The Half-Year Ledger: 207 Hacks, $972M, and a Rising Machine Tempo

The first half of 2026 closed with 207 recorded hacks and roughly $972 million lost, per TRM Labs — the worst half-year in the firm's dataset. By August, with the $116M Coldcard drain and a run of follow-on incidents, the running annual total had already passed $1.2 billion across 276 incidents.

What the composition says

Totals make headlines; composition makes policy. Three shifts inside the number matter more than the number. First, the victim profile is widening — this year's marquee losses hit individual self-custody users, not just protocols and exchanges, which changes the political salience of crypto crime. A drained DeFi protocol is an industry story; thousands of individuals losing retirement-sized sums from devices marketed as safe is a constituent-services story.

Second, supply-chain and infrastructure compromises — firmware, vendor databases, bridge permissions — are displacing the classic smart-contract exploit. The attack surface is migrating from code that gets audited to operational plumbing that doesn't. Third, tempo: TRM's 40% year-over-year rise in AI adoption across crypto crime means H1's record was set by attackers still mostly working at human speed.

The regulatory read

Loss curves precede rulemaking; it has happened after every major loss cycle since Mt. Gox. If the pattern holds, expect pressure in three places: disclosure timelines for custody-adjacent vendors (SafePal's breach is the exhibit), security standards for consumer key-management devices, and scrutiny of agent-money products as exchanges wire AI tools to trading rails. The industry can write those standards itself first, or read them in a rule later.