Blockaid: Ethereum and Solana are the main sources of losses for crypto hackers in the first half of

Cryptocurrency security company Blockaid reports: Loss from on-chain security incidents exceeded US$1 billion in the first half of 2026

Cryptocurrency security company Blockaid released a report saying that in the first half of 2026, losses caused by hacking and other on-chain security incidents have exceeded US$1 billion, setting a record for the number of security incidents tracked by the platform in six months. In Blockaid's first-half 2026 security report released on Tuesday, Ethereum and Solana ranked among the top in chain-level loss statistics, with approximately $332 million and $326 million stolen respectively.

Key Points

Losses exceed US$1 billion: Blockaid records show that total cryptocurrency losses exceeded US$1 billion in the first half of 2026.

212 security incidents: A total of 212 incidents occurred during this period, of which the number of verified serious vulnerability exploits in the first half of 2026 exceeded that in the whole of 2025.

Ethereum mainly exploits code vulnerabilities: The report points out that most of Ethereum's losses stem from application and smart contract vulnerabilities.

Solana losses are driven by key breach: More than 98% of Solana's losses are due to key breaches, not contract vulnerabilities.

The largest single exploit was KelpDAO: Blockaid identified the largest incident as a KelpDAO exploit, with a loss of US$292 million.

First half of 2026: The number of incidents rises, and major exploit affects results

Blockaid's report covers 212 security incidents in the first six months of 2026. Although the number of incidents has increased, the loss distribution has also been affected by a few large incidents. The largest single exploit highlighted by Blockaid came from KelpDAO, which allegedly caused $292 million in damage. Blockaid also reported that the number of verified serious exploits in the first half of 2026 was 3.4 times higher than in the entire year of 2025, indicating that serious and high-impact incidents occur more frequently than just a few outliers.

At the chain level, Ethereum and Solana account for almost all of the most important stolen funds data reported. Blockaid believes that these differences stem not only from the applications that exist on each chain, but also from how attackers execute.

Why Ethereum losses reflect the risk of high-value agreements

According to Blockaid, Ethereum suffered the largest losses in the first half of 2026, driven mainly by code exploit events-that is, vulnerabilities in applications, smart contracts, or components that interact with it. Blockaid said the most costly incidents for Ethereum included key leaks involving Humanity Protocol and StablR. In addition, the report noted that CoWSwap was the only major Ethereum incident classified as user error rather than protocol code exploitation.

In addition to individual cases, Blockaid also outlines common attack methods for Ethereum, including bridge and smart contract vulnerabilities, unauthorized access to privileged accounts, and market manipulation techniques. The report sees Ethereum as an ongoing goal, in part because it carries many of the highest value building blocks in the space-such as re-pledge platforms, stablecoins and decentralized exchanges.

The implications for investors and operators are obvious: As long as the chain continues to concentrate high-value agreements and liquidity, attackers can profit from direct smart contract vulnerabilities and operational errors such as privileged account access, turning code risk into actual theft.

Solana surges: fewer contract vulnerabilities, increased key and signer leaks

Solana's losses in the first half of 2026 were approximately US$326 million, almost the same as Ethereum. Blockaid said this figure is a significant increase compared to approximately $127 million in stolen funds in 2025. It is worth noting that Blockaid stated that this increase is not mainly caused by increased exploitation of smart contract vulnerabilities. Instead, the report points to key leaks as the main driver: More than 98% of Solana's losses during that period were related to key leaks. Blockaid linked a large portion of the losses to incidents involving Drift Protocol and Step Finance, which the report said were related to North Korean-linked cyber groups.

Blockaid also describes Solana attacker characteristics that are different from Ethereum. Ethereum's losses were mainly related to protocol code vulnerabilities, while the Solana incident focused on signer infrastructure and organizational security controls. According to Blockaid, only a small portion of Solana's losses came from code exploits, and Raydium and Volo are cited as examples of remaining code-related cases.

This is a clear operational reminder for teams built on or around Solana: Security inspections cannot stop at smart contract audits. The report's emphasis on keys, signature infrastructure, and overall security postures suggests that threat models need to regard hosting, signature processes, and privileged access as primary attack surfaces.

What to focus on next: The severity of the exploit, not just the number of incidents

As Blockaid data shows, the first half of 2026 has seen both a higher number of incidents and a significant increase in verified serious exploits. Readers should focus on whether the same balance remains in the coming quarters-especially whether Solana's key leakage trend continues and whether Ethereum's code and privileged access attack patterns accelerate as new value apps come online.