H1 2026 looked better on the surface, but the risk structure changed
The headline improved, but the risk profile did not get simpler. 207 attacks in H1 2026 set a record, while total losses remained below $1 billion at about $972 million stolen. The typical hack was around USD 219,000. That gap can make the market look cleaner than it is, because fewer dollars stolen does not mean the underlying threat landscape has simplified.
Two threat streams are doing different damage
The key shift is not simply more attacks. It is that losses now come from two different patterns: rare infrastructure blows and a steadier stream of smart-contract exploits. That matters because each pattern pressures the market in a different way.
Why lower losses can still hide rerating risk
A cleaner tape can be misleading. About 15% of incidents were infrastructure or operational compromises, but they drove roughly 76% of losses. In practice, that means frequent code exploits create noise and local capital damage, while the rarer infrastructure hits still carry the biggest portfolio risk.
Quick Backtesting Tool
The market may be getting better at absorbing smaller hacks. It is still exposed to the low-frequency, high-dollar strikes that can reset sentiment quickly.
Smart-contract exploits rose, but the biggest losses stayed concentrated
The split investors need to watch is mechanical, not cosmetic. 125 of the 207 incidents were smart-contract exploits, while about 15% of incidents drove roughly 76% of losses. Attack volume and dollar damage are no longer moving together.
The frequent stream versus the rare concentration event
The first track is the code stream. These exploits keep attackers active and keep the security community busy. They also show that defense has improved in measurable ways: 2026 saw USD 972 million stolen, down from USD 2.3 billion stolen during the first half of 2025. That supports the view that audits, bounties, and proactive research are making routine exploits less lucrative.
The second track is where valuation risk still concentrates. SlowMist recorded roughly $298 million in losses from supply chain attacks alone, and the Kelp DAO exploit alone was nearly $292 million. One incident can therefore absorb an outsized share of half-year damage. That is why the bull case can still fail even if exploit frequency keeps rising.
The real debate is not whether smart-contract security has improved. It clearly has. The debate is whether investors are mistaking that improvement for broad safety. Infrastructure failures, private-key compromises, and configuration errors often sit outside the same audit-and-bounty loop that has become better at stopping routine drains.
Sanctions risk may matter more than hack headlines
The next risk is not another hack headline. It is crypto's growing role in sanctioned finance. That matters because compliance risk can hit liquidity, counterparty trust, and institutional access all at once. A market that looks liquid can still get re-rated if banks and payment rails decide certain flows are too toxic to touch.
Illicit entities captured a meaningful share of available liquidity
The important signal is not just whether illicit activity exists. It is how much usable cash bad actors are absorbing. In 2025, illicit entities captured 2.7% of available crypto liquidity. In headline terms that share looks small. In market-impact terms, it is large enough to distort order flow, pressure intermediaries, and invite regulatory backlash.
The broader scale is also different from user-level exploits: sanctioned-entity activity surged 694% in 2025, and total illicit transaction volume reached $154 billion. That points to a broader shift: crypto is increasingly functioning as an alternative settlement layer, not just a target for individual hacks.
Why sanctions risk can rerate faster than hack risk
Hack risk mainly pressures protocols and focused capital. Sanctions risk pressures the intermediaries that connect crypto to the wider financial system. That is why the A7A5 case matters. The ruble-backed stablecoin processed $93.3 billion in less than a year, and related venues were sanctioned for facilitating those flows.
Bulls will argue this is still a contained problem inside a large market. Bears will argue the opposite: if state-aligned rails can move nine-figure sums reliably, regulators do not need broad crime to justify tighter access controls.
What to watch next
- any new exchange, stablecoin, or OTC partner tied to sanctioned flows
- sharper bank de-risking on crypto corridors
- regulatory guidance that moves from investigation to access restriction
- signs that illicit flow concentration is spreading beyond a few networks
