Union

Resolv

DORA

Truebit

Venus

Update (April 14, 2026, 11 am UTC): This article has been updated to adjust the total number of hacks and scams in the first quarter to $482 million and the total number of incidents to 44.
Web3 projects lost $482 million to hacks and scams in the first quarter of 2026, while multi-billion-dollar “mega hacks” gave way to a larger number of mid-sized incidents, according to blockchain security company Hacken.
According to Hacken’s Q1 2026 <a href="https://hacken.io/insights/q1-2026-security-report/" rel="noopener noreferrer nofollow">report</a>, phishing and social engineering attacks dominated the period, accounting for $306 million in losses in a quarter that saw 44 incidents overall. A single $282 million hardware wallet scam in January was responsible for more than half of the quarter’s damage.
Smart contract exploits totaled $86.2 million, with access control failures, including compromised keys and cloud services, driving an additional $71.9 million in losses.
The losses place this quarter as the second-lowest first quarter since 2023, with the absence of a single <a href="https://cointelegraph.com/features/bybit-hack-kim-jong-un-crypto-most-influential-2025" rel="noopener noreferrer nofollow">mega hack on the scale of Bybit</a>, which lost $1.46 billion in Q1 2025, the primary driver of the year-over-year decline.
Hacken’s incident mapping shows the largest failures increasingly occurring outside onchain code, in operational and infrastructure layers that traditional audits rarely touch. Yev Broshevan, chief executive and co-founder at Hacken, told Cointelegraph the most expensive failures “happen outside the code layer.”
Related: <a href="https://cointelegraph.com/news/aethir-bridge-exploit-halt-user-compensation-90k-loss" rel="noopener noreferrer nofollow">Aethir halts bridge exploit, promises compensation after $90K loss</a>
According to Hacken, that shift is drawing greater scrutiny from regulators and institutional counterparties, with frameworks such as the Markets in Crypto-Assets Regulation (MiCA) and Digital Operational Resilience Act (DORA) in the European Union moving further into enforcement and raising expectations around continuous security monitoring and incident response.
<h2 id="legacy-code-fake-vc-calls-and-key-compromises">Legacy code, fake VC calls and key compromises&nbsp;</h2>
Broshevan pointed to $306 million in phishing, a $40 million North Korea-linked fake <a href="https://cointelegraph.com/news/step-finance-solanafloor-remora-markets-wind-down-operations" rel="noopener noreferrer nofollow">venture capitalist (VC) call against Step Finance</a>, and a $25 million AWS <a href="https://cointelegraph.com/news/resolv-labs-stablecoin-depegs-attacker-mints-millions-of-tokens" rel="noopener noreferrer nofollow">key management service compromise at Resolv Labs</a>.&nbsp;
Even where smart contracts were at fault, the costliest bugs often sat in legacy deployments and known vulnerability classes. <a href="https://cointelegraph.com/news/26m-truebit-hack-smart-contract-vulnerability" rel="noopener noreferrer nofollow">Truebit lost $26.4 million</a> to a bug in a Solidity contract deployed around five years ago, while <a href="https://cointelegraph.com/news/venus-protocol-3-7-million-supply-cap-attack" rel="noopener noreferrer nofollow">Venus Protocol was hit by a donation attack</a> pattern documented since 2022.
<figure><img alt="Cryptocurrencies, Phishing, Smart Contracts, Cybercrime, Cybersecurity, Hacks" src="https://s3.cointelegraph.com/uploads/2026-04/019d8ba0-7933-7d51-8093-13d1405fc2c5.jpg">
 <figcaption>Q1 2025 compared to Q1 2026. Source: <a href="https://assets.hacken.io/assets/q1-2026-security-report.pdf" rel="noopener noreferrer nofollow">Hacken.</a>
 </figcaption>
</figure>
Six audited projects, including Resolv with 18 audits and Venus with five separate firms, still accounted for $37.7 million in losses. On average, that was more than their unaudited peers because higher total value locked (TVL) protocols attract more sophisticated attackers and exploits.
<h2 id="global-watchdogs-harden-incident-response-expectations">Global watchdogs harden incident response expectations</h2>
In Q1, MiCA and DORA in the EU shifted further into active enforcement, Dubai’s regulator, the Virtual Assets Regulatory Authority, tightened expectations around its Technology and Information Rulebook, Singapore enforced Basel-aligned capital and one-hour incident notification rules, and the United Arab Emirates’ new Capital Market Authority took over federal digital asset oversight with broader powers and higher penalties.
<figure><img alt="Cryptocurrencies, Phishing, Smart Contracts, Cybercrime, Cybersecurity, Hacks" src="https://s3.cointelegraph.com/uploads/2026-04/019d8b26-92d7-7352-9284-bec034b54cdc.png">
 <figcaption>Total crypto losses per quarter. Source: Hacken
 </figcaption>
</figure>
Related: <a href="https://cointelegraph.com/news/defi-hacks-169m-q1-2026-crypto-exploits-decline" rel="noopener noreferrer nofollow">Crypto hackers steal $169M from 34 DeFi protocols in Q1: DefiLlama</a>
Hacken ties those regimes to a new benchmark for “regulator-ready” stacks that includes proof-of-reserves attestations backed by daily internal reconciliation, 24/7 onchain monitoring across treasury wallets and privileged roles, automated circuit-breakers on minting and governance functions and incident notification clocks calibrated to the strictest applicable standard.&nbsp;
The report highlights “realistic” targets of awareness within 24 hours, labeling within four hours, and blocking in 30 seconds, with “aspirational” goals as low as 10 minutes for detection and 1 second to block, based on guidance from Global Ledger’s 2025 Laundering Race data.
At the human layer, Hacken flags North Korean clusters as the most consistent operational threat, with Step Finance’s $40 million loss and <a href="https://cointelegraph.com/news/bitrefill-claims-lazarus-group-hacked-them-stole-funds" rel="noopener noreferrer nofollow">Bitrefill’s infrastructure breach</a> extending a playbook of fake VC outreach, malicious video call tooling and compromised employee endpoints that extracted roughly $2.04 billion from the sector in 2025.
Magazine: <a href="https://cointelegraph-magazine.com/xrp-price-catalysts-bitcoin-macro-risks-analysts-trade-secrets/" rel="noopener noreferrer nofollow">XRP yet to ‘price in’ 3 bullish catalysts, Bitcoin to $80K? Trade Secrets</a>

Web3 hacks cost $482M in Q1 as phishing drove majority of losses: Hacken

Table of Contents

Cointelegraph

Other articles published on Apr 14, 2026

Join our free newsletter for daily crypto updates!