In the first half of 2026, cryptocurrency hacks resulted in approximately $972 million in losses. According to Immunefi founder Mitchell Amador, the majority of these losses stem from operational failures like compromised private keys and governance exploits rather than smart contract bugs. Notable incidents include a $30 million theft from Humanity Protocol via a compromised key and a $20 million drain of BonkDAO's treasury through a malicious governance vote.
2026 crypto hack losses
- ▪An Immunefi study of 425 cryptocurrency hacks from 2021 to 2025 found that a small share of operational failures carried most of the value lost.
- ▪Immunefi data shows that 93.9% of cryptocurrency programs running for five years or more surface a confirmed critical vulnerability.
- ▪An Immunefi study found that 54.6% of all cryptocurrency value lost across 191 hacks in 2024 and 2025 was caused by centralized exchange compromises.
- ▪Cryptocurrency exploits resulted in approximately $972 million in total losses during the first half of 2026, according to Immunefi founder Mitchell Amador.
Compromised private keys
- ▪Immunefi founder Mitchell Amador stated that standard security audits fail to verify key storage, signing authority, or the security of compromised laptops.
- ▪In June 2026, Humanity Protocol lost over $30 million due to a compromised private key on a team member's machine, leaving its smart contract untouched.
Governance vulnerabilities
- ▪In July 2026, an attacker spent approximately $4 million to pass a malicious governance proposal and drain roughly $20 million from the BonkDAO treasury.
- ▪The July 2026 BonkDAO exploit succeeded through a low-turnout vote rather than a smart contract failure, demonstrating governance rules as a vulnerability.
Continuous bug bounty programs
- ▪Immunefi data indicates that a median bug bounty of $20,000 routinely prevents cryptocurrency hacks that average approximately $25 million in losses.
- ▪Immunefi founder Mitchell Amador noted that one unnamed cryptocurrency protocol was audited 11 times and still lost $128 million.
Story comments
Loading comments…