ARK Invest: Crypto Hack Losses Hit $8.78B, First On-Chain Revenue Deficit Since 2020

Hacks Outpace On-Chain Earnings

Crypto theft has overtaken what the industry earns on-chain this year, the first such reversal since 2020. Aggregate security-tracking data puts 2026 hack losses at $8.78 billion, while $ARK Invest projects roughly $5.6 billion in on-chain revenue for the same period, leaving a shortfall near $3.2 billion. $ARK analyst Lorenzo Valente set out the comparison in a November 11 post, which draws on Token Terminal and DefiLlama datasets. On-chain revenue measures the fees and protocol income generated across networks, the yardstick behind $ARK's estimate of how blockchain revenue and profit actually accrue. The longer ledger still favors the industry: since 2017, $26.9 billion has been stolen from crypto against $47 billion earned on-chain, or 57 cents taken for every dollar earned. The previous crossover came in 2020, when attackers seized $4 billion against about $1 billion in on-chain earnings. Revenue then jumped to $12.5 billion in 2021 and stayed ahead of theft through 2025, when it reached $8.9 billion. This year's projection sits well below that mark. Some protocols route part of their revenue into token buybacks, a mechanism that helped most tokens paying holders outperform Bitcoin (BTC) in 2026. Both sides of the ledger could still move before the year closes. Revenue is annualized over the first three quarters, while the theft tally runs only through November 11, so the final quarter is weighted unevenly on each side.

@LorenzoARK · X post

November 11 post.

View on X

The Binance Breach Behind 72% of 2026 Losses

One incident shapes the whole tally. The October 29 breach of Binance, valued at $6.36 billion, makes up about 72% of the year's losses, and the FBI has attributed the attack to TraderTraitor, a hacking group tied to North Korea. In an official update posted on X, the exchange said it has covered roughly 98% of the stolen amount using its own reserves, a statement deployed to contain user FUD in the days after the event. That single backstop changes how the year reads. Strip the breach out and losses fall to about $2.42 billion, below the $2.72 billion recorded across 2025, even though the number of logged incidents more than doubled to 342 from 148. DeFi protocols moved the opposite way: they lost $1.19 billion across 243 incidents this year, a 58% increase from $757 million in 2025. Two April attacks illustrate the pattern. Drift, a Solana (SOL)-based trading platform, lost $295 million that month, and liquid restaking protocol Kelp DAO lost $293 million. Both were linked to North Korean hackers and formed part of a string of on-chain drains through the spring. The contrast between the two venue types is the sharpest fact in the data: a centralized operator with deep reserves could absorb a multi-billion-dollar hit and make users whole, while protocol users had no comparable protection once a drain occurred.

@binance · X post

Update posted on X.

View on X

Timing Gaps and a Missing Backstop

Two caveats belong on this comparison before it is read as a structural verdict. The revenue side annualizes three quarters while theft totals stop at November 11, so a fourth-quarter move on either input could still shift the gap; against that, the Binance figure alone already exceeds the full-year revenue estimate. The more durable signal sits in the split after the exchange is removed. Centralized venues can tap reserves the way an insurance pool would, but users who hold their own private keys stand largely alone after a drain. With on-chain incidents passing 240 for the year and protocol losses up 58%, wider adoption of DeFi insurance is the practical consequence the data points to.