Web3 security incidents cost the industry more than $1.31 billion across 344 events in the first half of 2026, according to CertiK's Hack3D H1 2026 Report, published Monday. The blockchain security firm noted that net losses stood near $1.2 billion after frozen and recovered funds were accounted for. Strikingly, when the anomalous 2025 Bybit hack is excluded from the comparison baseline, losses are up 28% year-over-year — a clear signal that underlying security threats across the Web3 ecosystem are structurally expanding rather than contracting.
The 344 incidents recorded in the first half of 2026 translate to roughly 1.9 security events per day on average. This frequency reflects the growing attack surface as more smart contracts, DeFi protocols, and cross-chain bridges come online. CertiK's Hack3D report is the industry's most closely watched recurring security digest, aggregating hacks, scams, and exploits across the entire Web3 ecosystem to visualize the scale and trajectory of digital asset losses.
The phrase "excluding the Bybit baseline" in the report's title is a critical analytical adjustment. In 2025, the cryptocurrency exchange Bybit suffered one of the largest hacks in industry history, and that single event heavily distorted the prior-year loss statistics. By removing this outlier from the comparison, CertiK aims to reveal the true trajectory of "everyday" security risk — the baseline threat level that persists independent of any single mega-incident.
For Bybit itself, this framing carries particular significance. The exchange has since invested heavily in security infrastructure, and the report's methodology acknowledges that its 2025 incident was an anomaly rather than an ongoing pattern. The 28% ex-Bybit figure is arguably the more honest barometer of where the broader industry stands.
NEAR is listed as an affected asset in this event. As a high-throughput Layer1 blockchain that also serves as a foundation for Layer2 scaling solutions, NEAR occupies a strategically important position in the Web3 stack. The heightened security awareness triggered by CertiK's report is likely to ripple across all major smart contract platforms, and NEAR is no exception.
Investors and developers will be paying closer attention to NEAR's ecosystem security posture — including the audit coverage of its most popular dApps, the robustness of its bridge implementations, and the protocol's governance mechanisms for responding to vulnerabilities. In a market where security is increasingly synonymous with competitiveness, NEAR's ability to demonstrate a hardened security stack could become a meaningful differentiator for institutional and retail capital alike.
Web3 security losses typically fall into three principal categories. The first is smart contract exploits — attacks that leverage code vulnerabilities in DeFi protocols, often targeting flash loan mechanics, price oracle manipulations, or reentrancy bugs. These tend to produce the largest individual loss events because they can drain liquidity pools in minutes.
The second category is scams and phishing — social engineering attacks that trick users into signing malicious transactions or surrendering their private keys. As wallet interfaces have become more sophisticated, attackers have evolved their tactics, using fake airdrop sites, malicious browser extensions, and impersonation campaigns to separate users from their funds.
The third category is internal threats, most notably rug pulls — where project developers abandon a protocol after attracting user funds. While individual rug pulls tend to be smaller in scale, their cumulative impact is significant, and they erode trust in the broader ecosystem. Based on historical Hack3D reporting patterns, exploits likely accounted for the largest share of H1 2026 dollar losses, with cross-chain bridges and lending protocols remaining prime targets.
The $1.31 billion figure has intensified the urgency around Web3 security spending. Leading protocols are responding on multiple fronts. Smart contract audits by firms like CertiK, Trail of Bits, and OpenZeppelin have become table stakes rather than optional. Bug bounty programs — which reward white-hat hackers for discovering vulnerabilities before malicious actors can exploit them — are expanding in scope and reward size.
DeFi insurance protocols such as Nexus Mutual and InsurAce offer users a partial safety net, allowing them to hedge against the risk of a covered protocol being exploited. On the governance side, multi-signature wallets, timelock mechanisms, and progressive decentralization are becoming standard practice. Users, too, are being urged to take greater responsibility — diversifying across protocols, using hardware wallets, and scrutinizing every signature request before approving it.
The H1 2026 numbers paint a picture of an industry still in its growth phase, where rapid innovation is outpacing security maturity. But there is a silver lining. The gap between gross losses ($1.31B) and net losses (~$1.2B) — roughly $110 million — represents funds that were frozen or recovered, demonstrating that blockchain transparency is enabling increasingly effective post-incident responses.
Looking ahead, several technological advances promise to strengthen the security landscape. AI-powered anomaly detection can flag suspicious transactions in real time. Zero-knowledge proofs offer the potential to combine privacy with auditability. Formal verification techniques allow smart contracts to be mathematically proven correct before deployment. As these tools mature, the cost of launching a successful attack should rise, narrowing the gap between innovation and protection.
For now, CertiK's report serves as a stark reminder: in Web3, security is no longer just a cost center — it is the foundation of user trust and a core competitive advantage. Projects that invest in robust security will attract capital; those that cut corners will pay the price. For investors, the ability to evaluate protocol security is becoming an essential skill, as indispensable as assessing tokenomics or team credentials.
Trade with a security-first exchange — start your journey with Bybit today
Sign Up on Bybit (Referral Code 48553)According to CertiK's Hack3D H1 2026 Report, Web3 security incidents cost the industry more than $1.31 billion across 344 events in the first half of 2026. Net losses stood near $1.2 billion after frozen and recovered funds were accounted for.
The 28% figure compares H1 2026 losses against the same period in 2025 after removing the anomalously large Bybit hack loss from the 2025 baseline. This adjustment reveals that underlying security threats are structurally growing, not just driven by a single mega-incident.
NEAR is listed as an affected asset in this event. The heightened security concerns across Web3 raise investor risk awareness for Layer2 and smart contract platforms broadly. NEAR's ecosystem security posture and audit practices may draw increased scrutiny as a result.
Hack3D is a recurring security report published by blockchain security firm CertiK that aggregates and analyzes hacking, fraud, and exploit incidents across the Web3 ecosystem, visualizing the scale and trends of industry losses on a regular basis.
The three main categories are: smart contract exploits (leveraging code vulnerabilities, common in DeFi), scams and phishing (social engineering to steal private keys or signatures), and internal threats such as rug pulls where developers abscond with user funds.
Key protections include using only protocols audited by reputable firms like CertiK, employing hardware wallets, enabling multi-signature controls, avoiding over-concentration in a single protocol, and staying vigilant against phishing links and suspicious signature requests.