CertiK: In the first half of 2026, Web3 losses exceeded $1.3 billion, with attacks accelerating towards high-value targets

Web3 security company CertiK released the "Hack3D: First Half of 2026 Report." The report shows that in the first half of 2026, the Web3 ecosystem experienced a total of 344 security incidents, with cumulative losses of approximately $1.32 billion. Although this figure represents a 46.8% decrease compared to the same period last year, if we exclude the impact of the $1.45 billion security incident encountered by Bybit, the loss scale in the first half of this year has actually increased by about 28% year-on-year, indicating that the overall security environment in the industry has not seen substantial improvement.

The report points out that wallet theft has become the largest type of attack causing financial losses, resulting in approximately $450 million in losses in the first half of the year; meanwhile, although the number of phishing attacks has decreased by over 50% year-on-year, the amount of losses has only decreased by about 10.8%, reflecting that attackers are increasingly targeting high-net-worth individuals and institutional targets, implementing more focused high-value attacks.

In addition, code vulnerabilities remain the most frequently occurring type of attack, with related incidents reaching 204. CertiK believes that attackers are increasingly targeting long-running and outdated smart contracts that lack re-auditing.

The report also shows that large-scale attack incidents continue to dominate industry losses, with the Kelp DAO and Drift Protocol incidents collectively causing approximately $577 million in losses, accounting for 44% of the total losses in the first half of the year. From the perspective of incident quantity, the impact of single attacks, and changes in attack patterns, the Web3 industry is facing increasingly complex and continuously escalating security challenges.