Early 2026 saw several kinds of crypto exploit, and analysts reported different loss totals because their reports covered different risks. CertiK’s broader report put **January losses at about $370.3 million across 40 incidents**, including roughly $311.3 million tied to phishing and one social-engineering theft near $284 million. PeckShield’s narrower protocol hack analysis put January at $86.01 million and February at $26.5 million. CertiK’s broader February losses came in at about $35.7 million. Each report counts different kinds of failure.
The biggest losses of the period came from risks around smart contract code: users under pressure, executives with signing authority, privileged bridge administrators, fragile release pipelines, and collateral systems trusting prices from markets too thin to deserve that trust.
The clearest example came on January 10, when a hardware wallet user lost about $282 million in BTC and LTC to a social engineering scam. Investigators traced the laundering through instant exchanges and THORChain-linked routes, with a large share moved into Monero and helping drive a sharp move in XMR. Cold storage protects keys at rest, while users remain vulnerable to social engineering. In crypto, the recovery phrase remains a single point of failure dressed up as self-custody.
Step Finance made the same point at institutional scale. The Solana platform later said executive devices were compromised and about $40 million was drained from treasury assets. The directly verifiable onchain theft was smaller: 261,854 SOL, about $27.3 million at the time, unstaked and moved after the attacker obtained the permissions needed to do it. That spread between the confirmed onchain drain and the company’s broader incident estimate is not unusual in crypto reporting, where teams often combine stolen funds, exposed positions, and at-risk assets into a single headline number. The deeper lesson is simpler: an executive device with signing authority needs the same protection as other treasury infrastructure.
Contract-level risk also remained significant. On January 8, Truebit lost roughly $26.4 million to $26.6 million after an attacker exploited faulty pricing logic in a legacy minting contract, acquired TRU at negligible cost, and sold it back against the protocol’s ETH reserves. The incident matters because it cuts against the comforting idea that early 2026 was mostly about phishing and off-chain compromise. Some of the damage still came from an older, less glamorous failure mode: stale contracts, poor visibility, and dangerous code left live after teams had stopped treating it as an active liability.
February shifted attention back toward protocol design, and YieldBlox was the cleanest example. The exploit hit on February 22. The attacker targeted the nearly untraded USTRY/USDC market on Stellar, executed a tiny trade at an absurd price, let the Reflector VWAP oracle absorb that print, and then borrowed against wildly inflated collateral. Public loss estimates ranged from about "0.2 million to "0.97 million, depending on source and valuation point. The structure of the failure: a lending market accepted a collateral price from a market with almost no depth, then treated that price as if it carried real information.
ioTube exposed a related but distinct February pattern: privileged-key failure inside bridge infrastructure. The exploit hit on February 21. Public estimates range from about $4.4 million in direct protocol losses to as much as $8.8 million when unauthorized minting is counted before freezes and write-downs. The mechanics matter more than the headline number. A compromised validator-owner key was used to upgrade Ethereum-side bridge contracts, bypass validation, drain reserves from TokenSafe, and mint CIOTX. Bridges keep relearning the same lesson: admin permissions need to be included in the bridge’s threat model.
Moonwell was smaller in dollar terms, around ".78 million in bad debt, but it may be the cleanest engineering case study of the period. After MIP-X43 went live on February 15, the protocol priced cbETH using the raw cbETH/ETH ratio, omitting the conversion through ETH/USD. That made an asset worth roughly $2,200 appear to be worth about ".12, allowing liquidators to seize collateral for almost nothing and leaving the protocol with 1,096.317 cbETH liquidated and around ".78 million in bad debt. The protocol consistently enforced an incorrect price calculation.
Trust Wallet’s browser-extension compromise unfolded between December 24 and 26, 2025, when a malicious v2.68 build was published to the Chrome Web Store outside the company’s normal release process. Trust Wallet later said 2,520 wallet addresses were affected, with about $8.5 million in assets impacted. The company said it had high confidence the incident was likely related to the broader Sha1-Hulud supply-chain attack, which exposed developer secrets and the Chrome Web Store API key. At the retail edge, the longer tail looked ugly too: Scam Sniffer reported **$6.27 million stolen across 4,741 wallets** in signature-phishing attacks in January. The blockbuster incidents were concentrated. The day-to-day threat was diffuse, cheap to run, and still growing.
The beginning of 2026 was shaped by three recurring failures: authorization abuse against users, compromised privileged access inside teams and bridges, and valuation systems that trusted markets too thin to price collateral safely.
PeckShield reported total hack pace decrease of 69.2% MoM from January to February, but that should not be misread as broad hardening. The biggest losses in this window came from security boundaries that sit above the smart contract, around it, or inside the assumptions feeding it.
These incidents show how different safeguards depend on the surrounding systems. Hardware wallets still depend on users keeping recovery access private; Step Finance depended on secure signing devices, ioTube on its admin key, and YieldBlox on sufficient liquidity in its oracle’s source market. Each dependency needs review alongside smart contract code.
Security reviews need to cover people, permissions, release pipelines, and price inputs alongside Solidity code.