The crypto industry set an anti-record for the number of hacks in the second quarter of 2026.
The second quarter of 2026 became the most "fruitful" for crypto protocol hacks in history. Analysts recorded 83 incidents—an absolute record in terms of the number of attacks. However, the total damage of $755.3 million falls short of historical highs.
The largest targets for attackers were the KelpDAO and Drift Protocol, which lost $293 million and $280 million, respectively. In the cross-chain bridge segment, losses reached $351 million, with 38% of that amount attributed to the attack on the LayerZero OFT bridge linked to the KelpDAO hack. Another 37% of the damage was caused by compromised administrative access and token price manipulation. Contrary to expectations, private key theft accounted for only 5.66% of total losses.
Despite the record number of incidents, the current quarter lags behind the fourth quarter of 2020 in terms of damage volume, when losses amounted to $3.56 billion. This indicates a shift in hacker tactics: instead of isolated but large-scale exploits, we are seeing a constant stream of smaller attacks.
The decline in average damage amid a rise in the number of attacks is linked to a sharp drop in overall ecosystem liquidity. The total value locked (TVL) fell from $164 billion to approximately $73 billion. This makes large targets less attractive but simultaneously increases the vulnerability of small and medium-sized protocols. Additionally, the gap between the pace of protocol development and the maturity of their risk management systems remains critical. For example, some projects use a "three out of six" multi-signature scheme but store three keys on a single laptop—a gross security error.
In May 2026, the THORChain team confirmed a $10 million hack, after which the protocol was suspended. On June 8, unknown attackers compromised Humanity Protocol wallets, stealing approximately $31 million. These incidents are just the tip of the iceberg.
My Analysis
The record number of hacks is an alarming signal for the entire industry. Hackers are adapting faster than many protocols implement adequate security measures. The decline in TVL does not make the market safer—it merely changes the attack profile. Investors should reconsider their due diligence approaches, especially when choosing projects with low liquidity and weak security infrastructure.