Cryptocurrency projects lost approximately $972 million across 207 hack incidents in the first half of 2026, the highest incident count ever recorded, according to Immunefi's June 2026 Ecosystem Update. Total losses remained below $1 billion and represented less than half of what the industry lost in the first half of 2025. The record incident count occurred alongside declining per-event costs, indicating that attacks became more frequent but individually less severe, the blockchain security firm noted.
DeFi Exploit Losses Drop 74% From 2022 Peak
Decentralized finance exploit losses fell 74% from their 2022 peak, declining from $2.62 billion to $680.3 million, Immunefi reported. Median loss per exploit decreased 75% over the same period. The firm attributed the decline to continuous security coverage, bug bounty programs, audit competitions, and a growing base of researchers identifying vulnerabilities before attackers exploited them. Immunefi also reported that full-year 2025 DeFi losses totaled $680.3 million, up from $534 million in 2024, and linked the modest year-over-year increase to the growing complexity of multi-chain deployments rather than broader security regression.
Infrastructure Failures Replace Smart Contract Flaws as Primary Threat Vector
Smart contract vulnerabilities remain a factor, but the most severe damage increasingly stems from infrastructure failures, private key compromises, cross-chain configuration errors, and weaknesses in privileged access, the report found. Immunefi framed this as a structural shift in the threat landscape, with attackers moving up the stack toward operational and infrastructure layers rather than focusing solely on protocol code. Bridge exploits, once responsible for the majority of DeFi losses, have largely receded, while flash-loan attacks, a dominant technique in 2020, now account for a fraction of a percent of losses, according to Immunefi's prior research.
Bug Bounty Platform Pays $13.45 Million to Researchers in H1 2026
The industry lost approximately $972 million to exploits in H1 2026, while Immunefi's platform paid researchers approximately $13.45 million to identify 837 valid bugs before attackers could exploit them. The firm crossed $140 million in lifetime researcher payouts in June, a threshold Immunefi described as the largest total in the security researcher market. Immunefi's platform now counts more than 92,000 registered researchers, protects more than $180 billion in assets across more than 650 protocols, and reports it has helped prevent more than $25 billion in losses from hacks.
Immunefi CEO Highlights Industry Learning Amid Ongoing Security Challenges
Immunefi CEO Mitchell Amador stated that hundreds of millions of dollars in annual losses remain unacceptable, even as the broader trend improves. "Crypto security is adversarial, and it never stops evolving," Amador said in comments to The Block following Immunefi's 2026 Ecosystem Vulnerability Audit. "The honest read on the numbers is simple: the industry is learning."
FAQ
How much did cryptocurrency projects lose to hacks in the first half of 2026?
Cryptocurrency projects lost approximately $972 million across 207 hack incidents in the first half of 2026, according to Immunefi's June 2026 Ecosystem Update. This represented the highest incident count ever recorded, but total losses remained below $1 billion and less than half of H1 2025 losses.
Why have DeFi exploit losses declined since 2022?
DeFi exploit losses fell 74% from their 2022 peak of $2.62 billion to $680.3 million, with median loss per exploit down 75%. Immunefi attributed the decline to continuous security coverage, bug bounty programs, audit competitions, and a growing base of researchers surfacing vulnerabilities before attackers could exploit them.
