Hackers Stole $370 Million in Crypto in January 2026

Data from the Web3 security research team CertiK shows that around 40 exploit- and fraud-related incidents were recorded in January 2026, resulting in hackers stealing digital assets worth $370.3 million.

CertiK estimates that the January figure is the highest in the past 11 months. The key growth driver was phishing, which accounted for $311.3 million of the total stolen funds. In one incident alone, attackers stole around $284 million from a single user, making up the lion’s share of January’s losses.

On a YoY basis, the volume of theft increased by more than 277%. In January last year, losses were estimated at $98 million. Compared to December 2025, the figure rose by 214%, from $117.8 million. The last time higher monthly losses were recorded was in February of last year, when total losses reached around $1.5 billion following the hack of crypto exchange Bybit.

PeckShield analysts highlighted several major attacks in early 2026:

• the compromise of treasury wallets of the Step Finance project, resulting in the theft of ~$28.9 million;
• a vulnerability in the Truebit protocol’s smart contract, which allowed an attacker to mint and withdraw TRU tokens worth $26.4 million;
• a hack of liquidity provider SwapNet totaling $13.3 million;
• an attack on the Saga blockchain protocol, causing losses of $7 million.

According to PeckShield, a total of 16 hacking attacks occurred during the month, with combined losses of $86.01 million, which is more than 13% higher than in December 2025.

Separately, CertiK analysts noted that the number of so-called wrench attacks, cases involving physical violence or kidnappings aimed at forcing the transfer of crypto assets, rose by 75% year over year in 2025. A total of 72 verified incidents were recorded globally during the year, with the combined value of assets stolen through such attacks reaching $40.9 million.

In H1 2025, hackers stole more than $3 billion in cryptocurrencies. At the same time, according to Global Ledger, in 68% of cases the funds began moving before information about the hack became public.