at Humanity Protocol and StablR.
What Happened
The crypto industry bled over $1 billion from hacks in the first half of 2026, the worst six-month stretch on record. Onchain security firm Blockaid tracked 212 security incidents, with Ethereum and Solana absorbing the heaviest blows. Ethereum lost roughly $332 million, while Solana saw $326 million in stolen funds, together accounting for nearly two-thirds of all losses. The largest single exploit hit KelpDAO for $292 million, and Blockaid verified 3.4 times more high-threshold exploits than all of 2025. The surge marks a sharp escalation from prior periods and spotlights vulnerabilities across both networks.
The Numbers
Ethereum's $332 million in losses came mainly from code exploits in high-value DeFi protocols, while Solana's $326 million nearly matched it, a 2.5x increase from its 2025 total of $127 million. Compromised keys accounted for more than 98% of Solana’s losses, driven by breaches at Drift Protocol and Step Finance. Across both chains, Blockaid recorded 212 incidents, with the KelpDAO exploit alone representing over a quarter of all stolen funds. Ethereum saw additional key compromises at Humanity Protocol and StablR, while CoWSwap was the only major incident blamed on user error.
Why It Happened
Attackers exploited two distinct weaknesses. On Ethereum, code vulnerabilities in bridges, smart contracts, and privileged access points were the primary vectors, as the network hosts many of crypto’s most valuable applications. On Solana, the story flipped: attackers largely bypassed code and instead targeted signing infrastructure and organizational security. Blockaid linked many of the Solana breaches to North Korean cyber groups, who compromised keys to drain funds. The shift reflects a strategic focus on the weakest link — key management — rather than protocol-level flaws, catching projects and users off guard.
Broader Impact
The scale and nature of these hacks could cool institutional appetite for Ethereum and Solana, especially as key compromises become a dominant threat. Solana's rapid loss increase and the involvement of state-linked actors raise alarms about the maturity of crypto security practices. The data may accelerate calls for stronger key management standards and insurance mechanisms, while also pushing developers to harden signing infrastructure across chains.
What to Watch Next
- Monitor whether Solana projects adopt hardware security modules and multisig upgrades to counter key breaches, or if attacks continue to escalate.
- Regulatory scrutiny may intensify around exchange and protocol security practices, particularly for networks with high institutional exposure.
- The KelpDAO exploit could spawn copycat attacks; watch for similar restaking protocols tightening security.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
