Crypto Hacks Fell to $26.5 Million in February – The Lowest Monthly Total in 11 Months

PeckShield data shows cryptocurrency hack and scam losses dropped to $26.5 million in February 2026, a 69.2% decline from January and a 98.2% decrease from the $1.5 billion lost in February 2025.

The Number Behind the Number

The year-over-year comparison is almost entirely explained by one event. February 2025 included the $1.4 billion Bybit exchange drain, one of the largest single crypto security incidents ever recorded. Remove that from the 2025 figure and the year-over-year comparison looks considerably less dramatic. What remains is still a meaningful improvement, but the 98.2% decline headline requires that context to be read honestly.

February 2026 had no billion-dollar event. It had 15 recorded incidents totaling $26.5 million. That’s a real reduction in aggregate losses, not just a statistical artifact of one catastrophic outlier disappearing from the comparable period.

Where the Money Went

Two incidents on February 21st accounted for over 70% of the month’s total losses. Both on the same day.

YieldBlox lost $10 million to a price manipulation attack on its DAO-managed lending pool. IoTeX lost $8.9 million to a private key compromise targeting the IoTeX.io bridge, though the protocol’s founders initially disputed the scale of the reported loss. Together those two incidents sum to $18.9 million, leaving roughly $7.6 million spread across the remaining 13 incidents for the month.

Foom.cash lost $2.2 million. CrossCurveFi lost somewhere between $1.4 million and $3 million depending on the estimate. Moonwell lost $1.8 million. The smaller incidents are consistent with the kind of low-level persistent threat activity that exists regardless of market conditions.

Why February Was Quieter

The explanation for the drop is a combination of factors rather than any single cause.

Market conditions played a role. Bitcoin’s early-month correction below $70,000 created an environment where attacker resources were being diverted toward navigating liquidity rather than executing complex protocol exploits. Sophisticated attacks require setup, coordination, and often favorable market conditions to maximize extracted value. A volatile, declining market changes the calculus.

Security infrastructure has also genuinely improved. AI-powered code auditing and real-time monitoring tools are catching vulnerabilities before they become exploits at a higher rate than prior years. Counterparty standards have tightened across institutional participants. These improvements don’t show up dramatically in any single month but compound over time into fewer successful attacks on well-audited protocols.

The attacker shift toward social engineering is the part worth watching. Roughly $8.5 million of February’s $26.5 million total came from phishing and address poisoning rather than technical contract exploits. The ratio of social engineering to technical hacks is moving in one direction. Protocols are getting harder to crack at the contract level. Humans remain easier targets. The attack surface is shifting from code to people.

What the 11-Month Low Actually Means

March 2025 was the last time monthly hack losses were this low. The intervening period included multiple nine-figure incidents and the Bybit event that defined the 2025 loss statistics. February 2026 breaking below that floor is a positive data point for ecosystem security maturity.

It’s also one month. A single undiscovered vulnerability in a high-TVL protocol can reset the monthly figures by an order of magnitude in a single transaction. The absence of a mega-hack in February doesn’t guarantee the absence of one in March.

The trend is positive. The risk isn’t gone.

The post Crypto Hacks Fell to $26.5 Million in February – The Lowest Monthly Total in 11 Months appeared first on ETHNews.