Crypto Security Losses Top $1 Billion in Record-Breaking First Half of 2026

Cross-chain bridges emerged again as the dominant failure surface in the first half of 2026, according to on-chain security platform Blockaid, which reported cumulative losses from crypto security breaches exceeding $1 billion across 212 separate incidents — a record high for any six-month window the firm has tracked.

Where the bleed happened

Blockaid's tally, summarized by Crypto Briefing, attributes roughly $332 million in losses to Ethereum-linked projects and approximately $326 million to Solana-linked projects, putting the two largest smart-contract ecosystems within a rounding error of each other in terms of attacker yield. The single largest incident in the period — a cross-chain exploit against restaking protocol KelpDAO — accounts for $292 million of the total, underscoring how a single bridge or validation-layer vulnerability can dwarf the cumulative damage of dozens of smaller exploits. Additional incidents involving WEMIX and the Garden protocol, referenced by BeInCrypto and CryptoRank, fit the same trend of late-quarter incidents pushing the H1 total past prior benchmarks.

Why this attack class keeps working

From an architectural standpoint, the recurring pattern is not coincidental. Cross-chain messaging layers — whether generalized bridges, restaking wrappers, or shared validator/DVT networks — effectively re-introduce trust assumptions that the underlying chains were designed to eliminate: the verifier set is typically smaller than either chain's native validator pool, the state representation on the destination chain is a projection rather than a direct witness, and finality across two systems is rarely atomic. Any pause, reorganization, or compromise on the source side propagates as an arbitrary-mint or arbitrary-burn vector on the destination. KelpDAO's incident fits this template precisely: the cross-chain layer was used as entry point, and the loss extended across both restaked assets and downstream defi positions. Separately, Decrypt reports that payments provider NOWPayments and security firm BlockSec have released a crypto payment security and technical compliance checklist — a more applied artifact aimed at merchants and integrators rather than core protocol teams, but indicative of industry-side hardening running in parallel with the breach volume.

What protocol teams and integrators should track

For engineers and security reviewers, the practical watchlist clusters around three vectors. First, expect continued regulatory scrutiny of bridge and restaking infrastructure — specifically how cross-chain validation is treated under existing custody and disclosure frameworks, since large interoperability protocols increasingly resemble systemic chokepoints. Second, monitor the post-mortems from KelpDAO and similar targets: whether slashing conditions activate for the compromised validator set, whether recovery proceeds through on-chain governance, and whether restaked collateral is socialized across holders. Third, measure the gap between vulnerability disclosure and weaponization on the protocols you depend on — that window is where real-time monitoring, rate limits, and circuit breakers earn their cost, and it has been narrowing, not widening.