Ledger All ledgers
Crypto in 2026 so far: the year in data
Crypto in 2026 so far: $8.76bn lost to hacks, 104 US enforcement steps, 313 sanctioned addresses and 151 MiCA licences, from the ledgers.
2026 isn’t over. Comparisons are with the same date in 2025, and the page updates with every desk run.
$8.76bn lost to crypto hacks in 2026 so far
$8.76bn was lost in 306 crypto hacks with a known loss. Losses were up 232% on the same point in 2025. The largest was Binance, at $6.36bn. US government statements attribute one of the year’s hacks to North Korea, $6.36bn in all.
US agencies took 104 crypto enforcement steps, down 22% on the same point in 2025, most of them from the DOJ (71). The median prison sentence across the 21 sentences that included prison time was 6.5 years.
OFAC actions named 313 crypto addresses that no OFAC action since January 2024, when this ledger starts, had named before, up 79% on the same point in 2025, and OFAC removed 1.
151 firms were authorised under MiCA in the EU.
Largest hacks
| Date | Target | Lost | Type | Method | Returned |
|---|---|---|---|---|---|
| 29 Oct 2026 | Binance | $6.36bn | CEX | Key Leaked via Infrastructure | — |
| 24 Sept 2026 | Bitget | $387.0m | CEX | Hot Wallet Key Compromised | — |
| 06 Sept 2026 | Liquid Network | $320.0m | Chain | Unbacked Cross-Chain Mint | — |
| 01 Apr 2026 | Drift Trade | $295.0m | DeFi Protocol | Proxy Upgrade Hijack | — |
| 18 Apr 2026 | Kelp | $293.0m | DeFi Protocol | Cross-Chain Message Spoofing | — |
| 30 Aug 2026 | Tectonic | $124.5m | DeFi Protocol | Donation Attack | — |
| 31 Jul 2026 | COLDCARD | $116.0m | Wallet | Weak Key Generation | — |
| 09 Oct 2026 | Ledger (Supply Chain) | $93.0m | Wallet | Supply Chain Attack | — |
| 24 Aug 2026 | Nesa | $50.0m | Chain | Arithmetic Error | — |
| 02 Nov 2026 | Mercado Bitcoin | $40.0m | CEX | Protocol Logic | — |
| 31 Jan 2026 | Step Finance | $40.0m | DeFi Protocol | Private Key Compromised | — |
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
US enforcement
- DOJ71
- SEC16
- OFAC12
- CFTC5
Every enforcement step in 2026 · By US Attorney’s office
Sanctions
Most addresses added were tied to ISIL Khorasan (134), Xinbi Guarantee (52), Zedcex Exchange Ltd (7), Amnokgang Technology Development Company (7). 24 individuals were also listed; they aren’t named here. The FBI published 627 addresses from thefts it attributes to North Korea.
Check an address · Sanctioned entities
MiCA licences
151 firms were authorised in 24 countries, most in France.
The MiCA register · Which big exchanges have one
On Bitminer.io
- Malta authorised six of the 18 big crypto exchanges and apps holding a MiCA licence
- None of 939 FBI-flagged North Korea theft addresses is on the US sanctions list
- FBI names North Korea in Binance theft, two days after the largest crypto hack on record
- Crypto enforcement falls to 98 actions through October as violent cases rise to 12
- Mercado Bitcoin loses $40 million four days after the $6.36 billion Binance incident
- Binance's $6.36bn loss is the largest on record and 97.9% of October's total
Hacks are DefiLlama’s records; enforcement, sanctions and licences come from the agencies’ own documents and lists. Enforcement and sanctions records start in January 2024. How this is built
Cite this Bitminer.io, “Crypto in 2026, the year in data”, data to 5 November 2026, https://bitminer.io/ledger/year/2026/. Free to reuse under CC BY 4.0 with credit and a link. How this is built · Frozen copy of November 2026’s data