In the first half of 2026, hackers stole nearly $1 billion from crypto protocols. But if you focus on the number, you miss the story. The real story is about how they stole it.
TRM Labs just dropped its H1 2026 report, and the data is a wake-up call. Attack incidents doubled—from 83 in H1 2025 to 207 this year. Yet total stolen value hit its lowest H1 since 2022, barely scraping past $1 billion. That paradox is the first clue: the market thinks security is improving, but the reality is more nuanced.
The median loss was just $219,000, meaning most attacks are small. But the average loss was $4.7 million, skewed by a handful of massive heists. And here’s the kicker: 15% of incidents—those targeting infrastructure and operations—accounted for 76% of all value stolen. That’s nearly $760 million gone in just over two dozen attacks.
This is not about smart contract bugs anymore. It’s about operational security: private keys, approval flows, and the trust framework around who can move money.
Welcome to the New Threat Model
I’ve been in this industry since the early DeFi days. I remember when the Ethereum Foundation community advocated for audited code as the holy grail. But after the Terra collapse and FTX debacle, I spent months auditing governance loopholes in lending protocols. What I saw then is now confirmed: the code is cold, but the community is warm—and that warmth can be exploited.
TRM Labs’ report is explicit: “The majority of large losses did not come from pure smart contract code vulnerabilities. Instead, they originated from systems that decide ‘who can move funds,’ ‘how signatures are approved,’ and ‘how the ecosystem around a protocol is trusted.’” Translation: the biggest security gap is no longer in the code—it’s in the process.
Consider the two most damaging events of 2026 so far: Drift Protocol’s $285 million exploit and KelpDAO’s $292 million heist. Combined, they accounted for nearly $577 million—almost the entire North Korea-linked total of $643 million, which itself was 66% of all stolen funds. These weren’t flash loan attacks or reentrancy bugs. They were sophisticated operational breaches.
From hype cycles to hydraulic stability. The bull market euphoria masks technical flaws, but I’ve learned to see through marketing with code audit eyes. Today, that means looking beyond the contract and into the governance structure.
Why Operational Attacks Are So Devastating
When a hacker exploits a smart contract bug, the damage is often limited by the logic of the contract itself. Patching is possible. But when an attacker compromises a private key or a multi-signature approval flow, they gain god-mode access. They can drain everything in minutes.
TRM Labs notes that operational and infrastructure attacks made up only 15% of events, yet stole 76% of value. That’s a massive leverage point. Attackers are no longer hunting for obscure mathematical flaws; they’re hunting for human error, weak vendor trust, and slow coordination.
The report lists future risk areas: weak approval processes, private key leaks, social engineering, over-trusted vendors or infrastructure dependencies, and slow cross-chain response plans. All of these are operational, not technical. They’re about how people and processes interact with code.
This is the new security frontier. We are not just users; we are the protocol. Every decision we make about key management, multisig design, and supplier vetting becomes a defense line.
North Korea: The State-Sponsored Threat
Let’s talk about the elephant in the room: North Korea. The $643 million linked to DPRK-affiliated activities is not just a number—it’s a declaration of intent. These aren’t script kiddies; they are highly persistent advanced persistent threats (APTs) combining technical skill with social engineering, patience, and state-directed financial goals.
TRM Labs points out that their activity isn’t just technical intrusion—it’s a blend of social engineering, patient operations, money laundering infrastructure, and state-directed financial objectives. In other words, they treat crypto theft as a national strategic priority.
The Drift and KelpDAO attacks bear their signature. Both protocols had large treasuries, complex governance structures, and presumably multiple layers of security. Yet the attackers found the weak link in the operational chain.
This changes the calculus for every protocol with significant TVL. If you’re building a DeFi platform and relying solely on a smart contract audit, you’re essentially leaving your front door unlocked while investing in a state-of-the-art lock for the back door.
The Blind Spot in the Market’s Perception
Here’s the contrarian angle: the market is obsessed with code audits. Investors ask, “Has it been audited by Trail of Bits or OpenZeppelin?” as if that’s the ultimate seal of safety. But the data shows that audits are not catching the biggest risks. They are necessary but not sufficient.
TRM Labs explicitly states: “Audits cannot be the ceiling of the security program. Protocols need to strengthen operational controls around asset movement, key management, signature infrastructure, approval processes, and custody.”
This is a paradigm shift. The traditional audit industry’s value proposition—that a clean audit equals safe protocol—is being challenged. We’re entering an era where operational security audits will become as essential as code audits, and likely more expensive.
I’ve seen this tension firsthand. In my “Anti-Hype” workshops during the 2022-2023 bear market, I taught developers to think beyond code. I showed them how a single misconfigured multisig could wipe out months of work. The response was always the same: “But we already audited the contract!” They missed the point.
Chaos is just order waiting to be optimized. The chaotic nature of operational risk is precisely why it’s so dangerous—it feels like a people problem, not a tech problem. But with proper systems, it can be tamed.
What Protocols Must Do Now
First, recognize that your security team should include more than just auditors. You need operational security engineers, governance architects, and a SOC (Security Operations Center) that monitors on-chain behavior for anomalies.
Second, treat your key management like a nuclear launch code. Use hardware security modules (HSMs) for large treasuries, implement time-locks for critical operations, and ensure that no single person—or small group—has unilateral control over funds.
Third, vet your vendors and infrastructure dependencies. Many attacks exploit over-trusted relationships with oracles, relayers, or liquidity providers. Conduct thorough due diligence and limit what permissions you grant external actors.
Fourth, practice cross-chain incident response. As the report notes, slow cross-chain response plans are a future risk bucket. If an attack happens on Chain A, can you pause operations on Chain B in minutes, not hours? If not, you’re exposed.
The Upcoming Opportunity: Operational Security as a Service
This shift creates a massive opening for startups focused on operational security. Companies that offer private key custody (like Fireblocks), multisig orchestration, approval flow management, and continuous monitoring will see demand explode. The threat intelligence space—including TRM Labs itself—becomes a must-have rather than a nice-to-have.
I also predict the rise of “operational security audits” as a standalone service. These would assess governance structures, key distribution, supplier risks, and incident response plans. They will likely command premiums above traditional code audits.
Additionally, insurance protocols like Nexus Mutual and Unslashed have a golden opportunity—and a challenge. They need to underwrite risks like social engineering and internal threats, which require new pricing models and deep data. The ones that succeed will become the backbone of DeFi trust.
The Regulatory Ripple Effect
North Korea’s involvement has regulatory implications. Expect OFAC and similar bodies to increase pressure on protocols and exchanges that inadvertently facilitate money laundering from these attacks. The line between decentralized and regulated will blur further.
DeFi protocols handling over certain thresholds may be forced to implement Know-Your-Transaction (KYT) screening similar to centralized exchanges. This will push the industry toward compliance-as-code, embedding legal requirements directly into smart contract layers.
From my experience bridging institutional and crypto worlds in 2024-2025, I know that compliance doesn’t have to kill innovation. But it does require thoughtful design. The protocols that preemptively adopt robust operational controls will have a competitive advantage when regulators come knocking.
A Personal Reflection
I’ve been through enough cycles to know that every bull run brings new security blind spots. In 2017, it was reentrancy. In 2020, it was flash loans. In 2022, it was governance attacks. Now, in 2026, it’s operational security.
Each time, the industry adapts. But adaptation takes time, and during that time, money gets lost. The TRM Labs report is not just data—it’s a map of where the next landmines are buried.
We are not just users; we are the protocol. That means every one of us—builder, investor, or casual user—needs to ask harder questions. Where are the keys? Who approves large transfers? What happens if a signer goes rogue? If you don’t know the answers, you’re already vulnerable.
The code is cold, but the community is warm. And sometimes, that warmth is exactly what attackers exploit. It’s time to secure not just the code, but the people and processes behind it.
The Takeaway: Vision Forward
The next wave of crypto security will be defined by operational resilience. Protocols that invest in key management, approval workflows, and vendor vetting will survive. Those that rely solely on code audits will be hacked.
As I write this, I’m working on a project at the intersection of AI and blockchain—verifiable on-chain training datasets. The same principles apply: we need to trust the infrastructure, not just the algorithm.
From hype cycles to hydraulic stability. The industry is maturing, and maturity means recognizing that security is never one-and-done. It’s a continuous practice of evaluating how power is distributed and how trust is managed.
Are you ready to build that future?