February Crypto Hack Losses Hit $37.7M, Lowest Since March 2025

The flow of crypto hack losses has swung sharply lower in early 2026. The first two months combined for a total of $112.53 million in losses, with January accounting for the bulk of that total. This marks a significant pullback from the prior month, as February's losses fell to $37.7 million.

That figure represents the lowest monthly loss since March 2025 and a dramatic 67% month-on-month decline from January's $86.01 million. The shift highlights the extreme volatility in exploit activity, where a handful of large incidents can drive monthly totals, and their absence leads to a steep drop.

The pattern underscores a concentration risk. While the aggregate flow has cooled, February's losses were again dominated by a small number of incidents, with the top five accounting for nearly 98% of the total. This suggests the underlying vulnerabilities persist, even as the overall dollar volume of attacks has pulled back.

The Concentration and Vector Shift

The structural flow of attacks reveals a persistent concentration of risk. In January, the top five incidents accounted for over half of the $86.01 million total, with Step Finance alone draining $28.9 million. This pattern of a few large exploits dominating the monthly flow is a recurring feature, not a one-off.

The dominant attack vector has clearly shifted from on-chain code to operational failures. While protocol exploits like Step Finance and Truebit drew headlines, phishing and social engineering drove $311.3 million of the January total. This represents a massive pivot, where human and corporate vulnerabilities are now the primary target as on-chain security improves. The implication is a tactical evolution by attackers. As on-chain security improves, criminals are moving to softer targets. The data shows a clear trend: scammers are outpacing traditional infrastructure hacks, focusing on impersonation and AI-enabled schemes that exploit trust and urgency. This shift means the attack surface is changing, but the overall flow of stolen value remains high.

Catalysts and Risks for the Flow

The low-loss trend in February is fragile and faces clear catalysts and persistent risks. A key near-term catalyst is the SEC's Crypto Task Force roundtables, which began on March 21. These sessions aim to provide regulatory clarity, a potential boost for institutional adoption and market stability. If they foster a more predictable environment, it could further reduce exploitable uncertainty and support the current downward flow of hack losses.

The most immediate risk is a single large-scale social engineering attack. In January, a $284 million scam alone drove the monthly total to a record high. Such incidents can quickly skew monthly figures, as they did then. The shift in attack vectors toward phishing and social engineering means a major new scam could easily reverse the recent pullback, reintroducing the extreme volatility seen in January.

Beyond tactical swings, a systemic risk persists: illicit activity remains deeply embedded in the crypto ecosystem. In 2025, illicit actors captured 2.7% of available crypto liquidity. This represents a massive, concentrated pool of capital that is inherently vulnerable to theft and manipulation. The sheer scale of this illicit liquidity-over $154 billion in 2025-provides a vast target for attackers, ensuring that the underlying flow of stolen value remains significant regardless of short-term monthly fluctuations.