CertiK Says H1 2026 Web3 Losses Topped $1.31B, Up 28% Excluding Bybit Baseline

§ 01 Executive Snapshot

• What: Web3 security incidents in H1 2026 resulted in over $1.31 billion in losses.
• Who: CertiK, a blockchain security firm, provided the report.
• Why it matters: The data indicates a concerning trend in Web3 security, highlighting vulnerabilities and the need for enhanced protective measures.

§ 02 Key Developments

• Web3 losses reached $1.31 billion across 344 incidents in H1 2026, with net losses near $1.2 billion after accounting for frozen and recovered funds.
• Wallet compromise was identified as the most costly attack vector, resulting in over $444 million in losses from 33 incidents.
• Phishing incidents decreased in frequency but remained costly, with four incidents accounting for approximately 85% of all phishing losses during the period.

§ 03 Strategic Context

• The report indicates a 46.8% year-over-year drop in losses, but this figure is skewed by the $1.45 billion Bybit hack in H1 2025, suggesting that losses in H1 2026 are approximately 28% higher than a more accurate baseline.
• North Korea-linked activities, particularly from the Lazarus Group, have increased, indicating a growing threat from state-sponsored actors in the Web3 space.

§ 04 Strategic Implications

• The immediate implication is the critical need for improved security protocols and measures in the Web3 environment to mitigate rising threats.
• Long-term, persistent vulnerabilities could deter investment and participation in the Web3 ecosystem if security concerns are not adequately addressed.

§ 05 Risks & Constraints

• A potential risk includes regulatory scrutiny as security incidents in Web3 could lead to calls for stricter oversight and compliance measures.
• The competition among security firms may intensify as they vie to provide solutions for an increasingly vulnerable Web3 landscape.

§ 06 Watchlist / Forward Signals

• The second half of 2026 is flagged as a period of heightened concern, particularly regarding the activities of state-sponsored threat actors.
• Monitoring trends in wallet compromise incidents and phishing attacks will be crucial for understanding the evolving risk landscape in Web3 security.