Crypto Theft Hit Nearly $400 Million in January 2026

The crypto industry’s security challenges reached a critical point in January 2026. A surge in sophisticated phishing attacks and treasury breaches drained roughly $400 million from the ecosystem.

Data from blockchain security firm CertiK shows that 40 recorded incidents cost the crypto industry approximately $370.3 million.

Single $284 Million Phishing Attack Dominates

However, that figure climbs to over $400.3 million when accounting for a $30 million exploit of the Solana-based platform Step Finance on January 31.

CertiK reported that a singular, devastating social engineering scam, rather than complex protocol hacks, defined the month.

https://twitter.com/certikalert/status/2017568546747035835?s=46

A lone investor lost $284 million on January 16 after a phishing campaign targeting a hardware wallet. The theft represented roughly 71% of the month's adjusted total losses.

The attacker, impersonating Trezor customer support, manipulated the victim into revealing a recovery seed phrase. The heist resulted in the immediate theft of 1,459 Bitcoin and 2.05 million Litecoin.

The immediate aftermath of the Trezor-related heist saw a massive rotation of stolen assets into Monero (XMR), a privacy-focused token that obscures transaction history.

This high-volume conversion triggered a rally in Monero’s market price. The price action underscores the persistent challenges regulators face in addressing the use of privacy coins to facilitate illicit capital flight and money laundering.

On the technical side, smart contract vulnerabilities continue to take a significant bite out of the market. Truebit reported a $26.6 million loss due to an overflow vulnerability, the month's largest direct attack on a protocol's code.

Other notable victims included Swapnet, which lost $13 million. DeFi protocols Saga and Makina Finance also lost $6.2 million and $4.2 million, respectively.

The Step Finance breach involved draining several treasury and fee wallets via a "well-known attack vector," resulting in the movement of 261,854 SOL.

As the industry enters February, these figures serve as a stark reminder that even the most robust hardware encryption is ineffective when user-level security is bypassed.