According to PeckShield's latest data, August 2026 recorded 50 major crypto hacks, marking the highest monthly count of 2026 and representing a significant increase from the 40 incidents recorded in April, May, and June combined. However, total losses fell dramatically to $136.3 million, down 49.5% from July's $268.4 million. The data shows attackers striking far more often while extracting less from each incident, with the average loss per hack falling to approximately $2.7 million from roughly $9 million in July. PeckShield reports that the top ten incidents accounted for $123.34 million of August's total, leaving around $12.9 million across the other 40 hacks. This represents a concerning trend where attack frequency has more than doubled while individual losses have decreased significantly.
The $74 million Tectonic exploit on Cronos emerged as August's largest incident, making it the fourth-largest crypto theft of 2026 to date. As reported by PeckShield, the attacker moved only about $6 million to Ethereum before validators froze the network. The company noted that "the exploiter has since started laundering the stolen funds, bridging them to #BTC (~200K so far)". Cronos then restored the chain state to a point before the attack and resumed block production. Moonwell followed with $8.7 million in losses, while Term Labs lost $8.5 million, Coinsbuy $7.9 million, and TAC $7.5 million. The remaining top ten included Injective, MANTRA, BounceBit, Cosmos Labs, and aquifer.
According to CoinGecko's 2026 state of crypto security report, 2026 has logged 233 separate incidents worth roughly $1.31 billion, compared to 92 incidents and $2.37 billion in losses during the same stretch of 2025. Incident volume more than doubled while total losses fell about 45%, with average loss per incident dropping from $25.8 million to $5.6 million. The $1.5 billion Bybit theft in 2025 inflated that year's total, while three cases carried most of this year's total: Kelp DAO lost $292 million and Drift Protocol lost $285 million in April 2026. April remains the year's costliest month at $646.89 million, driven by the Drift and KelpDAO exploits, with those two incidents alone accounting for $577 million.
The damage from attacks came primarily from sources other than smart contract flaws. Supply chain and infrastructure breaches took more than $1.8 billion, representing the largest single category in the report. Overall, smart contract exploit-driven losses across decentralized applications (dApps) reached $546 million. The report noted that attackers targeted external infrastructure, code shipped after audit closures, and systemic features that could be manipulated through governance. May's Stake DAO breach exemplified this trend, where an attacker compromised a deployer key rather than exploiting contract logic. The damage pattern shows that while smart contract vulnerabilities remain significant, they represent a smaller portion of total losses compared to infrastructure and supply chain attacks. State-backed groups have also adopted longer operations, with two North Korea-linked attacks draining approximately $577 million through social engineering and bridge infrastructure compromises rather than ordinary contract flaws.
The report reveals concerning trends in insurance coverage against crypto losses. Active on-chain insurance fell 20.2% to $130.2 million, and five of nine insurance protocols went inactive or changed direction. The losses also cluster tightly, with the 10 largest attacks alone producing 72.5% of total stolen value across the 19-month window. Cumulative payouts remained near $33 million, according to CoinGecko. The decline in insurance coverage coincides with the overall reduction in total losses, suggesting that the market may be adapting to a more risk-averse environment for crypto insurance products. The sector is also struggling to scale, with 5 of 9 on-chain insurance protocols becoming inactive or pivoting by August 2026. This decline comes as the SEC revisits its Custody Rule to clarify who can safeguard customer crypto, with proposed amendments submitted for review on August 25th, 2026, and publication expected by October 2026.
