Have we seen an acceleration in cyberattacks?
Introduction
This week’s cybersecurity events have been cause for alarm: PHP2Shell vulnerabilities have triggered widespread patching and precautionary shutdowns, and AI agents have been documented in attacks against banks, healthcare organizations, and corporate cloud systems.
At the same time, AI models, including open-weight ones, continue to scale their cyber capability. Vals AI reports that DeepSeek V4.1 Flash 1017, a Chinese open-weight model, outperformed the frontier closed model GPT 6 Sol on its multi-step offensive cybersecurity evaluation at substantially lower cost.
These developments raise a broader question: is there evidence of a measurable acceleration in cyberattacks in 2026?
Following Cunningham & Rush (2026), we examine publicly available data on cryptocurrency hacks and ransomware for signs of acceleration. Our preliminary findings are:
- Recorded cryptocurrency hacks accelerated after April 2026.1
- The increase was particularly pronounced for crypto code exploits and smaller thefts. We also find acceleration among larger thefts, though it is less pronounced.
- Recorded ransomware attacks show no clear acceleration, but growth in the number of ransomware hacker groups posting victims has accelerated.
- Ransomware hacker groups are sending more AI-generated negotiation messages, though these remain a small share of all negotiation messages.
Additionally, Appendix A checks the crypto findings against six other hack trackers.
Overall, we are moderately confident (~75%) that crypto attacks have accelerated in 2026.2 We open-source our code, data, and results in our GitHub repo.
Crypto attacks
Data source. Our main source is DeFiLlama, a public crypto-data website that keeps a list of hacks on decentralized finance. We downloaded a dataset of 1,306 incidents from 2011 to 2026 (of which 1,218 are from 2020-2026), each with a date, an amount stolen, and a classification of the cause. We have also collected data from other websites that recorded crypto attacks, including CertiK, Comparitech, and more, in Appendix A.
Tentative Finding 1: The number of recorded crypto hacks has accelerated in 2026
Tentative Finding 2: Most of that acceleration comes from smaller thefts in 2026
The increase in recorded small thefts could reflect two mechanisms:
- Cheaper attacks: AI lowers the cost of carrying out an attack, which makes smaller targets worth the effort.
- Better detection: AI helps discover anomalies, increasing the rate of identification of smaller thefts that would previously have gone unnoticed or unreported.
We cannot distinguish these mechanisms. We assign a subjective probability of 75% that both are contributing, with some real rise in cheaper attacks.
Tentative Finding 3: Total losses show little acceleration
Note: DeFiLlama gives no dollar loss for 37 of the 1,218 hacks listed since January 2020 (3%). By year, the share ranges from 0.5% (2023) to 5.1% (2024), and it is 3.4% in 2026. This chart counts those hacks as zero, so monthly totals are slightly understated.
Tentative Finding 4: The amount of loss from each exploit did not accelerate in 2026
Note: DeFiLlama gives no dollar loss for 37 of the 1,218 hacks listed since January 2020 (3%). By year, the share ranges from 0.5% (2023) to 5.1% (2024), and it is 3.4% in 2026. This chart averages only the hacks with a dollar loss.
Tentative Finding 5: Accelerations in hacking vary by exploit type
We counted DeFiLlama hacks by month and exploit type across 13 categories from January 2023 to September 2026, excluding incomplete October data.
Many of our findings fit what we’d intuitively expect.
- Many accelerated exploit types (input validation, access control, token and share accounting, oracle manipulation, key compromise) involve finding software flaws or reasoning about how a protocol behaves. These are tasks that AI coding agents could plausibly accelerate.
- Many non-accelerated exploit types (rug pulls, social engineering, market manipulation, governance) principally depend on persuading people, building credibility, or attracting investor funds. So, these hacks are probably less accelerated by improved AI coding capabilities.
The pattern is not clear-cut, though: reentrancy is also a code-based exploit category, yet it did not show acceleration in our analysis.
One possible explanation is that AI tools reduce the effort required for some exploit types more than others. Another possible explanation is that AI tools help discover anomalies that are also more AI-exploitable. The second explanation may be a little far-fetched in our opinion, because AI-assisted detection and AI-exploitability do not necessarily go hand in hand. For example, machine-learning methods can effectively detect rug pulls, even though rug pulls themselves don’t seem to be particularly AI-exploitable.
Caveat: Overall, we are ~75% confident that 2026 displays a genuine acceleration in the number of crypto hacks, beyond changes in detection and reporting.
The increase in recorded hacks could partly reflect improved detection, reporting, or database coverage. We could not verify whether DeFiLlama’s collection process remained consistent over the study period, so we cannot rule out that changes stemmed from the discovery of incidents. We therefore compare the pattern across other trackers (see Appendix A), although agreement across trackers would not fully resolve this concern if they rely on overlapping reports or detection systems.
To help address this concern, we also examine attacks involving losses of at least $1 million, since larger thefts are harder to miss. We find an acceleration in larger attacks too, though the acceleration is much smaller.
We also break down attacks by exploit type. The categories showing acceleration tend to be the ones that we’d expect to be more amenable to AI assistance. It is also possible that these exploits might also be easier to discover using AI, leaving the same underlying uncertainty.
A related article by DeFiLlama and Firepan examines whether the share of hacks reproducible using AI has increased. However, it compares 2020-2021 with 2024-2026, making it difficult to determine whether there was an acceleration specifically in 2026.
We will update this estimate as more evidence becomes available.
Ransomware attacks
We also examined ransomware attacks using two sources. Ransomware.live records victims named on ransomware gangs’ “leak sites,” websites where gangs threaten to publish stolen data to pressure victims into paying. Comparitech’s Ransomware Intelligence Platform includes only attacks confirmed by another source, such as a victim statement, a data-breach notice, or a news report.
Tentative Finding 1: The number of victims listed on ransomware leak sites has shown little acceleration.
Tentative Finding 2: The number of recorded independently confirmed attacks has not accelerated.
This difference could partly reflect delays in disclosure. US state laws require organizations to notify affected individuals of certain data breaches, so disclosure is not always voluntary. However, these notices can take months after an incident to appear. So, the counts for recent quarters may rise as more attacks are disclosed and added to the dataset.
Tentative Finding 3: There is a slight acceleration in the number of hacker groups posting ransomware victims.
Tentative Finding 4: Evidence of AI use in ransomware negotiations
We used Pangram 4.1 to examine possible AI use in publicly available ransomware negotiations from the Ransomchat dataset. The dataset contained 276 chats and 12,889 messages involving 31 ransomware hacker groups. We selected timestamped, English-language attacker messages longer than 50 words and excluded templates, which left us with 344 messages.
Note that our 2026 results are mostly limited to Q1: Ransomchat updates its dataset with a lag, which means that it has little coverage of Q2-Q3 2026. The 21 September 2026 Ransomchat snapshot contained few negotiations after March 2026, and historically, for chats since 2023, the median publication lag was four months, and the mean was five months.
Also note that the 2021 data point is likely a false positive.
Hacker data:
Some ransomware hackers appear to have started drafting negotiation messages with LLMs in 2025-26. Examples:
Pangram labels: AI-Generated | AI-Assisted | Human Written
| Attacker & date | Quote |
|---|---|
| Dragonforce, 2025-07-11 | “I’m sure you’ve been following the news. You know that some people have chosen to settle, even after the incident became public. They placed a high value on data privacy. What would be the consequences if you were to handle it differently? It would be a significant news story. We expect a serious proposal from you.” |
| Dragonforce, 2026-03-08. (Note: Contains curly apostrophes and non-breaking hyphens.) | Hello. In the end, we want to get money from you. We’ve encrypted your files and also downloaded a large number of them to our own servers. We can give you a list of the files we took, along with 1‑3 small samples from that list. We can also decrypt 1‑3 small files that contain non‑critical information to demonstrate that we can recover all of your data. If you’d like, we can do all of that, or we can go straight to the payment request. You see a timer counting down the negotiation period. When it expires, if we don’t receive what we want, we will publish the stolen data publicly and delete the decryption tools, making any recovery of your data completely impossible. |
| SilentRansomGroup, 2026-03-10 | “Our business is built on reputation - if a company were to pay us and, for some reason, we broke our promise, word would spread, negatively impacting our future deals. Clearly, that is not in our interest, as it would lead to a loss of trust from clients.” |
| SilentRansomGroup, 2026-03-17 | “We appreciate your offer, but we are unable to accept it at this time. To clarify, We remain open to negotiation and do not consider our initial figure unchangeable. However, given the critical nature of the situation and the value of the data involved, We must emphasize that We do not believe our current ask is unreasonable.” |
Victim messages:
Victims also used AI assistance in writing negotiation messages. Examples:
Pangram labels: AI-Generated | AI-Assisted | Human Written
| Victim & date | Quote |
|---|---|
| Akira victim, 2025-03-10 | “After further internal discussions, our limitations remain significant due to bureaucratic approvals and cryptocurrency transfer restrictions. Nevertheless, in the spirit of progressing towards a mutually acceptable resolution, we can increase our offer slightly to $162,000 USD. We kindly ask for your understanding regarding these economic realities and bureaucratic challenges, including the complexity of transferring funds into cryptocurrency. We remain fully committed to reaching an agreement promptly.” |
| Akira victim, 2025-03-21 | “Thank you for the updated offer. This is really appreciated. We understand your effort to reduce the price, but unfortunately, even 135K$ is still far beyond our financial capacity as I already mentioned. Our final and only possible offer remains 50K$, which we can pay quickly. This is not emotional or strategic, it’s a financial and operational constraint. We can’t give you what we don’t have.” |
| Dragonforce victim, 2026-03-18 | "We have completed validation of the data and confirmed your ability to decrypt. At this point, we are moving through the internal authorization process required before any payment can be approved. This step involves multiple parties and cannot be expedited beyond certain requirements. [...] Any early release of the information will disrupt this process and may impact our ability to finalize payment." |
| SilentRansomGroup victim, 2026-03-27 | "We were on the phone with our representative this morning, but they weren't able to provide any new information yet. As soon as we know more, you'll know as well. Please understand that we're not sitting on this, we're actively pressing them for an answer." |
Implications and future work
In this blog, we examined several public datasets for evidence of changes in cyberattack activity. Recorded crypto hacks accelerated in 2026, particularly smaller thefts, though the pattern varies across trackers. More ransomware groups posted victims on leak sites, but victim counts did not accelerate, and independently confirmed attacks did not accelerate. We also found evidence of AI-assisted writing in ransomware negotiations.
Our evidence suggests that there might have been an acceleration in crypto attacks in 2026, coinciding with improvements in AI’s cyber capabilities. We note possible confounders that may explain part of the observed increase, including changes in detection and reporting.
Continuing to track AI’s real-world use and impact is important, as Cunningham & Rush (2026) have noted. Researchers should keep on finding, registering, and updating useful data series to inform AI’s real-world impact.
Aside from that, we also see several promising directions for future research in cyber attack acceleration:
- Human misuse vs rogue AI agents: Our analysis of ransomware negotiation messages suggests possible AI-assisted drafting, but provides limited evidence about how the underlying attacks were carried out. We suspect these cases are human-directed AI misuse, given links to known ransomware groups. We would like to see future time series analysis that distinguishes human-directed AI use, autonomous agent execution, and rogue behavior in incidents and tracks their prevalence over time.
- AI’s impact on cyber offense vs. defense: As AI capabilities improve, both attackers and defenders may become more effective. For instance, AI could help attackers exploit smart contracts and develop ransomware, while helping defenders audit code and detect intrusions. Understanding the relative rates of improvement is essential for assessing AI’s net impact on cybersecurity.
- Which models are being used in attacks? Identifying the models involved in real-world cyberattacks, including whether they are open- or closed-weight, would help us understand how different models contribute to emerging cyber risks.
- Collect and analyze other datasets: Other sources we considered include npm/PyPI attacks, wallet-drainer phishing, bank transfer fraud, phishing emails, and scam conversations. We encourage timely updates to existing datasets, the development of new datasets, and further analyses as more 2026 data becomes available.
Thanks to Tom Cunningham, Alan Chan, Jake Steckler, and Daniel Paleka for feedback.
Appendix
Appendix A: other crypto hack datasets
We explore six other trackers: SlowMist, Comparitech, CertiK, rekt.news, Web3 Is Going Great, and BlockSec. In each analysis, we make a conclusion about acceleration by comparing each tracker’s average for 2026 Q2-Q3 (for BlockSec, 2026 Q2 only) with two benchmarks: its trend leading up to 2026, and its busiest quarter of 2022-25 (its “old peak”).
SlowMist Hacked: reversal of trend (acceleration), but below its old peak
- A list kept by the blockchain security firm SlowMist of every blockchain security incident it finds, including scams and a few incidents in which nothing was stolen.
- The acceleration came in March-April 2026.
- Caveats: From late 2025, SlowMist more often cited security firms’ monitoring accounts on X, which post when their software spots a likely hack. Such entries rose from about 3 a quarter in 2025 to 25 a quarter in 2026 Q2-Q3, about a third of the roughly 70 extra incidents a quarter; if SlowMist would otherwise have missed these incidents, or if these monitoring accounts used AI to discover attacks, then that part of the rise could reflect discovery rather than more attacks.
Comparitech crypto heists: acceleration, slightly above its old peak
- Comparitech compiles its cryptocurrency heist database by searching industry news reports and company announcements worldwide, rather than independently detecting attacks on the blockchain. It includes documented hacks, thefts, flash-loan exploits, and other technical vulnerabilities, but excludes rug pulls, employee theft, and thefts from individuals.
- The acceleration came in April 2026.
CertiK incident dashboard: acceleration, above its old peak
- CertiK tracks cryptocurrency security incidents through its own on-chain monitoring and investigations, supplemented by publicly available information such as project announcements, social media, and news reports.
- The acceleration came in March 2026.
- Caveats: CertiK keeps adding incidents to past months (its count for 2026 Q2 across all categories rose from 194 in July to 222 by 18 October), so recent quarters will probably rise further.
rekt.news leaderboard: unclear/no obvious acceleration, below its old peak
- Incidents that the crypto news site rekt.news wrote an article about, mostly large DeFi exploits.
- No clear acceleration in 2026.
- Caveats: editors choose which incidents to cover, almost all of them $1 million or more; its tags rarely say how an attack worked.
Web3 Is Going Great: no acceleration, far below its old peak
- One editor’s (Molly White’s) selection of notable crypto events; we count the entries tagged “Hack or scam”.
- No acceleration in 2026
- Caveats: it is not meant to be complete, and what gets in depends on what the editor finds newsworthy; the tag mixes hacks with scams, phishing and some court cases.
BlockSec security incidents: slight acceleration, slightly above its old peak
- BlockSec is a blockchain security firm that sells Phalcon, a system that watches blockchain transactions to detect and block attacks. The page says it lists attacks “with losses of over $100K.”
- There is a slight acceleration in 2026.
- Caveats: it publishes with a deliberate delay, and its newest entry is from 24 July 2026, so 2026 Q3 is incomplete and left out of the comparison.
Appendix B: Pangram messages
We have included all of our Pangram results in this CSV file.