CertiK Hack3D: H1 2026 Report

Executive summary: The CertiK Hack3D H1 2026 report catalogs 344 Web3 security incidents totaling $1.315B in reported losses (net ≈ $1.2B after recoveries), with wallet compromises ($444M), phishing ($366M), and code vulnerabilities ($151M) driving the majority of impact; two April incidents (Kelp DAO RPC and Drift Protocol) alone represented a large portion of losses. The report notes a shift toward fewer, highly targeted phishing attacks, systematic revisiting of legacy smart contracts by attackers, and escalated DPRK-linked activity (Lazarus Group), concluding that underlying risk worsened compared to a like-for-like H1 2025 baseline.