Why crypto wallets get hacked: stolen keys cost three times more than bugs

If you want to know why crypto wallets get hacked, look at the keys and the people who hold them. CertiK’s report for the first half of 2026, published on 6 July, ranks wallet compromise as the costliest attack type of the period.

CertiK counted $1.32 billion lost across 344 incidents in the half. The three costliest attack types:

• wallet compromise: $444.5 million in 33 incidents;
• phishing: $366.3 million in 63 incidents;
• code vulnerabilities: $151.6 million in 204 incidents.

By our count, a compromised wallet cost about $13.5 million per incident, a phishing attack $5.8 million and a code bug about $740,000. Bugs happened six times as often as wallet compromises and cost a third as much in total.

Four ways in

A stolen seed phrase hands over the wallet, and the attacker needs no further hack. Seeds leak through screenshots, cloud notes, spyware and fake support chats. In October a Trust Wallet user blamed iPhone spyware for a $68,000 loss.

A signature works almost as well. A phishing site asks you to sign an approval that lets a contract move your tokens later. Your wallet shows an ordinary confirmation window, and you click it.

In address poisoning, the attacker plants a lookalike address in your transaction history and waits for you to copy it. In December 2025 a trader lost about $50 million in USDT this way, after a small test transfer.

In a wrench attack, nobody touches the software: someone forces you to hand the money over. CertiK counted 34 verified attacks worldwide by May 2026, 82% of them in Europe, and estimated $101 million lost in the first four months of the year.

Where the victims are

Chainalysis tracks personal wallets separately. In 2025 it counted 158,000 compromises and at least 80,000 victims. Solana had the most victims, about 26,500, while Ethereum and Tron had the highest theft rates per 100,000 active wallets. Our protection checklist covers those numbers in more detail.

What follows for you

Attackers want two things from you: your seed phrase and your signature. Keep the seed off any device that connects to the internet, and read what your wallet asks you to sign before you approve it.

A hardware wallet closes the spyware route, because malware on your phone cannot read a key it never sees. It cannot stop you from approving a bad signature, so you still need the second habit. Our five fixes guide walks through each route.

Loss figures come from CertiK and Chainalysis; the per-incident averages are our own calculation. This is general information, not a security audit of your setup.