On-Chain Theft Reached 1.1 Billion Dollars in First Half as Reward-Vault Exploits Continue

Crypto security incidents caused about 1.1 billion dollars in losses across 212 cases in the first half of 2026, according to a report from the security firm Blockaid. The report's central finding is a shift in the attack surface. Private-key and access-control compromises overtook smart-contract bugs as the leading cause of loss. Projects tied to Ethereum accounted for roughly 332 million dollars and Solana-linked projects for about 326 million, per the same data.

The pattern continued into this week's on-chain activity. Security researchers at DeFiHackLabs published proof-of-concept reconstructions of two fresh self-dealing drains, in which an attacker who controls a contract's privileged logic routes the contract's funds to itself. One targeted a token's reward-on-transfer mechanism, moving about 605,000 dollars in the dollar-pegged stablecoin Tether in a single transaction. A second drained a reward vault on Ethereum of about 301.7 ether, roughly 565,000 dollars at current prices. Both are logic-and-access exploits rather than reentrancy or oracle manipulation. The contract behaved as written, and the design let insiders extract value.

Rekt News is separately tracking incidents at AFX Trade, Ostium, Bonzo Finance and BonkDAO, the continual series of smaller drains that accompanies the largest incidents. Neither the token nor the vault losses this week have been publicly attributed, and there is no indication of frozen or recovered funds.