Crypto losses from hacks and exploits have reached $1.2 billion in 2026, according to data compiled by CryptoRank, with a single breach of hardware wallet maker Coldcard accounting for roughly 10% of the total, or approximately $120 million.

The figure, published in CryptoRank's latest REKT database update, reframes the security debate in crypto away from smart-contract vulnerabilities and toward the physical and firmware layer of self-custody infrastructure. A hardware wallet vendor compromise differs structurally from a protocol exploit: the attacker does not need to find a flaw in a chain's code, only in the vendor's build, shipping or key-generation pipeline.

The Coldcard incident's share of the annual total is the most operationally significant data point in the release. Hardware wallets manufactured by Coinkite, Coldcard's parent company, are marketed specifically to users who assume device-level trust. If that assumption fails, the blast radius extends to every wallet generated on an affected unit, regardless of how carefully the user manages seed phrases, passphrases or multisignature setups.

A 10% single-vendor concentration also tells a market-structure story. In prior cycles, headline losses clustered around cross-chain bridges, lending protocols and bridge validators, where individual incidents routinely cleared hundreds of millions of dollars. The 2026 mix, as aggregated by CryptoRank, suggests the loss distribution has broadened: no single protocol collapse dominates the $1.2 billion total, and a custody-hardware failure ranks among the year's largest events.

For institutional operators, the implications are concrete. Treasury teams that treat hardware signer procurement as a commodity decision now face a due-diligence burden comparable to exchange counterparty review. Device provenance — firmware attestation, tamper evidence, verified build reproducibility — moves from nice-to-have to audit-line item. Firms running multisignature schemes should confirm whether their policy requires heterogeneous signer vendors; a Coldcard-only quorum concentrates exactly the kind of vendor risk this breach illustrates.

The $1.2 billion annual run-rate, if sustained, keeps crypto exploit losses within the range established in recent years, when totals tracked between roughly $1.5 billion and $2 billion annually across major trackers. The 2026 number covers hacks and exploits as categorized by CryptoRank's REKT leaderboard methodology, which logs incidents from on-chain forensics, protocol disclosures and security-firm post-mortems.

It is worth separating what the data establishes from what it does not. The CryptoRank release quantifies aggregate losses and attributes a 10% share to the Coldcard breach. It does not, in the summary published, break down the remaining ~$1.08 billion by chain, vector or attacker attribution, and this report does not add figures beyond what the dataset states.

What the confirmed numbers do support is a shift in where defenders should spend. Exchange and protocol operators have spent successive cycles hardening smart contracts, adding bug bounties and deploying real-time monitoring. Those controls do not address a compromised signing device at the edge of the custody chain. The Coldcard breach sits outside that perimeter entirely, which is precisely why it could capture a tenth of annual losses in one event.

The operational consequences extend to procurement cycles. Hardware wallet refresh schedules, previously driven by device aging or feature updates, now need a security-driven trigger: firmware compromise windows, vendor incident disclosures and certificate rotation. Vendors, for their part, face higher expectations on signed firmware, reproducible builds and disclosure timelines, because a single failure now carries a measurable nine-figure cost.

For Coinkite specifically, the reputational math is unforgiving. Coldcard's product thesis has always been maximalist self-custody — air-gapped signing, open firmware, minimal trust in third parties. A breach that accounts for 10% of industry-wide losses in a given year strikes directly at that thesis, and rebuilding device trust typically requires independent audits, verified toolchains and transparent post-mortems, none of which can be compressed into a short cycle.

Watch the next quarterly updates to CryptoRank's REKT dataset for two signals: whether the annual total trends toward or away from prior-year benchmarks, and whether the Coldcard share remains an outlier or marks the first of a series of custody-layer incidents. Insurance underwriters and institutional custody vendors will be pricing that transition over the coming quarters.