Q1 2026 in crypto hacks: $168.2 million lost, and no exchange among the victims

Crypto losses in the first quarter of 2026 came to $168.2 million across 49 incidents, according to the Bitminer.io failures ledger. A year earlier, the first quarter of 2025 had lost $1.61 billion, almost all of it at Bybit. The fourth quarter of 2025 had lost $231.2 million.

No centralised exchange recorded a loss in the quarter. DeFi protocols had 45 of the 49 incidents and $160.8 million of the losses, 95.6% of the total.

Step Finance

The largest loss was Step Finance, a Solana portfolio platform, which lost about $40 million on January 31. Attackers compromised devices used by its executive team and gained access to the signing keys for its treasury and fee wallets. No flaw in its smart contracts was involved. It was 23.8% of the quarter’s losses.

Code flaws

Most of the other large losses came from code. On January 8, an attacker exploited an integer overflow in Truebit’s token purchase logic, minted TRU almost for free and sold it back to the protocol for about $26 million. TRU fell 99.9%.

On January 25, users of Matcha Meta lost about $13.43 million after a flaw in the SwapNet aggregator let an attacker reach tokens that users had approved on Base and Ethereum. On February 22, an attacker inflated the price of a thinly traded market on Stellar and drained about $10.97 million from a Blend V2 lending pool, whose price feed had no liquidity checks.

In March, Resolv lost about $24.5 million after a private key held in a cloud key service was compromised, letting the attacker mint tokens without backing.

Small and many

Five incidents of $10 million or more made up 68.5% of losses. Of the 49 incidents, 30 were under $1 million.

Sources

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.