Ethereum and Solana Lead Crypto Sector in H1 2026 Security Losses Amid Record-Breaking Attack Wave

Record-Breaking Losses Define First Half of 2026

The crypto sector experienced its most damaging six-month period for security in H1 2026, with accumulated losses surpassing $1 billion across multiple blockchain networks. Onchain security firm Blockaid’s comprehensive report, released Tuesday, documented 212 distinct security incidents throughout the period, marking a significant escalation in both frequency and scale compared to prior years. Notably, the frequency of major exploits during this six-month window exceeded the entire previous year, with 3.4 times as many high-threshold incidents recorded. A single exploit at KelpDAO represented the period’s largest breach, resulting in $292 million in losses.

Ethereum’s Smart Contract Vulnerabilities Dominate Attack Surface

Ethereum emerged as the primary target for attackers in H1 2026, with approximately $332 million in stolen funds traced to incidents affecting its ecosystem. The network’s prevalence as a foundation for high-value applications—including restaking platforms, stablecoin protocols, and decentralized exchanges—made it an attractive attack surface. Blockaid’s analysis indicates that code exploits within smart contracts and applications constituted the dominant attack vector on Ethereum. Additional losses stemmed from compromised administrative credentials and market manipulation tactics. Specific incidents identified by Blockaid included breaches at Humanity Protocol and StablR, while CoWSwap, a major decentralized exchange, experienced losses attributed to user operational error rather than platform compromise.

Solana’s Sharp Increase Reveals Different Threat Patterns

Solana experienced a dramatic surge in security losses reaching approximately $326 million in H1 2026, representing a substantial increase from the roughly $127 million the network suffered throughout 2025. Unlike Ethereum’s vulnerability landscape centered on contract code, Solana’s losses stemmed primarily from compromised signing infrastructure and organizational security failures. Blockaid attributed incidents affecting Drift Protocol and Step Finance to cyber operations conducted by North Korean-linked threat groups. The data reveals that compromised cryptographic keys accounted for over 98% of Solana’s total losses during the period, with only a minor portion stemming from code-level exploits at platforms such as Raydium and Volo. This distinction highlights how different blockchain architectures and security models create unique threat vectors for attackers to exploit.

The disparities between 2025 and H1 2026 underscore an accelerating sophistication in blockchain-targeting attacks. Prior year data from Blockaid indicates 2025 recorded $2.58 billion in total losses across 63 incidents, with a disproportionate concentration in the first quarter driven by the $1.5 billion Bybit incident. The comparison reveals both a higher incident frequency and greater per-incident severity emerging in the current year. These findings underscore the evolving risk landscape for market participants invested in blockchain infrastructure.

As security breaches continue to mount across major networks, the importance of robust operational security practices and code audit standards becomes increasingly critical to preserving ecosystem integrity and investor confidence.

Source: Blockaid, via Cointelegraph. Not financial advice.