Woofun AI data shows that Web3 security incidents totaled 344 in the first half of 2026, resulting in cumulative losses of approximately $1.32 billion. While this represents a 46.8% decline year-on-year, excluding the $1.45 billion Bybit incident reveals an actual 28% increase in losses, indicating persistent security risks.

Wallet theft emerged as the leading cause of financial damage, accounting for roughly $450 million in losses. Although phishing attack frequency dropped by over 50%, associated losses decreased by only 10.8%, signaling a shift toward high-value targets. Code vulnerabilities remained the most frequent attack vector with 204 incidents, often targeting unaudited legacy smart contracts. Mega-attacks, including those on Kelp DAO and Drift Protocol, caused $577 million in losses, comprising 44% of the total.