Crypto's biggest 2026 threat is stolen keys, not broken code

Crypto thieves took more than $1.31 billion in the first half of 2026, and the way they did it has changed. For the first time on record, stealing the private keys that control funds beat breaking the code. Audits did not stop it.

The figures come from Hack3d, a half-year security report from the blockchain audit firm CertiK, published on July 6. CertiK counted 344 separate incidents. The costliest category was not buggy smart contracts. It was compromised wallets and keys, at $444.5 million across 33 attacks.

Where the stolen money actually went

CertiK sorts the losses by how the attacker got in. Wallet compromise led, at $444.5 million from 33 incidents. Phishing came next, at $366.3 million from 63 incidents. Code bugs, the thing most people picture when they hear the word hack, sat third at $151.6 million, spread across 204 incidents.

Two events did most of the damage. In April, attackers drained about $291 million from Kelp DAO and about $285 million from Drift Protocol. Together those two hits made up close to 44 percent of the half-year total. Neither began with a flaw in the contract code. Both began with access that should never have left the building. CertiK's report does not pin every one of the 344 incidents on a named group.

Kelp DAO shows the pattern in miniature. CertiK logged it as an RPC compromise, which sounds technical but is simple in effect. RPC is the connection an app uses to talk to a blockchain. Poison that connection, or the developer session behind it, and the app can be pushed to sign transfers its own team never meant to make. The contract stayed exactly as audited. The route to it did not.

What an audit does, and what it misses

A smart contract audit is a code review. Auditors read the program that runs on the blockchain and look for logic errors, math that can be gamed, and functions that let the wrong person move money. A clean audit means the code, as written, does what it claims. That is worth something. It is not the whole picture.

It is also a snapshot. An audit covers the code as it stood on a given day, within a scope the team agreed to pay for. Change the code afterward, add a new contract, or wire in an outside service, and the old report may no longer describe what runs in production. That is normal practice, not a scandal. It means the badge on a website and the live code can drift apart.

Everything around the code is the problem. A contract can be flawless and still sit behind a single admin key on someone's laptop. Steal that key and the code runs exactly as built, for the wrong person. Ronghui Gu, a co-founder of CertiK, framed the gap in remarks reported by crypto.news: "A protocol can pass a flawless code audit and still lose millions because of a compromised admin key."

Keys, signers, and bridges: the soft targets

Start with the private key. It is the secret that proves ownership of an on-chain account and signs off on moving funds. Whoever holds it controls the money. Big protocols try to spread that risk with a multisig, a setup where several keys held by different people must all approve a transfer. It helps. It is not magic. Breach or trick enough of those signers and the multisig waves the theft through like any other payment.

Bridges make the target bigger. A bridge is the plumbing that moves tokens between blockchains, and to do that it locks up large pools of assets in one place. That concentration is the draw. Cross-chain bridges have been among the most exploited parts of DeFi for years, and the reason has not changed. A lot of value, guarded by a handful of keys and off-chain systems that a code audit never touches.

Reaching those keys rarely involves the blockchain at all. Attackers go after the people and the machines around it, with fake job offers, cloned login pages, and messages that look like they came from a colleague. The security firm CredShields told crypto.news the attack surface has moved up the stack, to governance, to signers, and to the people building the protocols themselves.

Not every 2026 loss ran through a bridge. In July, a firmware flaw in some Coldcard hardware wallets exposed funds that Galaxy Research tracked across thousands of devices. Days earlier, a protocol called AFX Trade lost about $24 million after five validator signatures were compromised. Different targets, same theme. The money moved because someone controlled the keys, not because the math was wrong.

The uncomfortable part for DeFi

There is a reason this trend worries builders more than any single theft would. A code bug can be found and patched. A market for stolen keys, phishing kits, and insider access is harder to shut down, because it feeds on human habits and messy operations, not a line of Solidity. CertiK's own numbers make the point. Strip out the one-off $1.45 billion Bybit theft that inflated early 2025, and comparable losses in the first half of 2026 ran about 28 percent higher than a year earlier.

Some of the largest thefts also carry a state fingerprint. Security researchers have tied several 2026 attacks, including Kelp DAO and Drift, to the North Korea linked group often called Lazarus, which chases keys and credentials rather than contract bugs. Attribution in these cases is an estimate, not a courtroom finding, and the named firms say so.

None of this means audits are useless. Code review still catches real bugs before they ship. An audit badge just answers one question, not every question. What it cannot tell a holder is who keeps the keys, how those keys are stored, and who can approve a transfer at three in the morning.

For an ordinary holder, the practical takeaway is narrow. There is no way from the outside to see how a team stores its keys or who can sign a transfer. Public signals are thin: a named security firm on retainer, a public multisig with known signers, a habit of disclosing incidents fast. None of that is a guarantee. It is just more than a single audit badge.

What to watch

Watch where the audit stops. More firms now sell key-management reviews and operational checks that reach past the contract itself, and demand for them is a fair signal of where the risk really sits. Watch the loss tables too. If wallet and key compromise keeps leading them into the second half of 2026, this year's lesson holds. And watch how protocols respond when they are hit, because how fast a team freezes funds, discloses the breach, and names the cause tends to say more about its security than any pre-launch report. The weakest part of a crypto system is rarely the math. It is the people and the machines that hold the keys.