The second quarter of 2026 set an anti-record for the number of crypto project hacks — 83 incidents in three months.
The digital asset market experienced the most attack-intensive quarter on record. From April to June 2026, analysts recorded 83 cases of crypto protocol hacks — an absolute record in terms of the number of incidents. However, the total damage, amounting to $755.3 million, was significantly more modest than previous peaks.
A Stream of Small Attacks Instead of Single Giant Exploits
The key trend of the second quarter is a shift in the threat model. Instead of a few large-scale hacks typical of past years, the industry faced a continuous stream of smaller but more frequent attacks. The largest incidents were the hack of the KelpDAO protocol for $293 million and the Drift Protocol exploit for $280 million. In the cross-chain bridge segment, losses reached $351 million, with 38% of this amount attributed to the attack on the LayerZero OFT bridge, linked to the KelpDAO incident. Another 37% of losses came from compromised administrative access and token price manipulation. Private key theft accounted for only 5.66% of total losses.
Reasons for the Increase in Incidents
According to my data, the decline in total value locked (TVL) from $164 billion to approximately $73 billion played a dual role. On one hand, it reduced the potential bounty for hackers, explaining the relatively low total damage. On the other hand, it created an illusion of security among many teams, who let their guard down. The gap between the speed of protocol development and the maturity of their risk management systems has become critical. For example, some projects use a "three out of six" multi-signature scheme but store three keys on one laptop — a gross violation of basic security principles.
Warning Signs for the Industry
In May, THORChain developers confirmed a $10 million hack of the cross-chain protocol, after which they suspended trading and liquidity pool operations. And on June 8, unknown attackers compromised Humanity Protocol wallets, causing $31 million in damage. These incidents are just the tip of the iceberg.
My expert opinion. A record number of hacks with a decrease in total damage is not a reason for optimism. It is a signal of systemic vulnerability: the industry is becoming less liquid but more chaotic. Projects must urgently review their security practices, especially in key management and cross-chain infrastructure. Otherwise, the next quarter may bring not only anti-records in the number of attacks but also a return to billion-dollar losses.