Crypto hack losses fall below $1 billion in H1 2026 despite record attack volume: Immunefi

Cryptocurrency projects lost approximately $972 million across 207 hack incidents in the first half of 2026, the highest incident count ever recorded, according to Immunefi's June 2026 Ecosystem Update.

However, total losses still came in below $1 billion and less than half of what the industry lost in the first half of 2025.

The headline finding runs counter to the incident count, which means attacks are becoming more frequent but less costly per event, the blockchain security firm noted.

DeFi losses keep shrinking

Decentralized finance exploit losses have fallen 74% from their 2022 peak, dropping from $2.62 billion to $680.3 million, Immunefi found. Median loss per exploit fell 75% over the same stretch.

The firm attributed the decline to continuous security coverage, bug bounty programs, audit competitions, and a growing base of researchers surfacing vulnerabilities before attackers can exploit them.

Immunefi also linked the same 74% figure to full-year 2025 DeFi losses of $680.3 million, down from $534 million in 2024, and tied the modest year-over-year increase to the growing complexity of multi-chain deployments rather than a broader security regression.

Where the risk has moved

Smart contract vulnerabilities remain a factor, but the report found that the most severe damage increasingly stems from infrastructure failures, private key compromises, cross-chain configuration errors, and weaknesses in privileged access.

Immunefi framed this as a structural shift in the threat landscape, with attackers moving up the stack toward operational and infrastructure layers rather than focusing solely on protocol code.

The shift tracks with Immunefi's prior research. Bridge exploits, once responsible for the majority of DeFi losses, have largely receded from the picture, while flash-loan attacks, a dominant technique in 2020, now account for a fraction of a percent of losses.

Bug bounty economics

In H1 2026, the industry lost roughly $972 million to exploits while Immunefi's platform paid researchers approximately $13.45 million to surface 837 valid bugs before attackers could exploit them.

The firm crossed $140 million in lifetime researcher payouts in June, a threshold Immunefi has described as the largest total in the security researcher market.

Immunefi's platform now counts more than 92,000 registered researchers, protects more than $180 billion in assets across more than 650 protocols, and says it has helped prevent more than $25 billion in losses from hacks.

Immunefi CEO Mitchell Amador has previously said hundreds of millions of dollars in annual losses remain unacceptable, even as the broader trend improves.

"Crypto security is adversarial, and it never stops evolving," Amador said in comments to following Immunefi's 2026 Ecosystem Vulnerability Audit. "The honest read on the numbers is simple: the industry is learning."