ScamSonnar

Why 2026 Is a Record Year for Crypto Hacks: What the Data Shows, What It Doesn’t and How Banks Compare

Crypto hacks are up sharply in 2026. See what the data shows, how exchanges, wallets and banks compare, and what ordinary users can do to reduce risk.

Published: November 3, 2026
📌 Pinned Check a Wallet Address Before Sending Crypto – Free, No Sign-Up → or create a free account

Headlines in 2026 have been dominated by hacks: a record-size incident at one of the world's largest exchanges, a Brazilian exchange pausing withdrawals, a hardware-wallet supply-chain attack and even attacks on supermarket refrigeration systems. It can feel as if something unusual happens every week. This article looks at what the available data says, what it cannot tell us and how banks compare. Figures are as of 3 November 2026 and may change.

What the data shows

According to Immunefi's 2026 breakdown (covering the year to about 21 October 2026):

Cointelegraph, citing an analysis based on DefiLlama data, reported that the second quarter of 2026 had the most exploits on record by count (83 as of 22 June), with about $755 million stolen at that point. Bridges were the costliest attack vector.

Record count, not necessarily record losses

It is important to separate how many attacks happened from how much was stolen. Blockaid described the first half of 2026 as the most-hacked half-year on record by number of incidents, with more than $1 billion lost, according to The Block. But dollar losses were lower than in the first half of 2025, which was inflated by the Bybit exploit that year. CertiK's half-year report, as covered by ForkLog, put losses at about $1.32 billion, down 46.8 percent from a year earlier. ForkLog reports that, excluding that one 2025 outlier, CertiK's figure was about 28 percent higher than the year before.

In other words, there were more attacks, but the very largest single events were not larger than in 2025. The late-October Binance incident changes the full-year picture and is not included in the half-year reports.

Is November a bad month?

We found no evidence of a seasonal pattern. Immunefi's reports show that monthly losses swing widely depending on a few large events. In November 2024, losses from hacks and rug pulls were about $71 million across 26 incidents, the second-lowest month of that year. November 2023 was about $343 million. A few big incidents decide a month, not the calendar.

Why different trackers show different numbers

Reports on the first half of 2026 do not agree. One set of figures, about 207 incidents and about $972 million, was attributed to Immunefi by KuCoin and to TRM Labs by ForkLog. CertiK reported about $1.32 billion. Blockaid reported more than $1 billion. ForkLog suggests the gap between CertiK and the lower figure may come from CertiK counting a broader set of incidents, including scams. When you read a statistic, check who produced it and what it includes. We have not independently verified these figures, so please read the original reports.

What is causing it?

Immunefi's analysis points to flaws in contract code and to compromised keys and access controls as leading causes, although the categories overlap. Cross-chain bridges were a particularly expensive target.

According to TRM Labs, as reported by ForkLog, smart-contract hacks were the most common type, but infrastructure and operational compromises made up only about 15 percent of incidents while causing roughly 76 percent of losses. TRM Labs also estimated that groups linked to North Korea stole about $643 million, around two thirds of the funds stolen in the half-year. This is the firm's estimate, not an independently confirmed figure.

Whether artificial intelligence is making attacks easier is debated. Cointelegraph reports that Immunefi's CEO believes new AI models have shifted the balance toward attackers, but the article provides no data linking AI to incident counts, so this remains an opinion. Another analyst quoted there argues that protocols are being built faster than risk management keeps up, giving the example of a multisignature wallet with three keys stored on one laptop.

Recent incidents, with what is and is not known

How banks compare

Banks are also breached often. The Identity Theft Resource Center's 2025 report, as reported by American Banker, counted 739 breaches in financial services in 2025, the most of any sector for the second year in a row. About 30 percent of incidents involved third parties, and only about 30 percent of breach notices disclosed their root causes.

Some of the risks overlap with crypto: third-party suppliers, legacy systems, phishing and social engineering. What differs is the protection around the customer. Under EU rules, the European Central Bank says €100,000 per depositor is guaranteed through deposit-guarantee schemes. In the United States, the FDIC has said that deposit insurance covers up to $250,000 per depositor and does not apply to crypto assets or to the failure of non-bank crypto firms. Rules differ in other countries, so check your own country's rules with your national regulator.

Banks and crypto are also getting closer. The Block reported in August 2026 that Citi expected to launch a digital-asset custody service "later this year", starting with bitcoin, as part of a platform called Custody+. At the time of that report it had not launched. Whether it has launched since, please check with the bank.

What ordinary users can do

What this article cannot tell you

We cannot say whether 2026 will end as the worst year on record, because the data covers only part of the year and the trackers disagree. We also cannot say that the incidents above are connected. Where reports link them, as with the Binance and Mercado Bitcoin cases, the sources we read say no public evidence of a connection exists.

Incident reports change quickly. Verify the latest figures and statements from official sources and the original reports yourself.

This article is for general information only and is not financial advice.

Sources

Several of these sources report the same events and are not independent confirmations of each other. Please read the originals.