Crypto hack counts just set a record. The warning in TRM Labs’ latest data is where the money is actually being lost.
In its H1 2026 crypto hack review, TRM Labs said attackers carried out 207 separate hacks in the first half of the year, the most the firm has recorded in any six-month period.
Yet total losses fell to $972 million, less than half the $2.3 billion stolen during the first half of 2025.
That split changes the security story. More protocols, tokens, and decentralized applications are being hit, but the losses that still define the year are concentrated in operational systems: keys, custody, signing infrastructure, approval flows, and other controls around the code rather than the code alone.
For DeFi teams, smart-contract audits remain necessary because smart-contract exploits accounted for most incidents. The losses that can erase hundreds of millions of dollars increasingly come from systems that decide who can move funds, how signatures are approved, and how infrastructure around a protocol is trusted.
More incidents, smaller typical losses
TRM said the number of hacks more than doubled from 83 incidents in H1 2025 to 207 in H1 2026. Q2 alone produced 123 incidents, after a record-setting first quarter.
Most of that increase came from smart-contract exploits, which accounted for 125 of the 207 incidents.
The typical loss, however, was much smaller than the headline total suggests. TRM put the median hack at about $219,000, while the mean was $4.7 million.
That gap shows how a few very large incidents can dominate aggregate losses, even as the day-to-day threat environment becomes more crowded with smaller exploit attempts.
The result is a split security picture. On the one hand, DeFi is still dealing with code-level vulnerabilities, complex protocol logic, and multi-step manipulations that lead to frequent losses.
On the other hand, the largest damage is coming from failures in the systems that hold or authorize control of funds.
TRM said infrastructure and operational compromises accounted for only about 15% of incidents in H1 2026 but roughly 76% of stolen value.
That ratio turns the report from a hack-count story into a security-priority story.
If a protocol treats audits as the whole security program, it is defending only part of the risk. An attacker can skip the core contract by compromising a signer, manipulating a bridge validation path, poisoning an operational dependency, or obtaining approval for a malicious transfer.
The clearest example is the concentration of North Korea-linked activity. TRM assesses that about $643 million, or roughly 66% of all funds stolen in H1 2026, was attributable to North Korea-linked activity.
That figure was down from about $1.7 billion in the first half of 2025, but it still made North Korea-linked actors the largest source of stolen value in the period.
Nearly all of that H1 2026 total came from two April operations involving Drift Protocol and KelpDAO. TRM put the Drift loss at roughly $285 million and KelpDAO at roughly $292 million, for a combined total near $577 million.
Those incidents reflected the same broader pattern: attackers targeted the infrastructure and human layers around DeFi systems rather than simply hammering at core smart contracts.
That distinction matters because North Korea-linked operations are more than another exploit category. They combine technical intrusion, social engineering, operational patience, laundering infrastructure, and state-directed financial goals.
A single successful operation can outweigh months of smaller non-state exploits.
TRM’s warning is that the lower dollar total in H1 2026 reflects the absence of another theft on the scale of 2025’s largest attacks, not a reduction in attacker capability.
In other words, the aggregate number fell because the biggest outlier was smaller, while the class of risk that creates outliers remains unresolved.
That makes the next large loss less likely to look like a simple bug report. It is more likely to expose a weak approval process, a compromised private key, a signer that could be socially engineered, a vendor or infrastructure dependency that was trusted too broadly, or a response plan that moved too slowly once funds began crossing chains.
Audits need an operational layer
Smart-contract work remains important, but it needs controls around the systems that move funds. TRM says code exploits remain the most common incident type, and DeFi protocols still need audits, formal review, monitoring, and incentives for disclosure.
The change is that audits cannot be the ceiling of the security program.
The controls that matter most for catastrophic loss sit around asset movement. TRM specifically pointed to key management, signing infrastructure, approval workflows, and custody as areas requiring greater attention.
Those are operational disciplines as much as technical ones.
A hardened protocol now needs to know who can initiate large transfers, who can approve them, which devices and repositories can touch signing paths, how governance changes are delayed or challenged, and what happens if a trusted operator, contributor, or vendor account is compromised.
A static audit report cannot answer those questions after the operational environment changes.
That is why recent CryptoSlate security coverage has kept returning to the same theme: operational security, signing practices, governance, bridge validation, and infrastructure controls are becoming part of the industry’s policy-facing defense posture.
A separate CryptoSlate analysis warned that DeFi’s older exploit patterns may be fading, but newer risks can travel across chains and infrastructure layers when protocols reuse systems or trust assumptions too broadly.
For security teams, the next budget discussion should therefore cover more than another audit cycle.
It should include hardware-backed signing, multi-party approval for large transfers, limits on privileged access, monitored developer devices, stronger vendor review, tested incident-response playbooks, and treasury planning for a worst-case infrastructure compromise rather than an average exploit.
The same shift affects exchanges, custodians, and financial institutions that may never be the initial target. TRM said stolen assets often move through cross-chain bridges and no-KYC swap services before reaching exchanges.
That makes first-hop screening inadequate when attackers can quickly move value across chains and services.
Multi-hop transaction monitoring, faster wallet intelligence sharing, and coordination between protocols, exchanges, stablecoin issuers, analytics firms, and law enforcement become part of the security stack.
TRM pointed to information-sharing networks as one answer because response time can determine whether stolen funds are frozen, traced, or laundered beyond easy recovery.
For protocols, this creates a second operational burden. The security plan has to assume that prevention can fail.
It must define who can pause systems, who can contact counterparties, how attacker addresses are distributed, and which transfer paths are watched in the first minutes after detection.
That is the real meaning of TRM’s H1 2026 data. Crypto experienced more hacks and fewer losses, but it also exposed a split between the growing volume of smaller smart-contract incidents and the concentrated operational compromises that still set the industry’s loss profile.
The next test is whether DeFi teams and custodians treat that split as a reason to rebalance security priorities.
If the largest losses continue to stem from compromised keys, signing workflows, custody systems, and infrastructure dependencies, catastrophic risk will fall only when the movement of funds becomes harder to compromise, slower to abuse, and easier to interrupt once an attacker is inside.
