TRM says crypto hacks rose, but biggest losses came from ops

Crypto investors may see the lower dollar total in 2026 and assume security is improving. TRM Labs' latest data points to a different risk. In the first half of 2026, the firm recorded 207 hacks, its highest six-month count on record, while total losses fell to $972 million from $2.3 billion a year earlier.

Most incidents were still tied to smart-contract exploits. TRM said 125 of the 207 hacks came from contract-level attacks. But the larger losses were concentrated elsewhere. Infrastructure and operational compromises made up about 15% of incidents, yet accounted for roughly 76% of the value stolen.

That puts the focus on who can move funds, approve transfers, or access signing systems. TRM highlighted private keys, custody, signing infrastructure, approval workflows, and other controls around protocols as the main source of outsized damage. The median hack was about $219,000, versus a mean of $4.7 million, showing how a small number of large breaches still shape the totals.

TRM also estimated that about $643 million, or 66% of stolen funds in H1, was linked to North Korea-linked activity. Nearly all of that came from two April attacks on Drift Protocol and KelpDAO, which together caused about $577 million in losses.