{"investigation":{"slug":"june-2026-cross-chain-bridge-exploit-127m-three-protocols","entity_name":"June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)","trust_score":8,"severity_base":null,"score_modifier":0,"confidence":0.3,"status":"published","content_type":"investigation","summary":"An alleged coordinated cross-chain bridge exploit on June 14, 2026 is described as draining $127 million from three DeFi protocols, named only as BridgeLink, CrossFlow and Relay Protocol, across Ethereum, Arbitrum and Polygon in about 12 minutes. The claim rests on a single blog post by Nadcab Labs, an Indian blockchain development services firm, and no Tier 1 or Tier 2 outlet, analytics database or security firm has corroborated it; several details are inconsistent with verifiable facts. Verified bridge incidents in June 2026 were much smaller: Humanity Protocol (about $30.8M), Syscoin (about 5 billion SYS minted, worth roughly $9–10M, fully returned and burned) and Taiko (about $1.7M). The largest verified 2026 bridge exploit was KelpDAO in April (about $292M), which one analysis suggests may have been the source of the inflated figure.","sections":[{"content":"The $127M claim originates primarily from a blog post by Nadcab Labs (nadcab.com), a blockchain development services company based in Prayagraj, Uttar Pradesh, India, that publishes blog content as a marketing function, with no editorial independence and no disclosed methodology for original security intelligence; it is classed as a Tier 3 source. Two other sources cited in the investigation request do not support it: the Phemex blog's documented scope ends in mid-April 2026 and contains no reference to a June 14 incident or the named protocols, and CoinGabbar documents 14 bridge hacks in 2026 with the most recent dated May 31, 2026, again without the June 14 incident or the named protocols. No Tier 1 or Tier 2 outlet (including Reuters, Bloomberg, WSJ, CoinDesk, The Block, Decrypt, Rekt News or Chainalysis) has reported a $127M three-protocol exploit on June 14, 2026; CoinDesk's June 2026 bridge coverage yields only the Taiko exploit ($1.7M, June 22). The protocol names do not appear in any on-chain analytics platform, exchange announcement or security firm post-mortem, and no SEC, CFTC or DOJ action referencing these protocols or this figure has been identified. The '$127M' figure and the named protocols should be treated as alleged and low-confidence pending credible corroboration.","heading":"Source Credibility Assessment","sources":[{"url":"https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain","name":"$127M Stolen in DeFi Bridge Cross-Chain Hack | Nadcab Labs","type":"other","credibility":3},{"url":"https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","name":"Every Major DeFi Hack in 2026 So Far | Phemex Blog","type":"other","credibility":3},{"url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hacks-2026-14-bridge-attacks-security-concerns","name":"$340M Lost: 14 Crypto Hacks 2026 Targeting Bridges | CoinGabbar","type":"news_article","credibility":3},{"url":"https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10","name":"Taiko halts its Ethereum layer-2 network after a bridge exploit, token dives | CoinDesk","type":"news_article","credibility":1}],"severity":"critical"},{"content":"According to the Nadcab Labs post, the only source making specific claims, a coordinated exploit began at 03:42 UTC on June 14, 2026 and ended by 03:54 UTC. It allegedly targeted shared cross-chain bridge infrastructure used by BridgeLink (alleged loss $52M), CrossFlow ($48M) and Relay Protocol ($27M), for a combined $127M, on Ethereum, Arbitrum and Polygon, with Optimism also mentioned. The alleged vector was a signature replay attack exploiting validators that signed messages without chain-specific nonces or block heights, so valid Ethereum signatures could authorize fraudulent withdrawals on Arbitrum; two validator nodes were allegedly compromised via phishing. Alleged secondary impacts include $43M liquidated through decentralized exchanges, $34M locked in isolated pools and $8M partially recovered via exchange freezes. Market makers allegedly affected include Wintermute ($12M), Jump Crypto ($18M), GSR ($9M) and Amber Group ($7M). None of these claims has been confirmed by the named firms, any blockchain analytics firm or any Tier 1 outlet, and no on-chain transaction data or wallet addresses have been published to substantiate them. The post was published on June 17, 2026; no corroborating coverage has been identified since.","heading":"Alleged Exploit Details (Unverified)","sources":[{"url":"https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain","name":"$127M Stolen in DeFi Bridge Cross-Chain Hack | Nadcab Labs","type":"other","credibility":3}],"severity":"critical"},{"content":"Several details are inconsistent with verifiable facts. First, the investigation context called this 'the largest bridge attack since the Wormhole incident earlier in 2026', but Wormhole was not hacked in 2026; its exploit occurred in February 2022 and involved about $320–325 million (roughly 120,000 wETH via a signature verification bypass). Second, BridgeLink, CrossFlow and Relay Protocol do not appear in any blockchain analytics database, DEX registry or independent report; 'Relay Protocol' may be confused with Relay.link, an existing cross-chain payments provider that has published no security incident in this period. Third, every specific figure in the Nadcab article (timestamps, per-protocol losses, market maker losses, DEX liquidation amounts) exists only in that source and is absent from DefiLlama's hacks database, The Block's exploit tracker and security firm post-mortems. Fourth, Nadcab Labs has a commercial interest in publishing DeFi security content for SEO and business development and no track record as an original security intelligence source. The pattern is consistent with a plausible-sounding incident narrative that blends real 2026 context with fabricated specifics. An alternative explanation offered by a second analysis is that the figure is an inflated or garbled reference to the far larger April 2026 KelpDAO exploit; a Cybernews reference to a '$300 million cross-chain bridge hack' as the largest DeFi exploit of 2026 may likewise conflate or round the KelpDAO figure. The $127M figure matches neither the Syscoin ($9–10M) nor the KelpDAO (~$292M) incident.","heading":"Indicators of Potential Fabricated or AI-Generated Content","sources":[{"url":"https://www.nadcab.com/blockchain-development-company","name":"Nadcab Labs — Blockchain Development Company and Services","type":"official","credibility":3},{"url":"https://defillama.com/hacks","name":"DeFi Hacks and Exploits Database | DefiLlama","type":"on_chain","credibility":2},{"url":"https://www.theblock.co/data/decentralized-finance/exploits","name":"DeFi Data and Charts for Hacks and Recoveries | The Block","type":"research","credibility":1},{"url":"https://www.chainalysis.com/blog/wormhole-hack-february-2022/","name":"Wormhole Hack: February 2022 Post-Mortem | Chainalysis","type":"research","credibility":2},{"url":"https://www.elliptic.co/blog/325-million-stolen-from-wormhole-defi-service","name":"$325 Million Stolen from Wormhole DeFi Service (February 2022) | Elliptic","type":"research","credibility":1},{"url":"https://phemex.com/academy/what-is-wormhole-cross-chain-bridge-interoperability-security-ecosystem-trends","name":"Wormhole Cross-Chain Bridge: Interoperability, Security and Trends 2026 | Phemex Academy","type":"research","credibility":3},{"url":"https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","name":"Top Crypto Hacks of 2026: Bridge Exploits and Sophisticated Operations Drive Over $750 Million in Losses | KuCoin","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Several smaller June 2026 exploits are confirmed by Tier 1 and Tier 2 sources, although the pages disagree on scope: one described Syscoin as the only large June bridge exploit with Tier 2 corroboration, while the other also counts Humanity Protocol and Taiko. Humanity Protocol (June 9, 2026, CoinDesk): malware on a developer's device exfiltrated seven private keys; three of six Gnosis Safe owner keys controlling a Hyperlane bridge ProxyAdmin on Ethereum were compromised, the attacker upgraded the bridge contract to a malicious implementation, and about 18,510 ETH (around $30.8M; reported elsewhere as $30–36M, and $32M in CoinDesk's headline) and 1,548 BNB were drained; the H token fell more than 80% (80–90% per another summary). Syscoin (June 7, 2026): a proof validation flaw allowed about 5 billion SYS to be minted, worth roughly $9–10M; all tokens were returned and burned (detailed below). Taiko (June 22, 2026, CoinDesk, The Defiant, CryptoTimes): a private key for Raiko, Taiko's multi-prover stack, was inadvertently committed to the public taikoxyz/raiko GitHub repository (described as an RSA-3072 key on one page and an SGX signing key by The Defiant); the attacker forged cross-chain proofs and drained about $1.7M in ETH and TAIKO before Taiko halted block production, and on June 25 Taiko announced it would fully restore bridge backing. Together these verified incidents total roughly $42–47M, well below the alleged $127M.","heading":"Verified June 2026 Bridge and DeFi Exploits","sources":[{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","name":"Humanity Protocol token crashes more than 80% after a $32 million private-key hack | CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10","name":"Taiko halts its Ethereum layer-2 network after a bridge exploit, token dives | CoinDesk","type":"news_article","credibility":1},{"url":"https://thedefiant.io/news/hacks/taiko-bridge-exploit-sgx-signing-key-github-1-7m","name":"Taiko Bridge Drained $1.7M After SGX Signing Key Left Exposed on GitHub | The Defiant","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/06/25/taiko-to-fully-restore-bridge-backing-after-1-7m-hack/","name":"Taiko to Fully Restore Bridge Backing After $1.7M Hack | CryptoTimes","type":"news_article","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","name":"Explained: The Syscoin Bridge Hack (June 2026) | Halborn","type":"research","credibility":2},{"url":"https://pricepredictions.com/news/syscoin-bridge-exploit-5-billion-sys-tokens-minted-proof-validation-flaw-br7jyfk9","name":"Syscoin bridge exploit mints ~5B unauthorized SYS tokens worth $10 million | PricePredictions","type":"news_article","credibility":3}],"severity":"high"},{"content":"On June 7, 2026, an unknown attacker exploited a proof validation vulnerability in Syscoin's native cross-chain bridge to mint about 5 billion unauthorized SYS. At a June 7 price of about $0.00171 per SYS (CoinGecko), the tokens were worth roughly $8.56–10 million, a 568% increase over the roughly 891 million SYS legitimate circulating supply. The Syscoin team discovered the attack, suspended the bridge and publicly disclosed it on June 8; GoPlus Security independently identified and confirmed the vulnerability, and the incident was covered by Rekt News, Cryptopolitan, CryptoTimes, Halborn and others. Halborn's post-mortem and the Syscoin team's June 15 technical disclosure traced the root cause to ambiguous SPV (Simplified Payment Verification) proof parsing. The bridge links a Bitcoin-style UTXO chain to an Ethereum-compatible NEVM layer and relies on SPV proofs that a burn occurred on one side before minting on the other. The attacker crafted a UTXO transaction with two asset records referencing the same output, one labelling it a custom test token the attacker had created and the other native SYS; Syscoin Core treated it as a custom token transaction while the NEVM relay treated it as a native SYS burn, so the storage contract authorized a 5 billion SYS mint without a genuine burn. The attacker had first tested the technique with a smaller transaction. The Syscoin team said this was a logic and parsing implementation error in the relay code rather than a cryptographic flaw in SPV design; the fix requires each burn proof to link to exactly one asset record.","heading":"Syscoin Bridge Exploit (June 7, 2026): Incident and Mechanism","sources":[{"url":"https://www.cryptotimes.io/2026/06/08/syscoin-halts-bridge-after-exploit-mints-5-billion-sys-tokens/","name":"Syscoin Halts Bridge After Exploit Mints 5 Billion SYS Tokens | CryptoTimes","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/syscoin-bridge-paused-exploit-project/","name":"Syscoin bridge remains paused as 5B token mint exploit threatens project's future | Cryptopolitan","type":"news_article","credibility":2},{"url":"https://rekt.news/syscoin-rekt","name":"Syscoin - Rekt News","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","name":"Explained: The Syscoin Bridge Hack (June 2026) | Halborn","type":"research","credibility":2},{"url":"https://pricepredictions.com/news/syscoin-bridge-exploit-5-billion-sys-tokens-minted-proof-validation-flaw-br7jyfk9","name":"Syscoin bridge exploit mints ~5B unauthorized SYS tokens worth $10 million | PricePredictions","type":"news_article","credibility":3},{"url":"https://coinspot.io/en/cryptocurrencies/syscoin-recovers-after-hack-and-burns-5-billion-stolen-tokens/","name":"Syscoin eliminates consequences of bridge attack | CoinSpot","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/","name":"Syscoin recovers and burns 5 billion hack tokens | Cryptopolitan","type":"news_article","credibility":2}],"severity":"high"},{"content":"Rekt News published on-chain identifiers for the Syscoin exploit. Initial mint recipient: sys1qgaelv690g7wwp2xchfdh0enf5uewzq5sm9wvcw; mint transaction a5b422abbbd89c8e316d1990f696e030d610cb527001ff97524f5317e87fa184. The attacker split the roughly 5 billion SYS across sys1q2k482wnachkgky4lw60973p4vcf7xlh9kzpv33 (about 4 billion SYS) and sys1qx6jjkq89sdaxftfgre3m0nv7vjfd4jeakg5t38 (about 1 billion SYS) via transaction 31e12b0dcd9aeffa12e596e0b16d75ce161667104c7e511bfafe67195117113c. The Syscoin team's recovery address was sys1qdytsq5am9a7y6hweenl925g3yxtlrvl9fls0yg; funds were returned via transactions ce9671d1e5d1fa4d7090828f92712c830aef7ecb87e31f59c4fab7baf7a8fc9d and e079e10ceae81d30ce64e5469acde64a8c7f4705771e4d6eceabecbcb100debd, and all returned tokens were destroyed via an OP_RETURN burn transaction viewable on Syscoin's block explorer. These addresses relate to the verified Syscoin incident, not to the alleged $127M exploit, for which no addresses have been published.","heading":"Syscoin: On-Chain Evidence and Fund Movement","sources":[{"url":"https://rekt.news/syscoin-rekt","name":"Syscoin - Rekt News","type":"on_chain","credibility":2},{"url":"https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/","name":"Syscoin recovers and burns 5 billion hack tokens | Cryptopolitan","type":"news_article","credibility":2}],"severity":"medium"},{"content":"After tracing the tokens, the Syscoin team contacted the attacker on-chain with a recovery address and a warning that exchange escalation and legal action would follow, and on June 9, 2026 opened a private bounty discussion whose terms were not disclosed. The attacker returned all 5 billion SYS, which the team burned via OP_RETURN, restoring supply to about 891 million SYS. Native SYS deposits at exchanges resumed on June 10. As of the June 15 postmortem the bridge remained paused pending a full security audit and patch validation. No attacker was identified and no law enforcement or regulator was reported as involved. SYS fell about 20% after disclosure on June 8; in mid-June CoinMarketCap listed SYS at about $0.0026, down over 48% over 30 days and over 91% over a year. The unauthorized mint temporarily represented about 85% of Syscoin's post-exploit supply.","heading":"Syscoin: Recovery Outcome and Market Impact","sources":[{"url":"https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/","name":"Syscoin recovers and burns 5 billion hack tokens | Cryptopolitan","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/syscoin-reports-bridge-vulnerability-destroys-recovered-funds-89590","name":"Syscoin Reports Bridge Vulnerability, Destroys Recovered Funds | Phemex News","type":"news_article","credibility":2},{"url":"https://coinspot.io/en/cryptocurrencies/syscoin-recovers-after-hack-and-burns-5-billion-stolen-tokens/","name":"Syscoin eliminates consequences of bridge attack | CoinSpot","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/sys-drops-20-after-5b-unauthorized-tokens-minted-in-syscoin-bridge-exploit/","name":"SYS Drops 20% After 5B Unauthorized Tokens Minted in Syscoin Bridge Exploit | CryptoPotato","type":"news_article","credibility":2},{"url":"https://pricepredictions.com/news/syscoin-bridge-exploit-5-billion-sys-tokens-minted-proof-validation-flaw-br7jyfk9","name":"Syscoin bridge exploit mints ~5B unauthorized SYS tokens worth $10 million | PricePredictions","type":"news_article","credibility":3}],"severity":"medium"},{"content":"No threat actor has been attributed for the alleged $127M exploit, which remains unverified. For Syscoin, the team, GoPlus Security, Halborn and Rekt News all declined to name or speculate on the attacker; the attacker's willingness to return funds after on-chain contact and a bounty discussion may suggest an opportunistic exploit rather than a state-sponsored operation, though this is speculative, and no link to any state actor has been identified. The most significant 2026 state-actor attribution in the bridge landscape is the KelpDAO exploit of April 2026, which LayerZero attributed 'with preliminary confidence' to North Korea's Lazarus Group and its TraderTraitor subunit, while blaming Kelp's 1-of-1 DVN verifier configuration.","heading":"Attribution","sources":[{"url":"https://rekt.news/syscoin-rekt","name":"Syscoin - Rekt News","type":"research","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus | CoinDesk","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit | Chainalysis","type":"research","credibility":1},{"url":"https://www.crowdfundinsider.com/2026/04/275261-kelpdao-bridge-exploit-analysis-north-korean-hackers-steal-292-million-via-off-chain-attack/","name":"KelpDAO Bridge Exploit Analysis: North Korean Hackers Steal $292 Million Via Off-Chain Attack | Crowdfund Insider","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The broader 2026 trend of bridge exploits is well documented even though the $127M incident is not. The largest verified bridge exploit of 2026 is KelpDAO, reported at approximately $292M (about $290M per Bloomberg and LayerZero coverage, $293M per DL News). Sources differ on the date (April 18 vs April 19, 2026) and describe the mechanism differently: a forged cross-chain message through Kelp's LayerZero-powered bridge that released about 116,500 rsETH without a legitimate deposit (CoinDesk, per one page), versus an attack on compromised off-chain RPC node infrastructure (per the other page, citing Chainalysis and Crowdfund Insider); wrapped ether was left stranded across 20 chains. TRM Labs reported that North Korea-linked actors stole 76% of all 2026 crypto hack value through just two attacks. CoinGabbar documents 14 bridge exploits in 2026 through May 31 totalling about $340M (reported as $340.7M): CrossCurve ($3M, February 1), IoTeX Bridge ($8.8M, February 21), Squid Router ($1M, April 7), Hyperbridge ($2.5M, April 13), KelpDAO ($292M, April 18), ZetaChain ($300K, April 27), TransitFinance ($1.88M, May 13), TAC Cross-Chain Layer ($2.8M, May 13), THORChain ($10M, May 15), Adshares Bridge ($628K, May 15), Verus-Ethereum Bridge ($11.4M, May 18, via missing source-amount validation in Solidity bridge logic per CoinDesk), MapProtocol/ButterNetwork ($180K, May 21), Gravity Bridge ($5.4M, May 30) and Alephium TokenBridge ($815K, May 31). CryptoTimes reported in May 2026 that bridge hacks had topped $328M year-to-date; KuCoin put 2026 losses from bridge exploits and other sophisticated operations at over $750 million, and AltFins at over $840 million across DeFi hacks. Dominant 2026 vectors include forged cross-chain messages, compromised validator or signing keys and proof validation flaws, consistent with, but not unique to, the method described in the unverified $127M report.","heading":"2026 Cross-Chain Bridge Exploit Trend (Verified Context)","sources":[{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains | CoinDesk","type":"news_article","credibility":1},{"url":"https://www.bloomberg.com/news/articles/2026-04-19/crypto-hack-worth-290-million-triggers-defi-contagion-shock","name":"Crypto Hack Worth $290 Million Triggers DeFi Contagion Shock | Bloomberg","type":"news_article","credibility":1},{"url":"https://www.dlnews.com/articles/defi/why-crypto-bridges-are-defis-weakest-link-after-293m-kelp-dao-hack/","name":"Why cross-chain bridges are DeFi's weakest link after $293m Kelp DAO hack | DL News","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/05/02/the-usd292m-crypto-hack-exposed-defi-s-weak-spots-here-s-what-must-change-insiders-say","name":"The $292M crypto hack exposed DeFi's weak spots. Here's what must change, insiders say | CoinDesk","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit | Chainalysis","type":"research","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks | TRM Labs","type":"research","credibility":2},{"url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hacks-2026-14-bridge-attacks-security-concerns","name":"$340M Lost: 14 Crypto Hacks 2026 Targeting Bridges | CoinGabbar","type":"news_article","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/","name":"Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate | CryptoTimes","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack","name":"Yet another crypto bridge falls victim to an $11 million hack | CoinDesk","type":"news_article","credibility":1},{"url":"https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","name":"Top Crypto Hacks of 2026: Bridge Exploits and Sophisticated Operations Drive Over $750 Million in Losses | KuCoin","type":"news_article","credibility":2},{"url":"https://altfins.com/blog/defi-hacks-2026/","name":"DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything | AltFins","type":"news_article","credibility":2},{"url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/","name":"Biggest DeFi Hacks and Exploits of 2026 | CCN","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2022-02","event":"Wormhole bridge hack: about 120,000 wETH (~$320–325M) stolen via a signature verification bypass. This is the actual 'Wormhole incident'; it did not occur in 2026.","source":"Elliptic / Chainalysis","source_url":"https://www.elliptic.co/blog/325-million-stolen-from-wormhole-defi-service"},{"date":"2026-04","event":"KelpDAO bridge exploited for about $292M in rsETH (dated April 18 on one page and April 19 on another); the largest verified bridge exploit of 2026.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04","event":"LayerZero publishes post-mortem attributing the KelpDAO exploit with preliminary confidence to Lazarus Group/TraderTraitor and blaming Kelp's 1-of-1 DVN verifier configuration.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-05","event":"Verus-Ethereum bridge exploited for about $11.4M via missing source-amount validation in Solidity bridge logic.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack"},{"date":"2026-05","event":"CoinGabbar's count reaches 14 bridge exploits in 2026, totalling about $340.7M.","source":"CoinGabbar","source_url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hacks-2026-14-bridge-attacks-security-concerns"},{"date":"2026-06","event":"Syscoin bridge exploit: malformed SPV proof mints about 5 billion unauthorized SYS (~$8.56–10M); bridge suspended.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/06/08/syscoin-halts-bridge-after-exploit-mints-5-billion-sys-tokens/"},{"date":"2026-06","event":"Syscoin publicly discloses the exploit; GoPlus Security confirms the vulnerability; SYS drops about 20%.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/syscoin-bridge-paused-exploit-project/"},{"date":"2026-06","event":"Humanity Protocol: malware-stolen keys used to drain about $30–36M from a Hyperlane bridge ProxyAdmin on Ethereum; H token falls 80–90%.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack"},{"date":"2026-06","event":"Syscoin team contacts the attacker on-chain with a recovery address and opens a private bounty discussion.","source":"Rekt News","source_url":"https://rekt.news/syscoin-rekt"},{"date":"2026-06","event":"Native SYS exchange deposits resume; attacker returns all 5 billion SYS.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/"},{"date":"2026-06","event":"Alleged coordinated exploit at 03:42 UTC drains $127M from BridgeLink ($52M), CrossFlow ($48M) and Relay Protocol ($27M) across Ethereum, Arbitrum and Polygon. Asserted only by Nadcab Labs; unverified.","source":"Nadcab Labs (unverified; Tier 3 only)","source_url":"https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain"},{"date":"2026-06","event":"Syscoin publishes its technical postmortem; returned SYS destroyed via OP_RETURN burn; bridge remains paused pending audit.","source":"CoinSpot","source_url":"https://coinspot.io/en/cryptocurrencies/syscoin-recovers-after-hack-and-burns-5-billion-stolen-tokens/"},{"date":"2026-06","event":"Nadcab Labs publishes the blog post describing the alleged $127M exploit; no corroborating coverage identified.","source":"Nadcab Labs","source_url":"https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain"},{"date":"2026-06","event":"Taiko L2 bridge exploit: a private key leaked on GitHub enables about $1.7M in forged withdrawal proofs; Taiko halts block production.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10"},{"date":"2026-06","event":"Taiko announces it will fully restore bridge backing after the $1.7M exploit.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/06/25/taiko-to-fully-restore-bridge-backing-after-1-7m-hack/"}],"sources_used":[{"url":"https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain","name":"$127M Stolen in DeFi Bridge Cross-Chain Hack | Nadcab Labs","type":"other","archive_url":"https://web.archive.org/web/20260727014307/https://www.nadcab.com/blog/defi-bridge-exploit-june-cross-chain","credibility":3,"archive_timestamp":null},{"url":"https://www.nadcab.com/blockchain-development-company","name":"Nadcab Labs — Blockchain Development Company and Services","type":"official","archive_url":"http://web.archive.org/web/20260727014354/https://www.nadcab.com/blockchain-development-company","credibility":3,"archive_timestamp":"2026-07-27T01:43:54+00:00"},{"url":"https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","name":"Every Major DeFi Hack in 2026 So Far | Phemex Blog","type":"other","archive_url":"http://web.archive.org/web/20261021082652/https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","credibility":3,"archive_timestamp":"2026-10-21T08:26:52+00:00"},{"url":"https://phemex.com/academy/what-is-wormhole-cross-chain-bridge-interoperability-security-ecosystem-trends","name":"Wormhole Cross-Chain Bridge: Interoperability, Security and Trends 2026 | Phemex Academy","type":"research","archive_url":"https://web.archive.org/web/20261002152434/https://phemex.com/academy/what-is-wormhole-cross-chain-bridge-interoperability-security-ecosystem-trends","credibility":3,"archive_timestamp":"2026-10-02T15:24:34+00:00"},{"url":"https://www.coingabbar.com/en/crypto-currency-news/crypto-hacks-2026-14-bridge-attacks-security-concerns","name":"$340M Lost: 14 Crypto Hacks 2026 Targeting Bridges | CoinGabbar","type":"news_article","archive_url":"http://web.archive.org/web/20260727060826/https://www.coingabbar.com/en/crypto-currency-news/crypto-hacks-2026-14-bridge-attacks-security-concerns","credibility":3,"archive_timestamp":"2026-07-27T06:08:26+00:00"},{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","name":"Humanity Protocol token crashes more than 80% after a $32 million private-key hack | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260610155427/https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","credibility":1,"archive_timestamp":"2026-06-10T15:54:27+00:00"},{"url":"https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10","name":"Taiko halts its Ethereum layer-2 network after a bridge exploit, token dives | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260625234642/https://www.coindesk.com/tech/2026/06/22/taiko-halts-its-ethereum-layer-2-network-after-a-bridge-exploit-token-dives-10","credibility":1,"archive_timestamp":"2026-06-25T23:46:42+00:00"},{"url":"https://thedefiant.io/news/hacks/taiko-bridge-exploit-sgx-signing-key-github-1-7m","name":"Taiko Bridge Drained $1.7M After SGX Signing Key Left Exposed on GitHub | The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260625160807/https://thedefiant.io/news/hacks/taiko-bridge-exploit-sgx-signing-key-github-1-7m","credibility":2,"archive_timestamp":"2026-06-25T16:08:07+00:00"},{"url":"https://www.cryptotimes.io/2026/06/25/taiko-to-fully-restore-bridge-backing-after-1-7m-hack/","name":"Taiko to Fully Restore Bridge Backing After $1.7M Hack | CryptoTimes","type":"news_article","archive_url":"https://web.archive.org/web/20260727061351/https://www.cryptotimes.io/2026/06/25/taiko-to-fully-restore-bridge-backing-after-1-7m-hack/","credibility":2,"archive_timestamp":"2026-07-27T06:13:51+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","name":"Explained: The Syscoin Bridge Hack (June 2026) | Halborn","type":"research","archive_url":"http://web.archive.org/web/20260616062745/https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026","credibility":2,"archive_timestamp":"2026-06-16T06:27:45+00:00"},{"url":"https://pricepredictions.com/news/syscoin-bridge-exploit-5-billion-sys-tokens-minted-proof-validation-flaw-br7jyfk9","name":"Syscoin bridge exploit mints ~5B unauthorized SYS tokens worth $10 million | PricePredictions","type":"news_article","archive_url":"http://web.archive.org/web/20260726094055/https://pricepredictions.com/news/syscoin-bridge-exploit-5-billion-sys-tokens-minted-proof-validation-flaw-br7jyfk9","credibility":3,"archive_timestamp":"2026-07-26T09:40:55+00:00"},{"url":"https://www.cryptotimes.io/2026/06/08/syscoin-halts-bridge-after-exploit-mints-5-billion-sys-tokens/","name":"Syscoin Halts Bridge After Exploit Mints 5 Billion SYS Tokens | CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260726103022/https://www.cryptotimes.io/2026/06/08/syscoin-halts-bridge-after-exploit-mints-5-billion-sys-tokens/","credibility":2,"archive_timestamp":"2026-07-26T10:30:22+00:00"},{"url":"https://www.cryptopolitan.com/syscoin-bridge-paused-exploit-project/","name":"Syscoin bridge remains paused as 5B token mint exploit threatens project's future | Cryptopolitan","type":"news_article","archive_url":"https://web.archive.org/web/20260726225918/https://www.cryptopolitan.com/syscoin-bridge-paused-exploit-project/","credibility":2,"archive_timestamp":"2026-07-26T22:59:18+00:00"},{"url":"https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/","name":"Syscoin recovers and burns 5 billion hack tokens | Cryptopolitan","type":"news_article","archive_url":"http://web.archive.org/web/20261012164823/https://www.cryptopolitan.com/syscoin-recovers-and-burns-5-billion-hack-tokens/","credibility":2,"archive_timestamp":"2026-10-12T16:48:23+00:00"},{"url":"https://rekt.news/syscoin-rekt","name":"Syscoin - Rekt News","type":"research","archive_url":"http://web.archive.org/web/20260726145302/https://rekt.news/syscoin-rekt","credibility":2,"archive_timestamp":"2026-07-26T14:53:02+00:00"},{"url":"https://coinspot.io/en/cryptocurrencies/syscoin-recovers-after-hack-and-burns-5-billion-stolen-tokens/","name":"Syscoin eliminates consequences of bridge attack | CoinSpot","type":"news_article","archive_url":"https://web.archive.org/web/20260726233152/https://coinspot.io/en/cryptocurrencies/syscoin-recovers-after-hack-and-burns-5-billion-stolen-tokens/","credibility":2,"archive_timestamp":"2026-07-26T23:31:52+00:00"},{"url":"https://phemex.com/news/article/syscoin-reports-bridge-vulnerability-destroys-recovered-funds-89590","name":"Syscoin Reports Bridge Vulnerability, Destroys Recovered Funds | Phemex News","type":"news_article","archive_url":"https://web.archive.org/web/20260727003404/https://phemex.com/news/article/syscoin-reports-bridge-vulnerability-destroys-recovered-funds-89590","credibility":2,"archive_timestamp":"2026-07-27T00:34:04+00:00"},{"url":"https://www.livebitcoinnews.com/5-billion-sys-created-in-syscoin-bridge-breach-team-halts-operations/","name":"5 Billion SYS Created in Syscoin Bridge Breach, Team Halts Operations | Live Bitcoin News","type":"news_article","archive_url":"http://web.archive.org/web/20260726104746/https://www.livebitcoinnews.com/5-billion-sys-created-in-syscoin-bridge-breach-team-halts-operations/","credibility":2,"archive_timestamp":"2026-07-26T10:47:46+00:00"},{"url":"https://cryptopotato.com/sys-drops-20-after-5b-unauthorized-tokens-minted-in-syscoin-bridge-exploit/","name":"SYS Drops 20% After 5B Unauthorized Tokens Minted in Syscoin Bridge Exploit | CryptoPotato","type":"news_article","archive_url":"http://web.archive.org/web/20260726223629/https://cryptopotato.com/sys-drops-20-after-5b-unauthorized-tokens-minted-in-syscoin-bridge-exploit/","credibility":2,"archive_timestamp":"2026-07-26T22:36:29+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260804014915/https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","credibility":1,"archive_timestamp":"2026-08-04T01:49:15+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero blames Kelp's setup for $290 million exploit, attributes it to North Korea's Lazarus | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526220018/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-05-26T22:00:18+00:00"},{"url":"https://www.bloomberg.com/news/articles/2026-04-19/crypto-hack-worth-290-million-triggers-defi-contagion-shock","name":"Crypto Hack Worth $290 Million Triggers DeFi Contagion Shock | Bloomberg","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.coindesk.com/business/2026/05/02/the-usd292m-crypto-hack-exposed-defi-s-weak-spots-here-s-what-must-change-insiders-say","name":"The $292M crypto hack exposed DeFi's weak spots | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260507112601/https://www.coindesk.com/business/2026/05/02/the-usd292m-crypto-hack-exposed-defi-s-weak-spots-here-s-what-must-change-insiders-say","credibility":1,"archive_timestamp":"2026-05-07T11:26:01+00:00"},{"url":"https://www.dlnews.com/articles/defi/why-crypto-bridges-are-defis-weakest-link-after-293m-kelp-dao-hack/","name":"Why cross-chain bridges are DeFi's weakest link after $293m Kelp DAO hack | DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260625125211/https://www.dlnews.com/articles/defi/why-crypto-bridges-are-defis-weakest-link-after-293m-kelp-dao-hack/","credibility":2,"archive_timestamp":"2026-06-25T12:52:11+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit | Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.crowdfundinsider.com/2026/04/275261-kelpdao-bridge-exploit-analysis-north-korean-hackers-steal-292-million-via-off-chain-attack/","name":"KelpDAO Bridge Exploit Analysis: North Korean Hackers Steal $292 Million Via Off-Chain Attack | Crowdfund Insider","type":"news_article","archive_url":"http://web.archive.org/web/20260424212401/https://www.crowdfundinsider.com/2026/04/275261-kelpdao-bridge-exploit-analysis-north-korean-hackers-steal-292-million-via-off-chain-attack/","credibility":2,"archive_timestamp":"2026-04-24T21:24:01+00:00"},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks | TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260719135758/https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","credibility":2,"archive_timestamp":"2026-07-19T13:57:58+00:00"},{"url":"https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/","name":"Crypto Bridge Hacks Top $328M in 2026 as Cross-Chain Exploits Accelerate | CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260726153716/https://www.cryptotimes.io/2026/05/18/crypto-bridge-hacks-top-328m-in-2026-as-cross-chain-exploits-accelerate/","credibility":2,"archive_timestamp":"2026-07-26T15:37:16+00:00"},{"url":"https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack","name":"Yet another crypto bridge falls victim to an $11 million hack | CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260921151800/https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack","credibility":1,"archive_timestamp":"2026-09-21T15:18:00+00:00"},{"url":"https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","name":"Top Crypto Hacks of 2026: Bridge Exploits and Sophisticated Operations | KuCoin","type":"news_article","archive_url":"http://web.archive.org/web/20261006102127/https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","credibility":2,"archive_timestamp":"2026-10-06T10:21:27+00:00"},{"url":"https://www.elliptic.co/blog/325-million-stolen-from-wormhole-defi-service","name":"$325 Million Stolen from Wormhole DeFi Service (February 2022) | Elliptic","type":"research","archive_url":"http://web.archive.org/web/20260412163738/https://www.elliptic.co/blog/325-million-stolen-from-wormhole-defi-service","credibility":1,"archive_timestamp":"2026-04-12T16:37:38+00:00"},{"url":"https://www.chainalysis.com/blog/wormhole-hack-february-2022/","name":"Wormhole Hack: February 2022 Post-Mortem | Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260315141859/https://www.chainalysis.com/blog/wormhole-hack-february-2022/","credibility":2,"archive_timestamp":"2026-03-15T14:18:59+00:00"},{"url":"https://defillama.com/hacks","name":"DeFi Hacks and Exploits Database | DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20260726034353/https://defillama.com/hacks","credibility":2,"archive_timestamp":"2026-07-26T03:43:53+00:00"},{"url":"https://www.theblock.co/data/decentralized-finance/exploits","name":"DeFi Data and Charts for Hacks and Recoveries | The Block","type":"research","archive_url":"http://web.archive.org/web/20260506133429/https://www.theblock.co/data/decentralized-finance/exploits","credibility":1,"archive_timestamp":"2026-05-06T13:34:29+00:00"},{"url":"https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/","name":"Biggest DeFi Hacks and Exploits of 2026 | CCN","type":"news_article","archive_url":"http://web.archive.org/web/20261001051502/https://www.ccn.com/education/crypto/defi-hacks-exploits-causes-crypto-stolen-2026/","credibility":2,"archive_timestamp":"2026-10-01T05:15:02+00:00"},{"url":"https://altfins.com/blog/defi-hacks-2026/","name":"DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything | AltFins","type":"news_article","archive_url":"https://web.archive.org/web/20260727045534/https://altfins.com/blog/defi-hacks-2026/","credibility":2,"archive_timestamp":"2026-07-27T04:55:34+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-30T12:06:00.30459+00:00","updated_at":"2026-10-31T09:22:51.173907+00:00"},"source_quality":{"total":36,"tier1":0,"tier2":14,"tier3":0,"unrated":22},"follower_count":null,"content_updated_at":"2026-10-28T00:48:48.388Z","last_fact_checked_at":"2026-10-28T00:48:48.083Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}