Ethereum, Solana led crypto hack losses in H1 2026: Blockaid

The mid-year post-mortems for 2026 are starting to roll in, and the security landscape is looking uncomfortably familiar. Blockaid recently released their findings for the first half of the year, and the data suggests that while we have made massive strides in scalability, our security habits are still stuck in the early days of decentralized finance.

Ethereum continues to hold the title no one wants: the hardest-hit network by total value lost. But the real story isn't just that Ethereum is expensive to secure; it is the aggressive rise of Solana in the rankings. Solana has officially displaced Arbitrum as the network with the second-highest losses. This transition marks a shift in where attackers are focusing their energy, following the liquidity and the retail volume.

The Key Compromise Epidemic

When you dig into the mechanics of these breaches, a specific pattern emerges. We aren't seeing as many sophisticated smart contract logic flaws as we did in previous cycles. Instead, we are seeing the oldest trick in the book: key compromises. Attackers are effectively walking through the front door because the keys were left under the mat.

In the first half of 2026, the industry saw a massive spike in private keys being leaked through phishing, social engineering, and poor dev-ops practices. On Solana specifically, the velocity of capital and the surge in memecoin activity have created a target-rich environment. Founders are moving fast, sometimes too fast, and security is being treated as a secondary feature rather than a foundational requirement.

Why Ethereum Remains the Whale Target

Ethereum’s position at the top of the loss list is largely a function of its total value locked. It is where the deep liquidity resides. The hacks here tend to be larger in scale, often targeting institutional bridges or legacy protocols that have grown too complex to easily audit. Even with the move toward Layer 2 solutions, the base layer remains the honey pot for high-level exploiters who have the patience to wait for a nine-figure payday.

However, the nature of Ethereum losses is shifting. We are seeing fewer "rug pulls" in the traditional sense on Mainnet and more drainage via sophisticated permit signatures and malicious dApp interactions. Users are being tricked into signing away their vaulted assets, a problem that wallet providers are still struggling to solve with standard UI/UX patterns.

The Solana Shift

Solana replacing Arbitrum as the second-most exploited chain tells us a lot about the current market sentiment. Arbitrum’s ecosystem has matured, and the builders there seem to have adopted a more defensive posture after the volatility of the last two years. Solana, meanwhile, has become the epicenter of retail speculation. Where there is retail, there is vulnerability.

Blockaid’s data suggests that the speed of the Solana network is being weaponized against its users. The low friction of transactions makes it easier for drainers to move stolen capital through mixers or cross-chain bridges before the victim even realizes their wallet has been compromised. For builders on Solana, this is a wake-up call. You cannot just build for speed; you have to build for friction where it matters.

What This Means for Builders

If you are building in this environment, you have to realize that the "move fast and break things" mantra is a liability when you are handling other people's money. The fact that key compromises are the leading cause of loss tells me that we have a human problem, not just a code problem.

• Abstract the danger away: Account abstraction isn't a luxury anymore; it’s a requirement. If your users are still manually managing seed phrases, you are setting them up for a loss.
• Multi-sig is the floor: For founders, the days of keeping operational funds in a single-key hot wallet are over. If a key compromise can take down your entire project, you aren't really decentralized; you're just a centralized point of failure waiting to happen.
• UI-level warnings: We need better simulation tools at the wallet level. Users should know exactly what permissions they are granting before they click sign.

Security is not something you add at the end of a sprint. In a world where Solana and Ethereum are under constant siege, security is the product.

The Retail Risk

The rise in Solana-based losses is particularly concerning because it hits retail users the hardest. Large-scale Ethereum exploits often hit protocols with insurance or enough TVL to social-recover the funds. A retail user getting their phantom wallet drained on Solana has almost zero recourse. This creates a trust deficit that could stifle the next wave of adoption.

If we want to hit the next billion users, we have to stop treating these hacks as a rite of passage. The Blockaid report shows that the industry is still leaking billions because of basic operational failures. The technology is evolving, but our threat models are lagging behind.

Final Takeaway

The data for H1 2026 is a sobering reminder that as long as we prioritize liquidity over security, we will continue to pay a high tax to malicious actors. Ethereum will likely always be a target due to its size, but Solana’s rise in the loss rankings proves that attackers are following the trend lines. If you are a founder, your primary job in 2026 isn't just shipping features; it is making sure your users don't get wiped out by a simple phishing link. Stop focusing on the price of the token and start focusing on the integrity of the keys.

Read the original at Cointelegraph →