Crypto hack losses fell below $1 billion in the first half of 2026, according to security firm Immunefi, even as the industry recorded its highest-ever volume of attack attempts during the same period.

The findings, published in Immunefi's half-year report and reported by The Block, point to a structural shift in the threat environment: adversaries are probing more aggressively than at any point on record, but the capital captured per successful incident has declined. The result is a divergence between attack frequency and financial damage that security teams and exchange risk officers will need to reconcile.

Why are losses falling while attacks multiply?

The data suggests defenders are getting faster. Incident response pipelines, real-time monitoring and automated circuit breakers on major protocols have shortened the window between a breach and containment, limiting how much value attackers can extract before funds are frozen or traced.

At the same time, the report's framing of "record attack volume" indicates the adversary side has industrialized. Attempted exploits, phishing infrastructure and social-engineering campaigns now run at a scale that was not present in earlier market cycles, meaning the drop in losses reflects improved defense rather than a calmer threat landscape.

For protocols and centralized platforms, the operational consequence is direct: security budgets can no longer scale to incident count alone. Firms must prioritize pre-deployment audits, bug bounty coverage and post-incident recovery tooling, since the marginal attack is increasingly cheap for criminals but expensive to triage one by one.

What does the sub-$1 billion figure signal?

Crossing below the $1 billion threshold for a half-year period marks a meaningful change from prior cycles, when single semesters routinely produced headline losses well above that level. It also narrows the asymmetry that once defined crypto security discourse — massive, protocol-level collapses that wiped out treasuries in single transactions.

Industry analysts will watch whether the trend holds as attackers adapt. Historically, declines in measured losses have been followed by bursts of novel attack vectors targeting cross-chain bridges, wallet infrastructure and signing workflows. Immunefi's data implies the next battleground is volume-driven, low-yield attack campaigns rather than isolated megathefts.

Business implications for the sector

For exchanges, custody providers and DeFi protocols, the report carries three practical takeaways:

• Loss-per-incident is compressing, so insurance and reserve models calibrated to catastrophic single events may need re-underwriting.
• Attack volume at record levels raises operational expenditure on monitoring and triage even when net losses fall.
• Demonstrable containment capability is becoming a competitive differentiator for institutional clients evaluating venues and protocols.

Security firms themselves face a changing market. Bug bounty platforms like Immunefi sit at the center of the volume surge, processing more submissions and more attempted-exploit intelligence than ever. That positions them as critical infrastructure for an industry where the marginal cost of launching an attack continues to approach zero.

The second half of 2026 will test whether the first-half improvement reflects durable defensive maturity or a temporary gap before adversaries deploy new tooling against it.