Hackers Stopped Breaking Crypto's Code and Started Breaking Its People

Crypto just posted its safest half-year since 2020 and its most attacked half-year ever, and both records are explained by the same shift. Attackers logged a record 207 successful crypto hacks in the first six months of 2026, according to TRM Labs, while total stolen funds fell 57 percent year over year to $972 million. More break-ins, less loot. The industry's code got harder to rob. Its people didn't.

Buried in the same report is the statistic that should reorganize every security budget in the industry: infrastructure and operational compromise — chiefly private-key and seed-phrase theft — accounted for roughly 76 percent of losses despite representing only about 15 percent of incidents. The smart contract bug, crypto's signature catastrophe for a decade, has been demoted. The signing ceremony is the new attack surface.

Five years of audits actually worked

Give the industry its due first. The reason attackers moved on from contract exploits is that contract exploits stopped paying. Years of audit culture, formal verification, bug bounties that pay better than crime, and battle-tested standard libraries have made the big DeFi protocols genuinely hard targets. The reentrancy bugs and unchecked oracles that produced 2021's nine-figure disasters are mostly museum pieces now.

Security people call this the displacement effect, and it never eliminates crime; it reroutes it. Harden the vault and thieves study the guards. What 2026's numbers show is the reroute completing: the marginal dollar of attacker effort now goes into phishing a devops engineer, compromising a build pipeline, or socially engineering someone with signing authority — not into reading Solidity.

Two April mornings, $577 million

The half's losses were dominated by exactly two events, both in April, both attributed to North Korea-linked groups: roughly $285 million from Drift Protocol and $292 million from KelpDAO. Together they represent nearly 90 percent of Pyongyang's H1 haul, and TRM attributes about $643 million — 66 percent of everything stolen in the half — to North Korea.

Sit with that concentration. Strip out one sanctioned state's two best mornings and the entire global crypto hacking economy shrinks to something a mid-sized insurer would shrug at. This is no longer a story about ten thousand anonymous attackers probing DeFi. It's a story about one state-sponsored program that has industrialized the compromise of key infrastructure, plus a long tail of small-time phishing that generates headlines and rounding errors.

That's simultaneously comforting and alarming. Comforting because defensive knowledge compounds against a known adversary with known tradecraft. Alarming because that adversary's tradecraft — fake recruiters, poisoned dev tools, patient infiltration of the humans around the keys — is precisely the vector the industry spends the least on defending.

The org chart is the vulnerability now

A smart contract bug is a fair fight: the code is public, defenders and attackers read the same bytes, and diligence wins. Key compromise is not a fair fight. It happens off-chain, in inboxes and CI pipelines and Zoom calls with counterfeit recruiters, where no auditor ever looks.

The defenses that matter now read like corporate security, because that's what this is: hardware-isolated signing, multi-party approval with genuinely independent signers, out-of-band verification for any change to payout addresses, and the assumption that any employee's laptop is already compromised. None of it ships in a token audit. Most of it is boring. All of it is cheaper than $292 million.

There's an architectural lesson too: every dollar that can be moved by a human decision is a dollar that can be moved by a deceived human. The parts of a project's balance sheet that don't need discretion shouldn't have any. Time-locked team vesting and liquidity locks — the kind enforced on-chain through services like Team Finance — exist precisely to take categories of funds out of the reach of both rogue insiders and whoever phishes them. A key that can't move tokens until 2028 is a key not worth stealing in 2026.

Audit theater has a budget problem

The industry's spending hasn't caught up with its threat model, and the mismatch is structural. A protocol can point to an audit; investors check for the badge; the ritual satisfies everyone. There is no equivalent badge for "our deploy keys live in an HSM and our treasury operations require three humans on separate continents." Opsec is invisible until the morning it isn't, so it loses every budget fight to features and marketing.

Exchanges and custodians mostly learned this lesson the expensive way years ago. The unlearned population is DeFi teams — often a dozen people holding admin keys to nine-figure treasuries with the operational security of a group chat. The Drift and KelpDAO losses didn't happen because their contracts were unaudited. They happened because a state actor treated the teams themselves as the codebase and found the unpatched functions.

Due diligence should evolve accordingly. The questions that matter in 2026 aren't only "who audited the contracts" but "who can sign, from what devices, with what ceremony, and what happens when one of them is compromised on a Tuesday." Projects that can't answer crisply are carrying the industry's actual systemic risk, whatever their audit page says.

Small thefts, big denominators

One more wrinkle in the data deserves attention: 207 incidents with sub-$1 billion in losses means the median hack is getting small. Attackers are increasingly harvesting individuals — seed phrases lifted through fake wallet apps, malicious browser extensions, SIM swaps — rather than besieging protocols. Analysts tracking the half note the attack mix shifting toward exactly this retail-scale predation.

For ordinary holders the implication is blunt: you are now the target demographic, and the attack will not look like a hack. It will look like a job offer, an airdrop, a support agent, or an update prompt. The protocol layer's hard-won safety does not extend to the last fifty centimeters between a screen and a human being.

The industry spent five years and billions of dollars teaching its code to distrust everyone. The next five years are about teaching its people the same thing — and people, unlike contracts, cannot be formally verified. North Korea is betting $643 million a half that they never will be. The counter-bet is still looking for a buyer.