Crypto Hacking Statistics 2026: How Much Crypto Has Been Stolen?

Cryptocurrency hacking losses have reached billions of dollars in 2026, but a handful of major breaches account for most of the stolen funds.

In the first half of 2026, TRM Labs recorded 149% more crypto hacks than during the same period in 2025. Yet the total value stolen fell by nearly 58%. Then, in October, a single $6.4 billion breach changed the year's figures dramatically.

At a glance

• $8.776 billion was stolen through recorded cryptocurrency hacks in 2026.
• 328 hacking incidents were recorded in 2026.
• $27.60 billion in cumulative cryptocurrency hacking losses has been tracked historically.
• $6.4 billion was stolen in the largest cryptocurrency breach of 2026.
• 72.5% of recorded 2026 hacking losses came from a single breach.
• 207 crypto hacks were recorded in the first half of 2026, up 149% year over year.
• $219,000 was the median loss per hack in TRM's first-half 2026 dataset.
• At least $2.02 billion was stolen by North Korea-linked hackers in 2025.
• $115.3 million in stolen cryptocurrency was frozen or returned during the first half of 2026.

Note: The 2026 year-to-date totals use DefiLlama's November 4, 2026 snapshot. Other statistics have different reporting periods and coverage. They should not be added together.

Crypto Hackers Stole Nearly $8.8 Billion in 2026

Cryptocurrency hacking losses reached approximately $8.78 billion across 328 incidents in 2026, according to DefiLlama's hacking database, as of November 4. Its historical tracker recorded approximately $27.60 billion in cumulative losses.

The total took a dramatic turn in October. Until then, researchers had documented hundreds of smaller attacks alongside several major breaches. One incident changed the financial picture for the entire year.

One Binance Hack Accounted for Nearly 73% of 2026 Losses

On October 29, 2026, attackers stole approximately $6.36 billion from Binance, according to DefiLlama's incident database. That one breach represented 72.5% of all losses recorded in the database for 2026.

Note: Remaining losses and percentage share are our calculations using DefiLlama's reported figures.

The numbers reveal something that the headline total alone cannot: without the Binance attack, recorded 2026 losses would have been approximately $2.42 billion.

The distinction matters when comparing years. If a single breach can account for nearly three-quarters of all recorded losses, an annual increase may say more about that breach than about the typical attack.

Crypto Hacking Losses Totaled $11.34 Billion From 2020 to 2025

Cryptocurrency hacks and exploits caused approximately $11.34 billion in reported losses between 2020 and 2025, based on a calculation using CoinGecko's historical data.

The figures cover exchange and DeFi-related hacks and exploits rather than all cryptocurrency theft. CoinGecko also combines historical records from different tracking databases, which matters when comparing long-term trends.

Annual Cryptocurrency Hacking Losses, 2020–2025

Note: Values are rounded. The $11.34 billion cumulative figure is the sum of these annual estimates.

Losses rose sharply in 2021 and reached $2.77 billion in 2022. They then declined for two consecutive years before increasing again in 2025. CoinGecko recorded 97 hacks in 2023, 94 in 2024, and 97 in 2025. The incident count barely moved across those three years, even as the financial damage changed substantially.

Hacking Losses Doubled in 2025, but Incidents Rose Just 3%

CoinGecko recorded $1.27 billion stolen in 2024 and $2.55 billion in 2025, an increase of approximately 100.8%. Meanwhile, the number of recorded incidents rose from 94 to 97, or just 3.2%.

Note: Changes calculated from CoinGecko's rounded annual figures.

The number of recorded incidents barely changed, but the total amount stolen doubled. The increase was driven by the financial scale of attacks rather than a similar rise in their frequency. One major contributor was the February 2025 Bybit hack. The exchange's own incident timeline reported approximately $1.46 billion stolen.

That attack alone exceeded CoinGecko's entire reported hacking-loss total for 2024.

Why Researchers Report Different Crypto Theft Totals for 2025

The amount stolen in 2025 depends partly on whose research is being quoted.

All three are published research estimates, but they do not count precisely the same events. Chainalysis includes personal wallet compromises in its stolen-funds research. CoinGecko's historical compilation excludes individual wallet hacks. TRM uses its own incident definitions and investigation methods.

There is also a timing difference. Chainalysis' December 2025 figure reflected thefts identified through early December, while other estimates come from later research.

The figures answer different questions. None should be presented as the one universally accepted amount stolen in every cryptocurrency hack during 2025.

For the historical trend above, CoinGecko's figures remain together as one defined series. The newer DefiLlama 2026 total is presented separately because its coverage differs.

Crypto Hacks Became More Frequent in the First Half of 2026, but Losses Fell

The first six months of 2026 produced one of the clearest contradictions in cryptocurrency hacking data. According to TRM Labs' July 2026 research, attackers carried out 207 recorded hacks, compared with 83 during the first half of 2025. Yet the amount stolen dropped from approximately $2.3 billion to $972 million.

TRM Recorded 149% More Hacks Despite a 58% Drop in Losses

Note: Percentage changes calculated from TRM Labs' reported figures.

The number of incidents increased by 124. Smart contract exploits accounted for 125 of the 207 attacks recorded during the first half of 2026. This made them the most common attack type in TRM's dataset.

The financial decline had a different explanation. The first half of 2025 included the approximately $1.5 billion Bybit theft, which heavily influenced that year's total.

Without an equally large breach during the first half of 2026, the increase in smaller attacks did not produce higher overall losses.

The finding describes TRM's research population. It does not establish that every type of cryptocurrency hacking became 149% more common worldwide.

The Average Crypto Hack Was More Than 21 Times as Costly as the Median

TRM's first-half figures show how far the largest attacks sit above a typical incident.

Note: Ratio calculated from TRM Labs' reported mean and median.

The mean is the total stolen divided by the number of hacks. The median is the middle incident when losses are ranked from smallest to largest.

A few enormous breaches can raise the mean substantially, even when most attacks involve much smaller losses. That makes the $219,000 median a more useful measure of a typical incident in TRM's first-half 2026 dataset. The $4.7 million mean is still valuable, but it reflects the influence of the largest hacks.

Not Every Security Firm Recorded More Hacks

The increase was not universal across research providers. CertiK's first-half 2026 report counted 344 Web3 security incidents, compared with 345 a year earlier. Its incident count was almost unchanged.

CertiK also recorded $1.316 billion in gross losses, down 46.8% from approximately $2.474 billion in the first half of 2025.

The two companies do not use identical classifications. CertiK tracks a broader range of Web3 security events, including phishing and wallet compromises. A report claiming that cryptocurrency hacks increased 149% across the entire industry would therefore overstate what the available evidence proves.

What survives both comparisons is that gross losses were lower in the first half of 2026 than in the equivalent period of 2025.

There is another complication: CertiK calculates that if the Bybit breach is excluded from its 2025 comparison, first-half 2026 losses were approximately 28% higher. That is an outlier-excluded analysis, not a replacement for the actual gross-loss figures.

Code Exploits Were Common. Wallet Compromises Caused Greater Losses

The methods responsible for the most attacks were not necessarily those responsible for the most stolen money. CertiK's first-half 2026 research found that code vulnerabilities appeared in the greatest number of incidents, but wallet compromises caused nearly three times as much financial damage as code vulnerabilities.

Code Vulnerabilities Caused 59% of Incidents but Only 12% of Losses

Note: Percentages are our calculations using the $1.316 billion gross-loss total. The listed categories do not cover every incident or every dollar lost.

Code vulnerabilities accounted for 59% of incidents but only 11.5% of losses. Wallet compromises caused 33.8% of losses despite accounting for fewer than 10% of incidents.

Infrastructure Compromises Caused 76% of TRM's First-Half Losses

TRM reached a related finding using its own classifications. Infrastructure and operational compromises accounted for approximately 15% of recorded hacks in the first half of 2026, but caused around 76% of the total stolen value.

These attacks typically involve systems that control access or authorise transfers, including compromised credentials, signing infrastructure, and private keys.

Unlike CertiK, TRM uses its own attack classifications. The percentages should therefore be interpreted separately rather than combined.

Centralised Exchanges and Cross-Chain Bridges Show Different Loss Patterns

Where a cryptocurrency attack takes place matters as much as how it happens. Exchanges, lending protocols, and cross-chain bridges are targets, while stolen credentials, compromised keys, and code flaws are methods of attack.

According to DefiLlama's hacking database, cumulative DeFi hacking losses reached approximately $9.29 billion, while bridge-related losses totalled $3.69 billion. These figures should not be added together because bridge attacks can also fall under DeFi losses.

Centralised Exchanges Lost Nearly Five Times More Than DEXs in 2025

The OECD's Asia Capital Markets Report 2026 reported approximately $2 billion in 2025 hacking losses at centralised exchanges, compared with $424 million at decentralised exchanges.

Centralised exchanges lost approximately 4.7 times as much. The Bybit breach was a major reason for that gap. One large centralised-exchange compromise could outweigh many smaller attacks against decentralised platforms.

But the figures do not establish that centralised exchanges are 4.7 times riskier. They show the amount lost, not losses relative to assets held, transaction volumes or the number of platforms operating.

Decentralised exchanges also represent only one part of DeFi. The $424 million figure is not a measure of all DeFi protocol losses. This distinction also matters when examining how many crypto exchanges there are, since exchange counts depend on which types of trading platforms are included.

Cross-Chain Attacks Caused $700 Million Across 32 Incidents

Cross-chain bridges allow assets or messages to move between blockchain networks. Their security depends on the systems that validate those movements. Immunefi's October 2026 research reported the following figures from DefiLlama data through 21 October.

Bridge and cross-chain incidents averaged approximately $21.9 million in losses each. Incidents involving contract-code flaws averaged roughly $3.7 million.

Both figures are calculations from Immunefi's rounded totals. The bridge category recorded only one-sixth as many incidents as the code-flaw category, yet generated almost as much financial damage.

A bridge can also be compromised through a code flaw or a key compromise. For that reason, these classifications should not be added together as though they describe separate, non-overlapping losses.

The finding is about the scale of losses within each reported category, not a definitive ranking of every DeFi target by risk.

North Korea-Linked Hackers Account for Billions in Crypto Theft

The largest cryptocurrency hacks are not always isolated crimes. Some have been linked to organised groups carrying out repeated operations against exchanges, protocols and the systems controlling their assets.

North Korea-linked operations are among the most extensively documented examples, with substantial estimates from blockchain researchers and official attribution for specific attacks.

North Korean Hackers Stole at Least $2.02 Billion in 2025

Chainalysis' December 2025 research estimated that North Korean actors stole at least $2.02 billion in cryptocurrency during 2025. That was a 51% increase from 2024 and brought the cumulative estimate attributed to North Korea to at least $6.75 billion through 2025.

The phrase "at least" matters. Chainalysis treats these figures as lower-bound estimates because investigators may later connect additional incidents or funds to the same actors. The cumulative total also stops at 2025. It does not incorporate later 2026 thefts.

Two April Attacks Made Up Nearly 90% of TRM's North Korea-Linked H1 Losses

North Korea-linked activity was also prominent in TRM's first-half 2026 research. The firm attributed approximately $643 million of its $972 million hacking total to these operations, equivalent to about 66% of the stolen value.

Two attacks in April accounted for approximately $577 million of that amount. That means nearly 90% of the funds TRM attributed to North Korea during the first half came from just two incidents, based on our calculation.

TRM and Chainalysis use different reporting methods and attribution assessments. Their figures should not be combined into an updated all-time North Korea theft total without a consistent dataset.

The FBI Linked the $6 Billion Binance Hack to North Korea

The Binance breach was not just the largest cryptocurrency theft of 2026. It also raised questions about who was behind the attack.

On 31 October, the FBI identified North Korea as responsible for stealing more than $6 billion from Binance just two days earlier. The agency linked the attack to TraderTraitor, a North Korean hacking operation.

Unlike incidents where researchers can only identify possible suspects, this case had an official attribution from US law enforcement.

Still, many cryptocurrency hacks have no publicly confirmed attacker. That makes it difficult to determine exactly how much cryptocurrency is stolen by individual hacking groups, even when the total financial losses are known.

Personal Wallet Theft Affected at Least 80,000 Victims in 2025

Not every cryptocurrency theft targets a major exchange or DeFi platform. Many attacks involve individual wallets, affecting people who hold their own crypto.

Chainalysis identified approximately 158,000 personal wallet compromise incidents affecting at least 80,000 unique victims in 2025. The amount stolen from individuals reached approximately $713 million, down from around $1.5 billion in 2024.

The scale of personal wallet theft also raises questions about how many people hold cryptocurrency. Even estimates of how many Americans own crypto differ depending on the survey and its methodology.

Unlike major exchange breaches, these incidents spread financial losses across a much larger number of individual victims.

They also belong to a different reporting category from TRM's count of major hacks and exploits. One compromised wallet and one compromised exchange are not equivalent units when counting attacks.

The scale of personal wallet theft shows why the impact of cryptocurrency crime cannot be measured by its largest breaches alone.

Only Part of Stolen Cryptocurrency Is Frozen or Returned

Knowing how much was stolen is only one part of the financial picture. After a breach, some assets may be frozen, seized, returned, or replaced using company funds. These actions can reduce the eventual damage to victims, but they do not all mean the same thing.

Stolen cryptocurrency should also be distinguished from coins that become permanently inaccessible because their private keys are lost. These are separate issues when estimating how many bitcoins there are and how much cryptocurrency remains accessible.

CertiK Recorded $115 Million Frozen or Returned in the First Half of 2026

CertiK reported $1.316 billion in gross Web3 security losses during the first half of 2026. Of that amount, $115.3 million was classified as frozen or returned, leaving approximately $1.200 billion in adjusted losses.

Note: The 8.8% share is calculated by dividing the $115.3 million frozen or returned by CertiK's $1.316 billion in gross losses.

The 8.8% represents funds frozen or returned, not the percentage of stolen assets that victims have recovered. An asset can remain frozen while its ownership or eventual return is still being resolved.

Elliptic Verified $2.85 Billion Frozen or Seized After Binance

The October Binance breach provides a much larger example. Elliptic's investigation estimated $6.43 billion in stolen cryptocurrency and verified approximately $2.85 billion in frozen or seized assets. That was around 44% of Elliptic's estimated stolen value, using the company's early November reporting snapshot.

In its 30 October security update, Binance committed to covering stolen funds through its SAFU fund and corporate treasury. Compensating customers, however, is different from recovering the original cryptocurrency taken by attackers.

A victim may receive compensation even if the original assets are never recovered. Likewise, frozen cryptocurrency may not yet have been returned.

There is no reason to treat those outcomes as identical when reporting how much money remains lost.

What the 2026 Crypto Hacking Statistics Reveal

The biggest cryptocurrency hacking losses are not necessarily caused by the most common attacks. Smaller exploits account for much of the incident volume, while compromised infrastructure and major platform breaches can expose far greater sums.

That distinction explains why hacking frequency, typical losses, and total stolen value can move in different directions. Each measures a different part of the security threat, and no single figure tells the whole story.

Our crypto gambling statistics cover the casino side of crypto, our Kalshi statistics look at the 15-minute crypto markets behind much of that exchange’s recent growth, and Can quantum computers hack Bitcoin? looks at a threat that hasn’t arrived yet. If you spot an error, let us know so we can review it and date any correction.

Crypto Hacking Statistics That Need More Context

A valid statistic can become misleading when its reporting period, definition, or source is left out.

Several commonly repeated claims need those details restored.

The recurring problem is not necessarily false data. It is a figure being repeated without the conditions that made it meaningful.

What Crypto Hacking Research Still Cannot Tell Us

The available data is extensive, but there are important questions that published incident databases do not fully resolve.

How Many Cryptocurrency Hacks Happen Worldwide?

There is no universal incident count. TRM reported 207 hacks and exploits during the first half of 2026. CertiK counted 344 broader Web3 security incidents over the same period. Chainalysis' personal wallet research counts a much larger population of individual compromises.

All can be valid measurements without describing the same set of events. A worldwide count would require common definitions and comprehensive reporting of incidents that may never become public.

What Percentage of Stolen Cryptocurrency Is Eventually Recovered?

CertiK publishes combined frozen-or-returned amounts. Elliptic reports assets verified as frozen or seized. Exchanges may separately disclose customer reimbursement.

None of those measures alone establishes a complete industry-wide recovery rate. To calculate one consistently, researchers would need comparable gross theft values and verified amounts actually returned, measured at defined dates across the same incidents.

Which Type of Crypto Platform Is Most Vulnerable?

A centralised exchange may lose more money simply because it holds substantially more assets than a smaller DeFi application. The OECD's exchange comparison measures losses, not the probability of an attack or the loss rate per dollar exposed.

To determine relative vulnerability, researchers would need both a common incident dataset and comparable information about the assets, platforms, or transactions exposed to attack.

How Much Crypto Theft Can Be Attributed to Specific Groups?

Chainalysis and TRM publish substantial estimates for North Korea-linked activity. The FBI has formally attributed specific incidents.

But there is no comprehensive public classification assigning every crypto hack to a known group. Some investigations take months or years. Others never produce a public attribution.

The unidentified share prevents an exact ranking of all hacking groups by the total value stolen.

How to Verify These Crypto Hacking Statistics

Some of the most useful findings in this article are calculations from published research. They can be reproduced without access to private datasets.

The input figures are rounded in some reports, so the calculated results should also be treated as approximate.

When checking a cryptocurrency hacking statistic elsewhere, three questions are especially useful: What incidents were counted? What reporting period was used? And does the figure refer to gross losses, adjusted losses, or recovered assets?

Sources

Every figure above traces to one of these.

1. DefiLlama, Hacks and Exploits Databasedefillama.com
2. CoinGecko, Crypto Hacks and Exploits Through the Yearscoingecko.com
3. TRM Labs, H1 2026 Crypto Hacks Reporttrmlabs.com
4. TRM Labs, 2026 Crypto Crime Reporttrmlabs.com
5. CertiK, Hack3D H1 2026 Reportcertik.com
6. Chainalysis, Crypto Hacking and Stolen Funds Researchchainalysis.com
7. Chainalysis, 2025 Crypto Crime Mid-Year Updatechainalysis.com
8. OECD, Asia Capital Markets Report 2026oecd.org
9. Immunefi, 2026 Hacks Breakdownimmunefi.com
10. FBI, North Korea Responsible for Binance Attackfbi.gov
11. Elliptic, Binance Hacking Investigationelliptic.co
12. Bybit, Security Incident: Timeline of Events and FAQsbybit.com
13. Binance, Security Incident Update #2 (30 October 2026)binance.com