The cryptocurrency landscape is once again flashing red, as a new report from blockchain security firm Blockaid reveals a staggering increase in attack frequency during the first half of 2026. While the total financial losses of over $1 billion are slightly down from the previous year, the sheer volume of successful hacks has reached an unprecedented high, signaling a critical juncture for on-chain security.
Blockaid’s Tuesday report paints a stark picture: North Korean hacker organizations remain the biggest threat, and with the rapid popularization of AI Agents, AI-related attacks are expected to surge significantly in the second half of the year. The report states:
“The first half of 2026 has been a highly indicative period for on-chain security. The total number of verified attacks by Blockaid in the first six months alone has already surpassed the entirety of 2025.”
North Korean Hackers: The Dominant Threat
Tracing the flow of stolen funds, the primary architects behind this wave of heists are identified as North Korean hacker organizations. Blockaid specifically attributes the massive $285 million breach of the Drift platform and the $292 million attack on KelpDAO to these sophisticated cyber forces.
Blockaid warns that the threat from North Korea is expected to persist:
“The criminal method of hackers using social platforms like LinkedIn for social engineering to trick and then compromise multi-signature signer permissions accounted for two of the top four major hacker cases in the first half of the year. As it stands, the market still lacks robust protective mechanisms to curb this modus operandi.”
Industry Trends and a Glimmer of Hope
These findings are further corroborated by data from other leading cybersecurity institutions. Immunefi’s June ecosystem report documented 207 hacking incidents in H1 2026, resulting in approximately $972 million in losses. This aligns closely with Quill Audits’ statistics, which reported 87 DeFi attacks and $935 million in losses.
While the sheer “number” of attacks reached a new half-year high, there’s a silver lining: the overall financial impact on the DeFi sector in 2026 has actually decreased by a significant 74% compared to the historical peak in 2022. This suggests that while attacks are more frequent, the industry may be improving its resilience against truly catastrophic single events.
Blockchain-Specific Vulnerabilities: Ethereum vs. Solana
A closer examination of affected blockchains reveals distinct patterns of vulnerability. Ethereum and Solana were the hardest hit, incurring losses of $332 million and $326 million respectively, yet faced different threat landscapes.
Blockaid’s analysis indicates that Ethereum, home to a vast concentration of high-value protocols, remains a prime target for large-scale exploits. The report elaborates:
“High-value protocols, including re-staking platforms, stablecoins, and DEX aggregators, are predominantly deployed on Ethereum, thus making it the focal point for major smart contract vulnerability attacks.”
In contrast, attacks targeting Solana have shown a preference for exploiting “signature infrastructure” rather than direct smart contract vulnerabilities, pointing to a different attack surface for the network.
The Looming Threat of AI Agents
Looking ahead to the second half of the year, Blockaid’s report issues a stark warning about a potential explosion in Artificial Intelligence (AI) related cybersecurity incidents:
“The $216,000 hack of Bankr marked the first recorded AI-targeted attack, and with the deployment of AI agents on the blockchain projected to grow tenfold annually, this vector is set for an explosion.”
“Investors and developers should prepare for a surge in AI agent compromises in the second half of the year. ‘Prompt Injection,’ where malicious commands manipulate AI into unauthorized actions, is predicted to become a dominant attack method, alongside tool misuse and unauthorized signatures, heralding a new frontier in blockchain security challenges.”
Disclaimer: This article is for market information purposes only. All content and views are for reference only, do not constitute investment advice, and do not represent the views and positions of BlockTempo. Investors should make their own decisions and transactions. The author and BlockTempo will not bear any responsibility for direct or indirect losses resulting from investor transactions.
