August was the busiest month of 2026 for successful crypto attacks, while security researchers simultaneously reported a record number of vulnerabilities, according to new data from Immunefi.
The blockchain security platform said researchers closed 424 valid reports across bug bounty programs and audit competitions during August, up from 154 in the same month last year.
Confirmed critical vulnerabilities rose even more sharply, climbing from 14 in August 2025 to 126 this year — a ninefold increase and the highest monthly total recorded by Immunefi.
The figures come during an unusually active year for crypto security incidents. Immunefi previously recorded 207 hacks during the first half of 2026, the highest six-month incident count in its dataset, with losses totaling approximately $972 million.
Other security researchers have reported a similar trend. Blockaid described the first half of 2026 as the most-hacked half-year on record by incident count, although estimates of total losses vary between security firms.
At the same time, spending on responsible disclosure is rising. Immunefi said it paid $802,000 to 126 security researchers in August, while cumulative researcher payouts on the platform reached $143.2 million.
The increase in reported vulnerabilities does not necessarily mean blockchain software itself has become less secure. More active bounty programs and security competitions can lead to more flaws being discovered before attackers exploit them.
But the simultaneous rise in successful hacks and critical findings highlights the growing attack surface facing crypto protocols as more capital and financial infrastructure move on-chain.
For the industry, the numbers reinforce a familiar security race: attackers are finding more opportunities, while white-hat researchers are being paid to find the weaknesses first.