Web3 exploit losses: $1.31B gross, $110M clawed back, +28% ex-Bybit
CertiK's H1 2026 Hack3D data shows 344 incidents, a thin recovery rate, and rising losses once the Bybit outlier is stripped out.
CertiK’s Hack3D report for H1 2026, released Monday, puts gross Web3 security losses at $1.31 billion across 344 discrete incidents over the six-month window. Net losses land closer to $1.2 billion once frozen and recovered funds are subtracted — a recovery gap of roughly $110 million.
That gap implies a recovery rate in the single-digit percentage range relative to total losses. For treasury managers and protocol insurers, the takeaway is blunt: freeze and clawback tooling is catching a small fraction of stolen value, meaning most exploited funds exit the reachable custody chain before intervention becomes possible.
The number that matters: +28% ex-Bybit
Raw year-over-year comparisons in crypto security data are routinely skewed by single catastrophic events. CertiK’s report addresses this directly by stripping out the prior period’s Bybit exchange breach from the baseline — and gross losses still rose 28% year-over-year on that adjusted basis.
That distinction separates a one-off mega-hack from the underlying exploit trend line. It suggests the increase in incident severity and frequency is structural rather than an artifact of one large outlier skewing the prior comparison period.
The 344-incident count also points to losses spread across a wide base of protocols and chains rather than concentrated in a small number of headline breaches. That distribution matters for anyone modeling protocol-level risk exposure rather than treating exploit risk as a tail event confined to a few large targets.
What this means for risk pricing
The data reinforces a pattern that has surfaced repeatedly in recent CertiK datasets: aggregate security losses are not contracting as the industry matures, they are being redistributed across more incidents and rising once outlier events are normalized out of the comparison.
That has direct implications for how DeFi insurance premiums, audit pricing and on-chain risk scoring get calibrated through the second half of 2026. With gross-to-net recovery still thin at roughly $110 million against $1.31 billion in losses, the bulk of exploit risk remains uninsured against in practice even where monitoring and freeze mechanisms function as designed.
Read more: “Ill Bloom” Seed-Flaw Drains $5M as 431 of 2,114 Flagged Wallets Hit
Leave a Reply