The Hacken report shows that in the second quarter of 2026, 67 security incidents in the Web3 domain resulted in a loss of $763.9 million, of which 88.3% (approximately $674.5 million) were due to key and infrastructure damage. Smart contract vulnerabilities accounted for 44 incidents and 11% of the total losses. About 75.5% of the losses came from two incidents attributed to North Korean threat actors, with 14 audited agreements being invaded. Leo Fan stated that the audit does not cover signature devices and infrastructure, while Samuel Videau pointed out that nearly 90% of the losses come from keys, signers, and infrastructure. Multiple officials have suggested adopting layered defense, and Leo Fan expects that operational access control attacks will continue to dominate losses in the second half of 2026.
