The first half of 2026 saw a dramatic decline in crypto hacking incidents. According to CertiK’s latest report, published in early July, the total number of hacks dropped by 47 percent compared to the same period in 2025. An improvement that at first glance appears positive for the entire ecosystem. Yet the security firm is sounding the alarm: this figure does not necessarily reflect a fundamentally safer environment.
A Historic Decline in Thefts and Hacks
CertiK’s data shows that losses from hacks and exploits reached approximately $685 million in the first half of 2026, compared to over $1.29 billion during the same period in 2025. This 47 percent decline is the largest ever recorded over a six-month period since CertiK began publishing its quarterly report.
Several factors explain this improvement. On one hand, protocols have significantly strengthened their security measures following the devastating waves of hacks in 2024 and 2025. Security audits have become the norm rather than the exception, and bug bounty programs now attract thousands of security researchers from around the world.
On the other hand, the industry has witnessed the emergence of more sophisticated security solutions: blockchain firewalls, real-time monitoring of suspicious transactions, and decentralized insurance protocols that now cover several billion dollars in assets.
Why CertiK Refuses to Declare Victory
Despite this spectacular improvement, CertiK’s report warns against excessive optimism. “The ecosystem is not safer,” the report warns. “The decline in losses is mainly due to falling token prices and reduced DeFi activity, not to a fundamental improvement in security.”
In other words, hackers are stealing less because there is less value available to steal, not because protocols have become impenetrable. DeFi’s Total Value Locked (TVL) has fallen nearly 40 percent from its 2025 peak, which mechanically reduces the attractiveness of potential targets.
“The number of critical vulnerabilities identified in smart contracts has not decreased,” explains a CertiK researcher. “What has changed is the cost-benefit ratio for attackers. With TVL down and prices lower, the same exploit yields less than before.”
The Types of Attacks That Persist
CertiK’s report identifies several categories of attacks that remain a cause for concern:
- Cross-chain bridge exploits: despite improvements, bridges remain the number one target for hackers, accounting for 35 percent of total losses
- Governance attacks: decentralized governance protocols continue to be vulnerable to vote-token accumulation attacks
- Flash loans: flash loan attacks have decreased in frequency but not in sophistication, with amounts stolen per attack on the rise
- Phishing and social engineering: attacks targeting individual users rather than protocols have increased by 23 percent, now representing 18 percent of total losses
This last category is particularly worrying because it is almost impossible to prevent through technical measures alone. Users remain the weakest link in overall crypto security.
The Most Affected Sectors
CertiK’s report also details the distribution of losses by sector. Decentralized finance (DeFi) remains the most heavily affected sector, accounting for 62 percent of total losses (approximately $425 million). Next come centralized exchanges (15 percent, $103 million), wallets (12 percent, $82 million), and infrastructure protocols (11 percent, $75 million).
Among the most affected platforms in the first half of the year are several lending and liquid staking protocols that suffered large-scale exploits. The largest hack of the semester was an attack on a restaking protocol that lost nearly $90 million in March 2026.
“What is striking is that most of these protocols had been audited by reputable firms,” the report notes. “This shows that auditing alone is not enough. Security is a continuous process, not a one-time event.”
Progress in Security
Despite CertiK’s warnings, the first half of 2026 also saw significant progress in the field of crypto security. Several initiatives deserve to be highlighted:
- Massive adoption of zero-knowledge proofs (ZK-proofs) for transaction verification without exposing sensitive data
- Deployment of blockchain firewalls by several major protocols, capable of blocking suspicious transactions in real time
- The rise of decentralized insurance protocols, which covered over $200 million in losses during H1 2026
- Standardization of security audits, with the emergence of common frameworks endorsed by the industry
These technical advances, combined with increased awareness of the risks, could contribute to a lasting improvement in the ecosystem’s overall security.
Outlook for the Second Half
CertiK predicts that hack-related losses could rise again in the second half of 2026 if token prices recover and DeFi TVL increases. “The correlation between prices and hacks is well documented,” the report explains. “When prices go up, hackers become more active.”
Conversely, if collective security efforts bear fruit, the downward trend could be sustained independently of market conditions. Protocols that invest in security now could benefit from a significant competitive advantage when the market eventually turns around.
In the meantime, CertiK’s warning remains valid: do not confuse falling losses with improved security. Vigilance remains essential for all participants in the crypto ecosystem, both developers and everyday users alike.
📬
Get the weekly crypto briefing
Analysis, trends and opportunities — straight to your inbox.
