A single hardware wallet scam drove half of Q1 2026’s $482 million in Web3 losses, Hacken report finds

Web3 hacks reached $482 million in the first quarter of 2026, as phishing attacks and operational vulnerabilities overtook large-scale exploits as the primary threat vector, according to new data from Hacken.

The latest report shows that Web3 hacks were spread across 44 separate incidents, reflecting a shift away from single “mega hacks” toward a higher number of mid-sized breaches that continue to pressure the digital asset ecosystem.

Phishing Becomes the Leading Attack Vector

A defining trend in the quarter was the dominance of phishing and social engineering, which accounted for $306 million in Web3 hacks. One major incident—a $282 million hardware wallet scam in January—made up more than half of the total losses recorded during the period.

According to Yevhenii Broshevan, attackers are increasingly targeting users and operational systems rather than blockchain code itself.

“The most expensive failures are no longer happening at the smart contract level,” Broshevan said. “They are happening outside the code layer,” a shift that continues to drive Web3 hacks at scale.

Fewer Mega Breaches, More Persistent Threats

Although Web3 hacks totaled hundreds of millions, the quarter ranks among the lowest first-quarter losses since 2023. This is largely due to the absence of a major incident like the $1.46 billion breach suffered by Bybit in Q1 2025.

However, the decline in headline-grabbing attacks does not signal improved security. Instead, Web3 hacks are becoming more frequent and distributed, making them harder to detect and prevent at scale.

Smart Contract Bugs and Infrastructure Weaknesses

While phishing dominated, smart contract vulnerabilities still contributed $86.2 million to Web3 hacks. Many of these incidents were linked to legacy code and previously identified weaknesses.

For instance, Truebit lost $26.4 million due to a flaw in an older Solidity contract. Similarly, Venus Protocol was impacted by a donation attack pattern that has been known in the industry since 2022.

In addition, compromised keys and cloud infrastructure failures accounted for $71.9 million in Web3 hacks. A notable case involved Resolv Labs, which suffered a $25 million breach tied to vulnerabilities in AWS key management systems.

Audited Platforms Still Targeted

One key takeaway from the report is that audits alone are not enough to prevent Web3 hacks. Six audited projects were responsible for $37.7 million in losses, despite undergoing multiple security reviews.

Hacken noted that projects with higher total value locked (TVL) often attract more advanced attackers, which increases the likelihood of Web3 hacks even in well-audited systems.

Social Engineering Tactics Continue to Evolve

Attackers are also refining their social engineering techniques. Hacken highlighted a $40 million breach involving Step Finance, where attackers posed as venture capitalists during a video call to gain access to internal systems.

These tactics, often linked to North Korean threat groups, have become a major contributor to Web3 hacks. The same playbook—including fake meetings, malicious tools, and compromised endpoints—was responsible for more than $2 billion in losses across the industry in 2025.

Regulatory Pressure Increases Globally

The rise in Web3 hacks is drawing stronger regulatory scrutiny across multiple regions. In the European Union, frameworks such as the Markets in Crypto-Assets (MiCA) regulation and the Digital Operational Resilience Act (DORA) are now entering active enforcement stages.

These regulations are pushing firms to adopt stricter monitoring, reporting, and security standards to reduce exposure to Web3 hacks.

Elsewhere, Dubai’s Virtual Assets Regulatory Authority has tightened its technology rulebook, while Singapore has introduced stricter capital and incident reporting requirements. The United Arab Emirates has also expanded oversight through a new federal authority with broader enforcement powers.

New Standards for Security and Response

In response to rising Web3 hacks, Hacken outlined a new benchmark for security readiness. This includes continuous onchain monitoring, proof-of-reserves systems with daily reconciliation, and automated safeguards for critical functions.

The report also emphasizes faster response times, with targets such as identifying threats within hours and blocking malicious activity within seconds.

These measures reflect a growing recognition that preventing Web3 hacks requires more than static audits—it demands real-time visibility and rapid intervention.

A Shifting Threat Landscape

The Q1 data highlights a fundamental shift in how Web3 hacks occur. Rather than exploiting code alone, attackers are increasingly targeting the broader ecosystem, including users, infrastructure, and operational processes.

This evolution means that addressing Web3 hacks will require a more holistic approach, combining technical security with user awareness and regulatory compliance.

As the industry adapts, one thing remains clear: Web3 hacks are not declining—they are evolving, and the response must evolve with them.