Record-breaking wave of hacks in the second quarter of 2026: 83 incidents in three months
The second quarter of 2026 went down in crypto industry history as the most "fruitful" for hackers in terms of the number of attacks. Analysts recorded 83 crypto protocol hacks — an absolute record for the number of incidents over the entire observation period. The total damage from these attacks is estimated at $755.3 million.
The key feature of this period was not so much the total amount of losses, but the frequency of attacks. Instead of a few major exploits, as in the past, we observed a continuous stream of smaller but systematic hacks. This confirms the trend towards fragmentation of cyber threats: hackers have shifted from single high-profile targets to mass scanning of vulnerabilities in less secure protocols.
The most high-profile incidents of the quarter
The largest attacks were the hack of the KelpDAO protocol for $293 million and the Drift Protocol exploit, which caused $280 million in damage. Both incidents occurred in the cross-chain bridge segment, where total losses reached $351 million. Interestingly, 38% of this amount came from the hack of the LayerZero OFT bridge, which, according to DeFiLlama, is linked to the attack on KelpDAO. Another 37% of losses were caused by compromised administrative access and token price manipulation. Private key theft, contrary to popular belief, accounted for only 5.66% of the total damage.
Despite the record number of hacks, the second quarter of 2026 was not the most expensive in terms of losses. The absolute record is still held by the fourth quarter of 2020, with a figure of $3.56 billion. This suggests that overall liquidity in the ecosystem has significantly decreased: total value locked (TVL) has dropped from $164 billion to approximately $73 billion. As experts rightly note, the gap between the pace of protocol development and the maturity of their risk management systems is becoming critical. For example, some projects use a "three out of six" multi-signature scheme but store all three keys on a single laptop — a gross violation of basic security principles.
Special mention should be made of the THORChain incident in May, where a hack of the cross-chain protocol for $10 million forced the team to suspend the entire platform. And on June 8, hackers compromised the wallets of the Humanity Protocol project, causing $31 million in damage. These events confirm that vulnerabilities in cross-chain infrastructure and access management systems remain the main targets for attackers.
My analysis: The record number of hacks with a decrease in total damage is an alarming signal for the entire industry. It indicates that hackers are adapting faster than protocols are implementing protective measures. Investors and developers should reconsider their priorities: instead of chasing TVL and rapid launches, it is necessary to focus on security audits, multi-layered key protection, and penetration testing. Otherwise, the next quarter could break not only the quantitative but also the value record.