Crypto protocols, exchanges and individual wallets have been hit by 250 hacks so far in 2026, according to a tally kept by the data site DefiLlama. Losses from those incidents passed $1 billion by September, a figure that now looks certain to climb before the year is out.
The count puts 2026 on track to be one of the worst years on record for crypto security — and it's only October.
A steady drumbeat, not one big blowup
What stands out in this year's numbers isn't a single catastrophic breach. It's the volume. Two hundred and fifty separate incidents through nine months works out to roughly one hack every 26 hours. That kind of cadence is hard for any industry to absorb, let alone one where stolen funds are usually gone for good.
The $1 billion figure isn't a peak-year total yet, but the direction is clear. With a full quarter left, the cumulative damage from 2026 will keep growing unless the pace slows sharply.
Where the money is going
DefiLlama's data tracks the losses but doesn't attribute them to a single cause in the figures cited here. What the tally does show is that the problem is spread across the sector rather than concentrated in one corner. DeFi protocols, bridges and centralized services have all taken hits this year.
For users, the practical effect is a market where the risk of holding assets anywhere is higher than it was a year ago. For teams building on-chain, it means security budgets and audit schedules are no longer optional line items.
The regulatory pressure builds
The surge in hacks has renewed calls for stronger security standards and clearer oversight of digital-asset platforms. The argument from regulators and some industry participants is straightforward: at this scale of loss, self-policing clearly isn't working well enough.
But tougher rules raise their own questions. Custody requirements, disclosure timelines and cross-border enforcement are all still unsettled in most major markets. The hacks keep coming while those debates drag on.
What's left of 2026
Three months remain in the year. If the current rate holds, 2026 will close with well more than 250 incidents and a loss total north of $1 billion.
The next concrete marker will be the year-end data from DefiLlama and other security trackers, which will show whether the third-quarter pace carried into the final stretch. Until then, the only certainty is that the number on both counts is still moving in one direction.
