Crypto wallet security: Assessing claims about prevented losses

Opinions expressed by Digital Journal contributors are their own.

Immunefi reported roughly $972 million lost across 207 hack incidents in the first half of 2026, the highest six-month incident count in its records, according to The Block’s coverage of its June ecosystem update. Such loss reports document successful attacks, while company estimates of prevented losses attempt to describe potential harm avoided. The two measures require different evidence and should be assessed separately. 

Why losses get counted, and prevention gets estimated

Loss reporting draws on on-chain evidence and incident reports, but trackers can produce different totals. CertiK’s Hack3D report put H1 2026 losses at more than $1.31 billion across 344 incidents, while Immunefi’s figure for the same period was $972 million across 207. Coverage, incident definitions, and reporting methods can influence these differences, making each report’s scope relevant to comparisons. 

Prevention is harder still, because it counts attacks that never finished. Estimating their financial impact involves assessing what was exposed and what might have happened without intervention. Several platforms now publish figures describing that work.

“In the first half of 2026, Binance Wallet Security Center helped users avoid an estimated $540 million in potential losses,” says Jimmy Su, Chief Security Officer at Binance, “while filtering 206 million spam transfers, detecting 4.93 million high-risk transactions and flagging 996,000 malicious approvals.”

The activity figures count transfers, transactions and approvals; the $540 million estimates potential financial exposure avoided. Binance said some high-risk transactions were blocked directly, while others were abandoned after users received alerts. Its post describes these interventions but does not detail the calculation behind the dollar estimate. 

Loss figures carry their own uncertainty, too. Chainalysis first reported $9.9 billion in 2024 scam revenue, a number it later revised to $12 billion, and says its annual scam estimates grow by an average of 24% between reporting periods. Its January 2026 report recorded at least $14 billion in on-chain scam receipts for 2025 and projected that the figure could exceed $17 billion as more illicit addresses were identified. 

TRM Labs also identifies victim underreporting as a factor that can leave observed scam data below the full scale of harm. These reporting gaps help explain why loss estimates continue to develop after their initial publication.

What makes a prevention estimate useful

A credible prevention estimate starts by defining a potential loss, whether that means the full balance exposed or only the value of the transaction attempted. It breaks the total down by attack category and separates what the system blocked from warnings a user chose to heed. It avoids counting one attack twice when it trips several layers, sticks to a fixed period and, ideally, invites outside review.

Definitions matter because current disclosures measure different things. MetaMask said in its July 14, 2026, tenth-anniversary release that its protections blocked more than 6.5 million malicious website visits and nearly 150,000 malicious transactions in 2025, helping users avoid what the company estimated at more than $500 million in losses. The release gives the activity counts and estimated value without detailing how the latter was calculated.

Immunefi says its platform has helped prevent more than $25 billion in losses from hacks. Its homepage reports that total without setting out the valuation method. Separately, The Block reported approximately $13.45 million in researcher payments through the platform for 837 valid bugs in the first half of 2026. Those payments show the resources directed toward finding vulnerabilities before attackers exploit them. 

Binance, for its part, reported more than $3.9 billion in potential scam losses prevented across its platform in 2025, and $6.69 billion in fraud and scams blocked, affecting 5.4 million users. Its August 2026 post cites both figures without explaining their relationship or potential overlap, so they should be read as separate company-reported measures. 

Publishing methods alongside regular prevention updates would make that work easier to assess. Spending provides another perspective: Immunefi reports more than $140 million in lifetime researcher payouts, a measure of investment in vulnerability discovery alongside its estimates of potential losses avoided.

Reading prevention figures alongside loss reports

Loss totals and prevention estimates answer different questions, so they belong side by side and should never be netted against each other. The method behind a prevention estimate gives the number its meaning. Comparable reporting across platforms could give users, investors, and regulators a fuller picture of crypto wallet security than loss tallies alone, while making the industry’s defensive work easier to examine and compare.