Half a billion dollars vanished. Just like that, over three months. The worst bit? Not by hacking code. Mostly gone some other way.

Surprisingly, outdated tactics no longer explain what's happening across crypto threats.

The Numbers Are Harsh
Early 2026 saw Web3 platforms lose nearly half a billion dollars through hacking and fraud, spread over four dozen separate events. Sounds devastating because it is, yet one glaring difference stands out compared to prior years. Missing so far? A single massive collapse such as the Bybit incident from twelve months ago, which drained more than a billion bucks in one strike. This change hints at shifting tactics among cyber thieves along with new weak spots forming within digital frameworks

A quiet season for big breaches. Yet what emerged feels riskier somehow, scattered strikes, medium scale, aimed not at code but at people, the fragile core inside every setup.

Here's the breakdown:

• $306 million, phishing and social engineering
• $86.2 million, smart contract exploits
• Security gaps cost $71.9 million, access control failures (compromised keys, cloud breaches)

What grabs attention most? The $306 million taken just by phishing and manipulation tactics. That chunk makes up close to 65 percent of every dollar lost. Numbers like that shift how you see the risk.

Most of it. Take a moment to think about that.

A single scam took two hundred $282 million. Money vanished without a trace. Not one line of code was involved. Criminals used trust instead of software.

A quarter billion dollars vanished in moments. Not through complex coding tricks. Through a phone call that seemed harmless at first. Someone answered what they thought was tech help. Spoke freely about access details. Just like that, balance gone. No digital break in needed. Trust did the damage.

This scares anyone who truly holds something here. Not a hidden flaw in brand new code. Just someone calling you. Pretending to help. One second deciding to believe the voice on the line.

Out of all breakdowns last quarter, the costliest ones weren’t about faulty software. That’s what Hacken’s leader Yev Broshevan pointed out. Instead, issues rooted in people and processes caused the biggest damage. Their research breaks down breaches into three parts: written code, live systems, physical setup. Yet when results came in, human actions weighed heaviest. Most money lost tied back to choices made beyond programming.

North Korea's playbook hasn't changed. It still works.

Out of nowhere, DPRK-connected groups kept using tactics seen all year, bogus investor meetings, harmful code hidden in update alerts, breached staff devices, yet again pulling more than $40 million from Step Finance and Bitrefill. Hacken saw it unfold just like before

A voice call pretending to be investors drained forty million dollars from Step Finance. When hackers slipped into Amazon's key tools, Resolv Labs lost $25 million when AWS key management services were compromised. Systems at Bitrefill cracked open after unseen breaks in their setup.

Most of these methods have been around a while. Which is the whole issue. They’re standard tactics, written up plenty before. Yet here we are in 2026, still seeing widespread success simply because teams keep putting audits ahead of day to day defenses.

Audits Aren't Enough Anymore. Not Even Close
It’s hard to ignore what happened last quarter, six supposedly secure protocols got breached, even though experts had checked them before. One of those had been reviewed eighteen times. That falls on all of us who trust these checks too much

Eighteen checks done. Hackers got through anyway.

Out of nowhere, smart contract losses jumped 213% compared to last year. Still, it’s scams using fake websites and trick messages grabbing most attention. Old software decisions are now causing problems again for some teams. A flaw in a Solidity contract from around five years back drained Truebit of 26.4 million dollars. The same method used since 2022,  pretending to donate, pulled off another exploit, this time on Venus Protocol.

Most companies see audits as an ending point. Yet according to Hacken’s findings, that moment is just the beginning.

AI Steps Into the Attack Zone
Astonishingly, deep within the Hacken report lies a quiet red flag, this quarter saw the debut of a serious breach in a smart contract written entirely by artificial intelligence. The incident hints at new risks emerging as generative systems quietly reshape what's vulnerable

Uncharted ground now. As coders lean on artificial intelligence to push out smart contracts quicker, hidden flaws slip through, tools meant to spot issues cannot see these yet. Fast work fueled by machine help might build up unseen risks, something the field has no real plan for facing. What feels like progress could leave systems open in ways nobody expected.

Stablecoins Overlook Quiet Regulatory Risks
Surprisingly, the Hacken report took a close look at stablecoin ventures, what turned up might worry those with large stakes. Not every path in the system actually followed the rules built into the code, even when those checks were coded right in. Nearly two out of five showed gaps like this, opening doors to unseen risks. What happens behind the scenes isn’t always what it seems.

Imagine this. Close to four out of every ten stablecoin initiatives carry rules meant for oversight, rules written down yet rarely active where they matter most: the blockchain itself. When bodies enforcing MiCA, DORA, or America’s GENIUS Act dig deeper, that mismatch won’t only weaken safety, it’ll spark official consequences. What looks fine on documents may crash under real scrutiny.

What You Should Actually Do Right Now
What Hacken wrote feels less like an autopsy, more like a wake up signal. For each person holding tokens and every group running a protocol, here’s what actually matters

For individuals:

• Never share your seed phrase with anyone, ever. Legitimate support will never ask for it.
• Before sending anything, always check where it's going, fake addresses pop up often. Spotting the right one yourself matters each time a transfer happens. Crooks tweak characters just enough to trick quick looks. Staying sharp protects what you move across networks
• Even though hardware wallets block online attacks, giving away your details still puts you at risk
• Enable multi-factor authentication everywhere

For protocols and teams:

• Staying ahead means checking things regularly, not just once. Spotting issues early has become the baseline expectation
• Training staff about social engineering belongs in security, yet lives too often in HR paperwork. Not every policy fits a clipboard. Awareness grows through practice, though many still treat it as a signature exercise. Real defense comes from drills, while forms just gather dust. Skills matter more than checklists when someone clicks a link. The difference shows up during attacks, not audits
• Infrastructure security (cloud keys, AWS permissions, internal access control) needs the same rigor as smart contract audits
• Build incident response procedures before you need them

Out here, threats aren’t fading, they’re changing shape. The attack surface isn't shrinking. It's shifting from code to people, from protocols to phone calls.

That first three months of 2026 showed exactly what sharp eyed security experts kept saying. Blockchain tech wasn’t the weak spot after all. Instead, trouble lives where people meet shaky safeguards at big organizations. Criminals already know this path well. Now it’s just a matter of time before next quarter blows this one wide open.

Watch closely. Check each detail. Your seed phrase is worth more than any customer support conversation.