The crypto industry set an anti-record for the number of hacks in the second quarter of 2026.
The second quarter of 2026 set a record for the number of crypto protocol hacks, with 83 incidents recorded. Total losses amounted to $755.3 million. This is not the most expensive period in history in terms of losses—the record is still held by the fourth quarter of 2020, with $3.56 billion. However, the frequency of attacks has reached an unprecedented level, indicating systemic problems in the security of decentralized finance.
Major Attacks and Key Threat Vectors
The most significant events were the hack of the KelpDAO protocol for $293 million and the exploit of Drift Protocol for $280 million. In total, the cross-chain bridge segment accounted for $351 million in losses, with 38% of that amount linked to the incident involving the LayerZero OFT bridge, which, according to my data, directly correlates with the KelpDAO attack. Another 37% of losses were caused by compromised administrative access and token price manipulation. Contrary to popular belief, private key theft accounted for only 5.66% of total damages.
Notably, the number of attacks increased against the backdrop of a significant decline in overall ecosystem liquidity. Total value locked (TVL) fell from $164 billion to approximately $73 billion. This is a paradoxical situation: hackers are attacking more frequently, but the targets are becoming less "lucrative." In my opinion, the root of the problem lies in the gap between the speed of deploying new protocols and the maturity of their risk management systems. For example, many projects use a "three-of-six" multisignature scheme but actually store three keys on a single device, nullifying all security.
Consequences and Market Reaction
After the hack of the cross-chain protocol THORChain for $10 million in May, the team was forced to suspend the service, including trading and liquidity pool operations. And in early June, unknown parties compromised the wallets of the Humanity Protocol project, causing damages of approximately $31 million.
As an analyst, I see a worrying trend: the industry is becoming increasingly fragmented, and security standards are failing to keep pace with innovation. Although total losses have not yet broken historical records, the frequency of attacks signals that attackers are adapting faster than developers are implementing protective measures. This requires not just point fixes but a fundamental overhaul of security architecture in DeFi.