ARK Invest: Crypto Hack Losses Hit $8.78B, First On-Chain Revenue Deficit Since 2020

For the first time since 2020, money stolen from the cryptocurrency industry this year has surpassed what it earns on-chain. Aggregate security-tracking data places 2026 hack losses at $8.78 billion, while ARK Invest projects roughly $5.6 billion in on-chain revenue over the same period — a shortfall of about $3.2 billion.

Hacks Outpace On-Chain Earnings

ARK analyst Lorenzo Valente laid out the comparison in a November 11 post, which draws on datasets from Token Terminal and DefiLlama. On-chain revenue, in this framing, captures the fees and protocol income generated across networks — the yardstick behind ARK's estimate of how blockchain revenue and profit actually accrue.

The longer ledger still favors the industry. Since 2017, $26.9 billion has been stolen from crypto against $47 billion earned on-chain, or roughly 57 cents taken for every dollar earned. The last crossover came in 2020, when attackers seized $4 billion against about $1 billion in on-chain earnings. Revenue then jumped to $12.5 billion in 2021 and stayed ahead of theft through 2025, when it reached $8.9 billion — a mark this year's projection sits well below, roughly 37% under 2025's total.

Some protocols route part of their revenue into token buybacks, a mechanism that helped most tokens paying holders outperform Bitcoin (BTC) in 2026 — the same revenue stream now outpaced by theft this year.

Both sides of the ledger could still move before the year closes. Revenue is annualized over the first three quarters, while the theft tally runs only through November 11, leaving the final quarter weighted unevenly on each side.

@LorenzoARK · X post November 11 post. View on X

The Binance Breach Behind 72% of 2026 Losses

One incident shapes the whole tally. The October 29 breach of Binance, valued at $6.36 billion, accounts for about 72% of the year's losses, and the FBI has attributed the attack to TraderTraitor, a hacking group tied to North Korea. In an official update posted on X, the exchange said it has covered roughly 98% of the stolen amount using its own reserves — a statement deployed to contain user FUD in the days after the event.

That single backstop changes how the year reads. Strip the breach out and losses fall to about $2.42 billion, below the $2.72 billion recorded across 2025, even though the number of logged incidents more than doubled to 342 from 148.

DeFi protocols moved in the opposite direction. They lost $1.19 billion across 243 incidents this year, a 58% increase from $757 million in 2025. Two April attacks illustrate the pattern: Drift, a Solana (SOL)-based trading platform, lost $295 million that month, and liquid restaking protocol Kelp DAO lost $293 million. Both were linked to North Korean hackers — as was October's Binance breach — and formed part of a string of on-chain drains through the spring.

The contrast between the two venue types is the sharpest fact in the data: a centralized operator with deep reserves could absorb a multi-billion-dollar hit and make users whole, while protocol users had no comparable protection once a drain occurred.

@binance · X post Update posted on X. View on X

Timing Gaps and a Missing Backstop

Two caveats belong on this comparison before it is read as a structural verdict. The revenue side annualizes three quarters while theft totals stop at November 11, so a fourth-quarter move on either input could still shift the gap — though the Binance figure alone already exceeds the full-year revenue estimate.

The more durable signal sits in the split after the exchange is removed. Centralized venues can tap reserves the way an insurance pool would, but users who hold their own private keys stand largely alone after a drain. With on-chain incidents passing 240 for the year and protocol losses up 58%, wider adoption of DeFi insurance is the practical consequence the data points to.