The crypto industry set an anti-record for the number of hacker attacks in the second quarter of 2026.
The second quarter of 2026 became the most "fruitful" in terms of the number of crypto protocol hacks: analysts recorded 83 incidents. This is an absolute historical record for the number of attacks in a single quarter. The total damage from these incidents amounted to $755.3 million.
The largest attacks were the hack of the KelpDAO protocol for $293 million and the Drift Protocol exploit for $280 million. These two incidents together account for more than 75% of the total losses. In the cross-chain bridge segment, damage reached $351 million, with 38% of that amount attributed to the attack on the LayerZero OFT bridge, which was linked to the KelpDAO hack. Another 37% of losses in this segment were caused by compromised administrative access and token price manipulations. Private key theft, contrary to expectations, accounted for only 5.66% of the total damage.
Despite the record number of attacks, this quarter was not the most expensive in terms of loss volume. The absolute record for the cost of hacks still belongs to the fourth quarter of 2020, when damage amounted to $3.56 billion. This indicates a fundamental change in the threat structure: instead of single giant exploits, we are observing a constant stream of smaller but more frequent attacks.
The reason for this shift is a sharp decline in overall liquidity within the ecosystem. The total value locked (TVL) decreased from $164 billion to approximately $73 billion. This means that hackers simply have nothing to attack on a large scale. However, as practice shows, this does not reduce their activity but merely fragments their targets.
It is important to note that the increase in the number of incidents alongside a decrease in total damage is an alarming signal. It points to a systemic problem: a gap between the pace of protocol development and the maturity of their risk management systems. For example, some projects use a "three out of six" multi-signature scheme but store three keys on a single laptop. This is not security, but an illusion of security.
In May, THORChain developers confirmed a hack of the cross-chain protocol for $10 million, after which the team paused the protocol's operations, blocking trading and liquidity pool activities. And on June 8, unknown parties compromised wallets associated with the Humanity Protocol project, causing $31 million in damage.
My expert conclusion: The record number of hacks alongside a decrease in total damage is not a "success" for the industry in fighting hackers, but a symptom of its fragmentation and immaturity. As long as protocols sacrifice security for speed to market, we will see more small but painful incidents. Investors should pay attention not to the size of TVL, but to the security architecture of the project.