The first half of 2026 was the worst stretch on record for crypto-security losses, according to Blockaid's H1 report published July 28. On-chain losses climbed to roughly $1.1 billion across 212 verified incidents — already more than all of 2025 combined, Blockaid said — with a single attacker cluster linked to the Democratic People's Republic of Korea accounting for 55% of the losses alone.
The headline numbers bury a more important structural shift. According to Blockaid, 74% of the stolen value came from operational-security failures rather than exploited smart-contract code. In other words, attackers are not breaking contracts — they are breaking the people and credentials that run them.
The shift from code bugs to operational breaches
Blockaid's figures point to a clear change in how attackers approach crypto infrastructure. Compromised devices, privileged credentials, private keys, signing-system compromises and off-chain infrastructure takeovers produced most of the measured losses. The defining detail: these attacks generate valid-looking blockchain transactions because somebody inside the organisation with legitimate signing rights actually approves them. A smart-contract audit, however thorough, cannot stop a signing key that has already been phished.
Blockaid also flagged that the H1 incident count was roughly 3.4 times its 2025 total. Comparison across security firms remains rough — vendors use different definitions and coverage methods when compiling industry loss estimates — but the directional signal is unambiguous.
You Might Also Like: As Regulators Move on Crypto Perpetuals, Traders Are Still Confused About What a "Perp DEX" Actually Is
The North Korea cluster dominates the loss table
A single DPRK-linked cluster of operations accounted for the majority of the dollar value lost, Blockaid said, reflecting a hardening concentration pattern across the on-chain threat landscape since 2024.
Historically, North Korea-affiliated threat actors have specialised in long-haul social-engineering compromises — fraudulent job-recruitment outreach, planted developers, and wallet-drain payloads delivered via fake meeting apps — rather than contract-level exploits. The 55% loss share quoted by Blockaid leans naturally into the operational-breach category the report says dominates the year-to-date data anyway.
Implications for security teams in H2
The H1 data has practical consequences for the entire crypto-sec stack. If three-quarters of stolen value came from credential and operational compromise, then the most-impactful defensive spend in 2026 is not a deeper code audit. It is signing-key isolation, hardware-walled multi-sig, signer-on-call escalation, IP allow-lists for admin consoles and rigorous off-boarding for anyone who has ever touched a privileged key.
Project-level M&A activity and Chapter 11 filings may also accelerate in H2 — a theme ARK Invest's digital assets director Lorenzo Valente flagged separately on July 28 when he argued that crypto is entering its deepest consolidation phase, with revenue concentrating into a small number of applications. His take on shutdowns reads as the missing prequel to Blockaid's loss data: stressed balance sheets and shrinking teams create exactly the kind of operational gaps the H1 attacks exploited.
For users specifically, the H1 reading is a reminder that the most-effective wallet protection remains layered custody — taps, timelocks, and cold storage at the user side; and signer escrow, hardware-backed multi-sig and air-gapped key custody at the operator side. Blockaid expects the operational-breach category to remain dominant through the rest of the year.
