Ethereum and Solana Drive Most Crypto Hack Losses in H1 2026, Blockaid
Crypto security firm Blockaid reports that losses from hacks and other onchain security incidents exceeded$1 billionin the first half of 2026, marking thehighest number of security incidents in a six-month. . .
Crypto security firm Blockaid reports that losses from hacks and other onchain security incidents exceeded$1 billionin the first half of 2026, marking thehighest number of security incidents in a six-month periodtracked by the platform. In Blockaid’s H1 2026 security report published Tuesday,EthereumandSolanaled the network-level loss tally, with stolen funds of roughly$332 millionand$326 million, respectively. Key takeawaysOver $1B lost: Blockaid recorded total crypto losses above $1 billion across H1 2026. 212 security incidents: The period included 212 incidents, with more high-threshold exploits verified in H1 2026 than in all of 2025. Ethereumdominated by code exploits: The report attributes most Ethereum losses to application and smart-contract vulnerabilities. Solanalosses driven by key compromises: More than 98% of Solana’s losses stemmed from compromised keys rather than contract bugs. Biggest single exploit was KelpDAO: Blockaid identified the largest incident as KelpDAO’s exploit at$292 million. H1 2026: incident volume climbed, and major exploits shaped outcomesBlockaid’s report covers212 security incidentsfrom the first six months of 2026. While the number of incidents rose, the distribution of losses was also shaped by a small set of very large events. The largest single exploit Blockaid highlighted came fromKelpDAO, which it linked to losses of$292 million. Blockaid also reported that it verified3. 4 times as many high-threshold exploitsin H1 2026 compared with all of 2025, suggesting a higher frequency of severe, high-impact events rather than only a few outliers. At the network level, Ethereum and Solana were responsible for nearly all of the most significant stolen-funds figures in the report. Blockaid attributes these differences not only to what applications exist on each chain, but also to how attackers executed their operations. Why Ethereum losses reflected risk in high-value protocolsAccording to Blockaid, Ethereum saw the largest losses in H1 2026, driven primarily by incidents that stemmed fromcode exploits—meaning vulnerabilities in applications, smart contracts, or components interacting with them. Blockaid said Ethereum’s highest-loss events included key compromises involvingHumanity ProtocolandStablR. In addition, CoWSwap was identified in the report as the only major Ethereum incident classified as auser mistake, rather than an exploit of protocol code. Looking beyond individual cases, Blockaid outlined recurring Ethereum attack methods that included weaknesses inbridgesandsmart contracts,unauthorized access to privileged accounts, andmarket manipulation techniques. The report frames Ethereum as a persistent target partly because it hosts many of the sector’s highest-value building blocks—restaking platforms, stablecoins, and decentralized exchanges. For investors and operators, the implication is straightforward: as long as the chain continues to concentrate high-value protocols and liquidity, attackers can profit from both direct smart contract vulnerabilities and operational failures (such as privileged account access) that turn code risk into real-world theft. Solana’s surge: fewer contract bugs, more key and signer compromisesSolana’s H1 2026 losses came in at roughly$326 million, nearly matching Ethereum. Blockaid describes this as a substantial increase versusabout $127 millionin stolen funds during 2025. Notably, Blockaid says the increase wasnotmainly caused by a rise in smart contract exploits. Instead, the report points to compromised keys as the dominant driver:more than 98%of Solana’s losses in the period were tied to key compromises. Blockaid connected a large portion of those losses to incidents involvingDrift ProtocolandStep Finance, which the report linked toNorth Korea-linked cyber groups. Blockaid also described a different profile for Solana attackers compared with Ethereum. Where Ethereum’s losses were largely associated with vulnerabilities in protocol code, Solana incidents were centered onsigner infrastructureand organizational security controls. In Blockaid’s accounting, only a small portion of Solana losses came from code exploits—citingRaydiumandVoloas examples of the remaining code-related cases. For teams building on or around Solana, this is a clear operational reminder: security reviews can’t stop at smart-contract audits. The report’s emphasis on keys, signing infrastructure, and broader security posture suggests that threat models need to treat custody, signing workflows, and privileged access as first-class attack surfaces. What to watch next: exploit severity, not just incident countsAs Blockaid’s data shows, H1 2026 combined higher incident volume with a significant jump in verified high-threshold exploits. Readers should watch whether future quarters keep the same balance—especially whether Solana’s key-compromise trend persists and whether Ethereum’s code and privileged-access attack patterns accelerate as new high-value applications launch. Risk & affiliate notice:Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure