Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks

According to this week’s report from crypto market tracker CryptoRank, DeFi platforms suffered 121 hacks to date this 12 months, leading to roughly $942 million in losses.

The second quarter accounted for 85 incidents and about $775 million stolen, inserting it as essentially the most lively interval ever for exploits within the crypto sector.

The surge in assaults is towards a backdrop of a crypto market wrestle, pervaded by weakening investor confidence. Total worth locked (TVL) in DeFi protocols has fallen each month this 12 months, dropping from about $115 billion in January to $70 billion in late June.

Drift Protocol, KelpDAO Exploits Hiked Q2 Losses

Per CryptoRank’s knowledge, Q2 2026’s 85 incidents are 49 greater than the interval with the second-highest frequency of exploits, which occurs to be Q1 2026. However, complete dollar-denominated losses weren’t as high as earlier peaks, with the information supplier reporting that two back-to-back assaults in April accounted for the vast majority of losses recorded within the quarter.

Drift Protocol and KelpDAO misplaced a mixed $590 million, which is greater than half of all of the DeFi losses recorded in 2026. Drift Protocol disclosed that attackers had stolen about $285 million in person belongings, with blockchain intelligence agency TRM Labs’s investigations linking the operation to hacking outfits linked with North Korea.

According to TRM, preparations for the assault began on-chain as early as March 11 with a ten ETH withdrawal from Tornado Cash. The crypto tumbler transaction got here after months of in-person conferences between the Pyongyang proxies and Drift workers.

“The attacker used social engineering to induce Drift Security Council multisig signers into pre-signing transactions that appeared routine however carried hidden authorizations for important admin actions,” the agency wrote in a report printed April 30.

Just over two weeks later, North Korea’s Lazarus Group exploited the liquid restaking protocol KelpDAO’s LayerZero bridge infrastructure and stole roughly $290 million value of rsETH.

Chainalysis talked about on the time that the attackers solid a cross-chain message on April 18 after compromising two distant process name nodes utilized by LayerZero’s Decentralized Verifier Network. At the identical time, the criminals struck a 3rd node with a distributed denial-of-service assault, making the system use compromised verifiers.

The verification course of was rigged to permit for the creation of rsETH tokens on Ethereum with out burning the corresponding belongings on Unichain. Within days of the assault, lending protocol Aave’s TVL dropped from $26.4 billion to $14.3 billion, clocking $12 billion in withdrawn funds and a decline of about 46%.

Hacks Were One Problem; a Shrinking Market Was Another

Aave’s TVL dip wasn’t distinctive, with CryptoRank’s knowledge displaying the worth locked in all of DeFi falling each single month in 2026, going from $115.3 billion in January to only over $70 billion in June. And whereas hacks weren’t the principle cause for the decline, the agency famous that the frequency of incidents doubtless made customers much less assured, resulting in a wider rotation away from the sector.

But the drop hasn’t been as dangerous because the one within the 2021-2022 cycle when the DeFi TVL tanked greater than 70% in seven months. The present dip has been a lot slower, and the market has additionally been totally different structurally, CryptoQuant says, with the stablecoin provide rising to about $300 billion, real-world asset tokenization increasing, and capital dispersed throughout extra sectors like derivatives, infrastructure, and lending, as a substitute of being concentrated in a handful of AMMs and yield farms.

However, among the many largest ecosystems by TVL, solely Tron and Hyperliquid have managed to develop this 12 months, with the previous gaining 5% and the latter including almost 7% because it turned the dominant venue for on-chain perpetuals. The remainder of the highest 10 chains are deeply within the pink, with the worst hit being Plasma and Arbitrum, which have to date seen their TVL plunge by 74.6% and 55%, respectively.

The publish Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks appeared first on CryptoPotato.