Hackers Torch $940M In 6 Months, and Security Audits Missed 94% of It
Crypto investors were fleeced of almost a billion dollars in the first half of 2026, and the industry’s favorite comfort blanket did little to stop it.
Security research house ack3 has verified 135 exploits between January and June, with $939.86m in attributed losses, averaging $6.96m each time the alarm sounded. The firm has published its full incident dataset openly, so every number can be checked line by line.
Here’s the stat that should chill every retail holder: of the money stolen from audited projects, 94.4% walked out through code or infrastructure the auditors never examined. The green tick covered the front door. The thieves came through the loading bay.
The Mega Heists Major Crypto Audits Missed
Two mega-heists account for the bulk of the carnage, and neither was a bug that an auditor missed.
Kelp DAO’s rsETH hemorrhaged $292m in April after attackers forged a LayerZero cross-chain message by compromising the protocol’s single message verifier – one checkpoint, no backup.
Two weeks earlier, Solana perps giant Drift lost $285m when operatives – linked by researchers to North Korea – spent months socially engineering their way to admin keys. Between them: $577m, roughly 61% of everything stolen all half. Not broken maths. Broken keys and broken trust.
… Continue reading the full article at the original source below.
