Crypto hacks hit 207 in H1 2026: what controls are lagging?

TL;DR: Crypto hacks hit a record 207 incidents in H1 2026, while total stolen funds fell to $929 million and North Korean-linked attackers were responsible for about 66% of losses, according to FYEO. The pattern shows that Web3 risk is increasingly about attack frequency, control fragility and governance gaps, not only headline loss values.

Editorial analysis by NHI Mgmt Group, based on content published by FYEO: “Crypto Hacks on the Rise: 207 Incidents in H1…”.

By the numbers:

• The total value stolen in H1 2026 was approximately $929 million, down from $2.3 billion in early 2025.
• North Korean-linked hackers were responsible for approximately 66% of all stolen crypto.

Key questions

Q: What breaks when smart contract controls are not in place for Web3 protocols?

A: The main failure is that code becomes the control plane, so a logic error or missing access check can directly authorise theft, minting or state manipulation.

Q: Why do weak private key controls create outsized risk for crypto institutions?

A: Weak key controls create outsized risk because private keys directly control asset movement, and compromise can mean immediate, irreversible loss.

Q: How do security teams know if Web3 security controls are actually working?

A: Look for narrower blast radius, faster detection of unusual signing behaviour, fewer always-on administrative paths and successful containment during tests.

Practitioner guidance

• Inventory signing authorities and privileged wallets Create a complete register of wallets, relayers, validators, admin keys and automation accounts that can move value or change protocol state.
• Reduce standing privilege in bridge and protocol operations Remove always-on administrative access where possible and require time-bound approval for privileged actions that can change liquidity, upgrade code or alter bridge trust settings.
• Harden key custody and compromise detection Store private keys in segregated systems, enforce MFA for operational access, monitor for anomalous signing patterns and rehearse revocation steps before a compromise occurs.

Bottom line: Web3 breaches are increasingly driven by repeated control failures across contracts, keys and bridges rather than a single novel exploit class.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →