The 5 Biggest Crypto Hacks and Scams of 2026 (So Far) — and How Each One Actually Worked

Crypto didn't get safer in 2026 — attackers just changed targets. Security firms tracked a record number of incidents in the first half of the year: TRM Labs counted 207 hacks draining about $972 million, while CertiK's broader count (including scams) reached $1.32 billion. The pattern behind the numbers matters more than the numbers themselves: the biggest losses came from social engineering and stolen keys, not smart contract bugs. Attackers are hacking people and infrastructure, not code.

Here are the five incidents and scam waves that defined the year so far.

1. Kelp DAO — $293 million

The largest DeFi exploit of 2026. In April, attackers exploited a single point-of-trust failure in cross-chain messaging infrastructure connected to LayerZero, draining roughly $293M from the restaking protocol. The attack has been linked to North Korea's Lazarus Group.

The lesson: cross-chain bridges and messaging layers remain crypto's most dangerous infrastructure. Even if a protocol's own contracts are audited, it inherits the risk of everything it connects to.

2. Drift Protocol — ~$280 million

Days apart from Kelp, the Solana-based perpetuals platform Drift was hit for approximately $280M [VERIFY: sources range $280–285M], also attributed to Lazarus Group. Together, North Korea-linked operations accounted for roughly 66% (~$643M) of all H1 2026 theft.

The lesson: the largest 2026 incidents compromised RPC infrastructure, admin permissions, signing systems, or privileged devices — not public smart contract code. "Audited" doesn't mean the team's laptops are safe.

3. The address poisoning epidemic — $83.8 million from 6,600+ victims

Not one hack — a mass-scale scam hitting ordinary users. A March 2026 USENIX study found over 6,600 victims lost a combined $83.8 million to address poisoning.

How it works: scammers use a vanity address generator to create a wallet matching the first and last 4 characters of yours, then send you a zero-value transaction so their address appears in your history. Later, you copy "your" address from history — and send funds to them instead.

The lesson: verify the entire address before sending, or use whitelisted addresses. A zero-value transaction from a look-alike address in your history is a red flag, not a glitch.

4. AI-powered pig butchering and deepfake investment scams

The costliest category by raw dollars isn't hacking at all. Investment fraud ("pig butchering") caused $7.2 billion in US losses in 2025 — more than any other category — and AI deepfake scams using fake celebrity videos are the fastest-growing threat in 2026. Chainalysis found scam operations using AI services were roughly 4.5x more profitable than those without — AI now handles the fake relationships, cloned interfaces, and multilingual conversations at scale.

The lesson: a video of a famous person promoting a platform is not proof of anything anymore. Guaranteed-return platforms introduced by someone you've never met in person are the scam, every time.

5. Ice phishing and approval drainers — the job offer that empties your wallet

The quiet workhorse of 2026 wallet theft. A common tactic involves fake recruiters asking you to "test" a new crypto app or connect your wallet to a hiring portal — granting "Set Approval For All" and letting them drain your tokens instantly. Even security firms aren't immune to social engineering: wallet company Zerion disclosed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from its hot wallets.

The lesson: every signature and approval is a permission that persists until you revoke it. Check what your wallet has approved regularly — you can scan any address for risky or unlimited approvals (and revoke them) with our free Token Approval Checker & Revoker. No sign-up, runs in your browser.

How to not be on next year's list

• Never share a seed phrase — no legitimate support will ever ask
• Verify full addresses, not just the first/last characters
• Review and revoke token approvals monthly, especially unlimited ones to contracts you no longer use
• Treat unsolicited "opportunities" — jobs, tests, romance, celebrity endorsements — as hostile by default
• Use a hardware wallet for anything you can't afford to lose, and enable withdrawal whitelisting on exchanges

FAQ

What was the biggest crypto hack of 2026? The Kelp DAO exploit (~$293M in April 2026), linked to North Korea's Lazarus Group, via a cross-chain messaging infrastructure failure.

Are most crypto losses caused by smart contract bugs? No — in 2026 the biggest losses came from social engineering, stolen keys, and compromised infrastructure rather than contract code.

How do I check if my wallet has dangerous approvals? Paste your address into an approval checker tool, look for unlimited approvals or contracts you don't recognize, and revoke them (a small gas fee applies, since revoking is an on-chain transaction).