Sophia’s Thoughts On Crypto Hacks In 2026
Crypto hack losses surpassed USD 1 billion in the first half of 2026, and Ethereum and Solana sit at the center of that tally. The real question is not which chains lost the most money, but why, and what that distinction means for genuine security risk.
These are Sophia's Thoughts:
Blockaid's H1 2026 security report tracked 212 incidents resulting in losses exceeding USD 1 billion, the highest number of hacks recorded in any six-month period, with Ethereum and Solana accounting for a combined USD 658 million in stolen funds.
The concentration of losses on Ethereum and Solana reflects application-layer vulnerabilities rather than protocol-level failures, a distinction that matters considerably when assessing the security profile of the underlying assets.
As Morgan Stanley expands its crypto exchange-traded product lineup to include both ETH and SOL, the question of how institutional capital prices security risk at the protocol versus application level is becoming harder to ignore.
🚀 Last week’s market performance
The broader crypto market declined 2.4% over the past seven days, with Bitcoin (BTC) falling 2.3% as risk sentiment softened. Shiba Inu (SHIB) stood out as the week's top performer, rising 14.0%. DeXe (DEXE) was the worst performer by a significant margin, declining 92.6% over the period.
🧐 What is your crypto mood today?
In each Sophia's Thoughts newsletter, we ask about your crypto mood. Your response to this question helps Sophia get a better sense of the pulse of crypto markets. And this ultimately translates into better insights for you when combined with Sophia's AI models. Your data empowers Sophia to provide you with even better intelligence going forward!
🔍 A Billion-Dollar Tally
The headline number demands context. According to Blockaid's H1 2026 security report, crypto losses topped USD 1 billion across 212 incidents in the first six months of 2026, the most incidents recorded in any comparable period. Ethereum suffered approximately USD 332 million in stolen funds; Solana, USD 326 million. The largest single exploit was KelpDAO at USD 292 million.
Ido Ben-Natan, CEO of Blockaid, offered important historical framing when speaking to CoinTelegraph: "2025 had $2.58 billion lost across 63 incidents, concentrated in Q1 by Bybit's $1.5 billion, with Ethereum and Arbitrum the top chains by stolen-fund flow." The comparison is instructive: 2026's H1 figure represents a far higher incident count at a lower average loss per event, an editorial calculation based on source data, suggesting that while catastrophic single exploits may be declining, the attack surface across the ecosystem is widening.
The base case, then, is not that Ethereum and Solana are structurally insecure blockchains. Rather, they are the most actively developed ecosystems, which means the most deployed smart contracts, the most active decentralised finance (DeFi) protocols, and, by extension, the most concentrated pool of exploitable value at the application layer. To be precise: the protocol layer is the blockchain itself, Ethereum's or Solana's core code and consensus rules, while the application layer refers to the individual programmes and protocols built on top of it, such as lending platforms or trading applications.
⚖️ Protocol Risk vs. Application Risk
That distinction matters because conflating protocol-level and application-level security leads to a misreading of where genuine risk resides. Neither Ethereum's consensus layer, the system by which network participants agree on the state of the chain, nor Solana's validator architecture, the set of nodes that process and confirm transactions, was the point of failure in H1 2026. The exploits, including the KelpDAO incident, targeted smart contracts and application logic sitting on top of those networks, not the networks themselves.
This pattern is not new. High-value protocols attract both capital and adversarial attention. The more total assets deposited in DeFi protocols, a figure commonly referred to as total value locked (TVL), the larger the incentive to probe the application layer for weaknesses. Ethereum's dominance in DeFi and Solana's growth in trading infrastructure have made both chains primary targets for exactly this reason: activity concentration and exploit concentration tend to move together, though the precise causal relationship between the two remains an active area of research in on-chain security.
For investors assessing ETH and SOL as assets, the relevant security question is therefore not whether the base layer is safe, it largely is, but whether the specific applications holding capital have undergone rigorous auditing, maintain active on-chain monitoring, and hold credible insurance or recovery mechanisms. Protocol ownership does not confer protection from application-layer failure.
🏛️ Institutional Appetite Meets Security Scrutiny
Institutional capital is nonetheless moving toward both assets with conviction. Morgan Stanley Investment Management launched the Morgan Stanley Ethereum Trust (MSSE) and Morgan Stanley Solana Trust (MSOL) on July 28, 2026, each carrying a 0.14% expense ratio. According to the same report, both funds intend to stake a portion of their holdings, and Morgan Stanley stated it will not retain any portion of the staking rewards, directing them to investors in full.
The staking feature introduces a layer of nuance. ETH and SOL staking operates at the protocol level, through validators and delegated stake, which sits structurally above the application-layer risks responsible for H1 2026's losses. However, smart contract risk does not disappear entirely from institutional products. Some institutional staking vehicles use liquid staking protocols as intermediaries. Liquid staking refers to arrangements where deposited assets are represented by a separate token that can be traded or redeployed, creating an additional layer of smart contract exposure that standard staking does not carry. The KelpDAO exploit is one example of the risks that can emerge at that layer.
The launch of these exchange-traded products (ETPs), benchmarked against CoinDesk Ether and Solana settlement rates, suggests institutional allocators are treating protocol-level security as within acceptable parameters while viewing application-layer risk as a portfolio management consideration rather than a reason to avoid the underlying asset class. Whether that framing holds depends on several conditions: whether institutional staking infrastructure avoids direct exposure to high-risk liquid staking contracts, whether audit coverage across major protocols keeps pace with TVL growth, and whether the incident rate of H1 2026 moderates in the second half of the year. At the pace of 212 incidents in six months, an editorial extrapolation rather than a formal forecast, full-year figures could approach prior records even without a single catastrophic event. The more durable structural question is whether the Ethereum and Solana developer communities, auditors, and on-chain security firms can reduce the application-layer attack surface faster than the total value deposited in those ecosystems grows. Security infrastructure, not protocol architecture, is what determines the answer.
Indicia Labs does not provide investment, tax, or legal advice. You are solely responsible for determining the suitability of any investment, investment strategy, or related transaction based on your personal investment objectives, financial circumstances, and risk tolerance. Indicia Labs may offer educational information about digital assets, which may include blog posts, articles, third-party content, news feeds, tutorials, and videos. This information does not constitute any form of advice, and you should not rely on it as such. Indicia Labs does not recommend buying, earning, selling, or holding any digital asset and will not be responsible for any decisions you make based on the provided information. Any content provided by Indicia Labs may contain errors, inaccuracies, or outdated information and should not be relied upon for making any investment decisions and Indicia Labs and its affiliates hold no responsibility for the accuracy of the provided information or content.
As with any asset, the value of digital assets can fluctuate, and there is a significant risk of losing money when buying, selling, holding, or investing in digital assets. Consult your financial advisor, legal or tax professional regarding your specific situation and financial condition, and carefully consider whether trading or holding digital assets is suitable for you.
Indicia Labs is not registered with the U.S. Securities and Exchange Commission and does not offer securities services in the United States or to U.S. persons. You acknowledge that digital assets are not subject to protections or insurance provided by the Federal Deposit Insurance Corporation or the Securities Investor Protection Corporation.
