{"investigation":{"slug":"q2-2026-defi-record-hack-wave","entity_name":"Q2 2026 DeFi Record Hack Wave","trust_score":0,"severity_base":null,"score_modifier":-1.4,"confidence":0.87,"status":"published","content_type":"investigation","summary":"Q2 2026 became the most-hacked quarter in crypto history by incident count, with 83 reported exploits totaling approximately $755 million in losses. The two largest incidents — a $292–293 million bridge exploit at KelpDAO and a $280–295 million social-engineering attack on Drift Protocol — were both attributed to North Korean state-sponsored actors, who TRM Labs said captured 76% of crypto hack value in 2026 through April. The wave marked a shift from smart-contract bugs toward infrastructure, key and human-layer compromise, and coincided with a roughly 39% year-to-date fall in DeFi total value locked.","sections":[{"content":"Q2 2026 (April 1 – June 30, 2026) was reported by multiple blockchain intelligence and cybersecurity firms and news outlets as the most-hacked quarter in crypto history by incident count. Citing data aggregated by DefiLlama, CoinTelegraph and Blockchain.news reported 83 distinct security incidents with aggregate losses of approximately $755.3 million, an average of nearly one confirmed exploit per day; FinanceFeeds and CryptoPotato also reported the quarter as a record. Counts differ between outlets: a Crypto Briefing report headlined the quarter as a record 70 hacks totaling $746 million. Q2 2026 trails Q4 2020 (approximately $3.56 billion) in aggregate dollar terms. Year-to-date through late June 2026, CoinTribune counted 121 hacks with cumulative losses approaching $942 million. The two largest incidents of the quarter, KelpDAO ($292–293 million) and Drift Protocol ($280–295 million depending on the source), together accounted for roughly 75% of quarterly losses and were both attributed by blockchain intelligence firms to North Korean state-sponsored actors. Immunefi CEO Mitchell Amador publicly characterized the surge as a 'vulnerability apocalypse,' citing advances in AI-assisted exploit tooling as a contributing factor. The record incident count came against a backdrop of sharply reduced DeFi total value locked (see Market and TVL Impact).","heading":"Overview and Scale","sources":[{"url":"https://cointelegraph.com/news/q2-2026-most-hacked-quarter-record-83-incidents","name":"Q2 2026 Emerges as Most-Hacked Quarter on Record with 83 Incidents — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://blockchain.news/news/q2-2026-most-hacked-quarter","name":"Q2 2026 Breaks Record with 83 Crypto Hacks, $755M Stolen — Blockchain.news","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/q2-2026-sees-record-70-crypto-hacks-totaling-746m-in-losses/","name":"Q2 2026 sees record 70 crypto hacks totaling $746M in losses — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://financefeeds.com/q2-2026-records-highest-number-of-crypto-hacks/","name":"Q2 2026 Records Highest Number of Crypto Hacks Ever With 83 Incidents — FinanceFeeds","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/report-q2-2026-becomes-worst-quarter-ever-for-crypto-hacks/","name":"Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks — CryptoPotato","type":"news_article","credibility":2},{"url":"https://www.cointribune.com/en/121-crypto-hacks-billions-evaporated-defi-faces-its-worst-year-since-2022/","name":"121 Crypto Hacks, Billions Evaporated: DeFi Faces Its Worst Year Since 2022 — CoinTribune","type":"news_article","credibility":2},{"url":"https://memeburn.com/q2-2026-just-broke-the-record/","name":"Q2 2026 Just Broke the Record — Memeburn","type":"news_article","credibility":2},{"url":"https://whale-alert.io/stories/99c0016d98d195/Immunefi-CEO-says-new-AI-models-are-worsening-crypto-security-as-2026-hacks-and-DeFi-exploits-surge","name":"Immunefi CEO says new AI models are worsening crypto security — Whale Alert / Immunefi","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The largest DeFi exploit of Q2 2026 struck KelpDAO on April 18, 2026 at approximately 17:35 UTC. An attacker drained 116,500 rsETH — approximately 18% of the token's circulating supply, worth roughly $292–293 million — from KelpDAO's cross-chain bridge, which used LayerZero's OFT (Omnichain Fungible Token) messaging infrastructure. According to CoinDesk and a Chainalysis post-mortem, the attack exploited off-chain infrastructure rather than a smart-contract code flaw. The attacker allegedly compromised two RPC nodes that the bridge's LayerZero Decentralized Verifier Network (DVN) relied on to validate cross-chain messages, while a simultaneous distributed denial-of-service (DDoS) attack against uncompromised external RPC nodes forced the verifier to rely on the poisoned servers, which then approved the fraudulent transaction. The malicious node software reportedly self-destructed afterwards, destroying local logs and binaries. The critical enabling factor was a 1-of-1 DVN configuration: rsETH was secured by a single verifier, so one poisoned path was sufficient. KelpDAO's emergency multisig paused contracts approximately 46 minutes after the exploit, blocking two further attempted drains each estimated near $95–100 million. The exploit had cascading effects on Aave: the attacker deposited approximately 89,567 rsETH as collateral and borrowed roughly $190.86 million in wrapped Ether. Aave's oracle still valued rsETH at its pre-exploit rate, and by the time Aave froze rsETH markets an estimated $190 million in real Ether had been extracted — a second-order loss distinct from the bridge drain. The Arbitrum Security Council coordinated with law enforcement to freeze approximately $75 million of attacker funds on Arbitrum. Approximately $175 million of the stolen funds was reported converted to Bitcoin through intermediaries including the Umbra privacy tool. LayerZero initially placed responsibility for the configuration on KelpDAO (April 20, 2026); on May 5, 2026 KelpDAO publicly claimed LayerZero had approved the setup. On May 9, 2026 LayerZero acknowledged it 'made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions,' said it would no longer service 1-of-1 configurations, and migrated defaults to 5-of-5 or a minimum of 3-of-3 verification. KelpDAO moved its rsETH bridge to Chainlink, and Solv Protocol relocated over $700 million in tokenized Bitcoin infrastructure away from LayerZero. CoinDesk later framed the hack as forcing DeFi to adopt stricter bridge security standards.","heading":"KelpDAO Bridge Exploit ($292–293 Million, April 2026)","sources":[{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/04/19/the-usd292-million-kelp-exploit-how-it-happened-and-what-it-means-for-defi","name":"The $292 million Kelp crypto exploit: how it happened, and what it means for DeFi — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero Blames Kelp's Setup for $290M Exploit, Attributes It to North Korea's Lazarus — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp claims LayerZero approved the setup it blamed for $292M bridge hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","name":"The $293 million KelpDAO hack shows why DeFi is finally being forced to grow up — CoinDesk","type":"news_article","credibility":1},{"url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","name":"What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026 — KuCoin","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks — TRM Labs","type":"research","credibility":1}],"severity":"critical"},{"content":"On April 1, 2026, Drift Protocol, a Solana-based perpetuals and spot exchange, was drained in an attack lasting roughly 12 minutes. Reported loss figures differ: $285 million according to The Hacker News, TRM Labs and Shattered.io; $295 million in CoinDesk's recovery-plan coverage; and $280 million in a Cryptopolitan headline. The Hacker News, TRM Labs and Drift's own post-mortem describe the incident as the culmination of a roughly six-month social-engineering campaign attributed with medium confidence to UNC4736, a North Korean state-sponsored unit also tracked as AppleJeus, Citrine Sleet, Golden Chollima and Gleaming Pisces (see North Korean State-Actor Attribution for differing descriptions of its relation to TraderTraitor). There was no smart-contract code vulnerability. The alleged operation began in fall 2025, when operatives posing as representatives of a quantitative trading firm approached Drift contributors at crypto conferences in multiple countries. Between December 2025 and January 2026, the group formally onboarded an Ecosystem Vault on Drift, depositing more than $1 million of its own funds to establish credibility. Between February and March 2026, the attackers allegedly distributed malicious Microsoft Visual Studio Code projects with weaponized 'tasks.json' files and fake wallet applications via Apple TestFlight. The attackers allegedly convinced multisig signers to pre-sign hidden governance authorizations, then on April 1 pushed a zero-timelock governance migration that removed the protocol's review window and granted them administrative control. They also allegedly fabricated a worthless synthetic asset, CarbonVote Token, and manipulated Drift's price oracle into accepting it as collateral to borrow against. Perpetrators reportedly deleted all Telegram chats and malware evidence immediately after execution; Mandiant forensic investigators were engaged for attribution. Drift's native token ($DRIFT) declined more than 40% within hours. Approximately $3.36 million in USDC was frozen, and approximately 130,259 ETH (reported as roughly $31 million) remained traceable. The exploit ranked as the second-largest in Solana's history, behind the 2022 Wormhole hack. On May 5, 2026, Drift announced a recovery plan issuing recovery tokens representing $1 per dollar of verified loss, funded by remaining protocol assets ($3.8 million), performance-based Tether support (up to $127.5 million), partner contributions (up to $20 million) and future exchange revenue.","heading":"Drift Protocol Social-Engineering Exploit ($280–295 Million, April 2026)","sources":[{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News","type":"news_article","credibility":1},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks — TRM Labs","type":"research","credibility":1},{"url":"https://shattered.io/drift-protocol-hack-285m/","name":"Drift Protocol Hack: $285M Stolen in 12 Min — Shattered.io","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","name":"Drift outlines a recovery plan for users after $295 million DPRK-linked exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://news.bitcoin.com/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next/","name":"Drift Protocol Hack 2026: What Happened, Who Lost Money, and What's Next — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/experts-slam-drift-after-280m-hack/","name":"Crypto experts slam Drift Protocol after months-long hack drains $280M — Cryptopolitan","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Humanity Protocol, a biometric identity project using palm scans and zero-knowledge proofs, described as a Worldcoin competitor or 'Chinese Worldcoin' alternative, suffered a private-key compromise in June 2026. Accounts differ on the date of the attack: June 8, 2026 in one summary of CoinDesk and Halborn reporting, June 9, 2026 in another. According to CoinDesk, Halborn and a Quantstamp post-mortem, a Humanity Foundation team member received a phishing email impersonating South Korean exchange Bithumb; the malware it delivered compromised the employee's laptop, enabling theft of MetaMask credentials and private keys. CoinDesk reported that the laptop held multiple bridge admin keys on a single device — three of six Ethereum multisig keys and three of five BNB Chain multisig keys. Using these keys, the attacker allegedly upgraded Humanity's Ethereum bridge to a malicious implementation and deployed an unlimited-mint function on BNB Smart Chain; approximately 141 million H tokens were drained from the Ethereum bridge and approximately 200 million additional H tokens were minted on BNB Chain. A separate account reports that approximately 17 project-controlled wallets were drained and puts the total unique impact at approximately 447 million $H tokens. Loss estimates vary: CoinDesk reported $32 million in one article and $36 million in another; CCN, CoinTelegraph and Crypto Briefing reported up to $36 million; Cryptonomist reported approximately $30 million. The attacker swapped most stolen tokens for ETH via DEXs, and the H token fell an estimated 80–90% within about 12 hours. Quantstamp attributed the malware used to North Korean threat actors. Humanity Protocol announced a token swap program beginning June 17, 2026 to compensate affected holders.","heading":"Humanity Protocol Private-Key Compromise ($30–36 Million, June 2026)","sources":[{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-s-usd36-million-exploit-happened-because-a-multisig-wallet-lived-on-one-laptop","name":"Humanity's $36 million exploit happened because a 'multisig' lived on one laptop — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","name":"Humanity Protocol token crashes more than 80% after a $32 million private-key hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026","name":"Explained: The Humanity Protocol Hack (June 2026) — Halborn","type":"research","credibility":2},{"url":"https://cryptobriefing.com/humanity-protocol-36m-hack-north-korean-hackers/","name":"Humanity Protocol's $36M hack linked to suspected North Korean hackers — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://en.cryptonomist.ch/2026/06/17/36-million-exploit-humanity-protocol-token-swap-begins/","name":"$36 million exploit: Humanity Protocol token swap begins — Cryptonomist","type":"news_article","credibility":2},{"url":"https://www.ccn.com/education/crypto/humanity-protocol-private-key-hack-36m-h-token-crash/","name":"'Chinese Worldcoin' Crashes 85% After $36 Million+ Private Key Hack — CCN","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/humanity-protocol-token-crashes-88-024154068.html","name":"Humanity Protocol Token Crashes 88% Following Private Key Breach — Yahoo Finance","type":"news_article","credibility":2}],"severity":"high"},{"content":"On May 15, 2026, THORChain, a decentralized cross-chain liquidity protocol, halted trading after approximately $10.7–11 million was drained from one of its five Asgard vaults across at least nine networks, including Bitcoin, Ethereum, BNB Chain, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash and XRP. According to THORChain's official exploit report and coverage by CoinDesk, The Block and TRM Labs, the attacker was a newly churned node operator that had joined the network about two days earlier. Through routine GG20 threshold signature scheme (TSS) operations it allegedly accumulated enough key material to reconstruct the private key for a single vault, then bypassed the normal approval process to authorize direct outbound withdrawals. THORChain's automated solvency checker, which monitors for more than 1% imbalance in vault balances, flagged the breach within minutes and halted trading, signing and churning without human intervention. Reports differ on the halt's length: the global emergency halt lasted approximately 12 hours and 42 minutes per one account, while Crypto Briefing reported that trading resumed after a five-week halt. The attacker's wallets held roughly 3,443 ETH, 36.85 BTC and 96.6 BNB after the exploit. RUNE fell approximately 12–15%. The protocol covered the $10.7 million loss from protocol-owned liquidity reserves, avoiding RUNE supply inflation. TRM Labs had separately documented North Korean laundering of funds from the April Drift and KelpDAO exploits through THORChain's cross-chain infrastructure.","heading":"THORChain Asgard Vault Exploit ($10.7–11 Million, May 2026)","sources":[{"url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","name":"Thorchain halts trading after $10 million cross-chain exploit, RUNE token drops 12% — CoinDesk","type":"news_article","credibility":1},{"url":"https://blog.thorchain.org/thorchain-exploit-report-1","name":"THORChain Exploit Report #1 — THORChain Official Blog","type":"official","credibility":2},{"url":"https://www.theblock.co/amp/post/401462/thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit","name":"THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit — The Block","type":"news_article","credibility":1},{"url":"https://cryptobriefing.com/thorchain-resumes-trading-after-exploit/","name":"THORChain resumes trading after five-week halt following $10.7M exploit — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","name":"THORChain Exploit Drains USD 11M+ Across at Least Nine Chains — TRM Labs","type":"research","credibility":1},{"url":"https://memeburn.com/thorchain-asgard-vault-exploit-crashes-rune-may-2026/","name":"THORChain Asgard Vault Exploit Drains $10M, Crashes $RUNE 15% — Memeburn","type":"news_article","credibility":2}],"severity":"high"},{"content":"Beyond the major exploits, numerous smaller incidents contributed to the record count. Two exploits on abandoned Aztec Connect smart contracts caused losses of approximately $2.1 million and $1.3 million; the protocol had been deprecated but its contracts still held residual funds. Raydium, a Solana-based DEX, reported a $1.3 million exploit in June 2026, and Taiko, a ZK-rollup bridge, suffered an estimated $1.7 million loss. The quarter also saw concurrent non-crypto cybersecurity incidents, including tens of thousands of Fortinet firewall compromises and 772 ransomware victims recorded in April alone. The altfins analysis characterized the pattern of smaller, more frequent attacks as attackers diversifying target selection rather than concentrating only on large-TVL protocols.","heading":"Other Notable Incidents","sources":[{"url":"https://blockchain.news/news/q2-2026-most-hacked-quarter","name":"Q2 2026 Breaks Record with 83 Crypto Hacks, $755M Stolen — Blockchain.news","type":"news_article","credibility":2},{"url":"https://www.cryptobreaking.com/q2-2026-becomes-record-breaking/","name":"Q2 2026 Becomes Record-Breaking Most-Hacked Quarter with 83 Incidents — CryptoBreaking","type":"news_article","credibility":2},{"url":"https://altfins.com/blog/defi-hacks-2026/","name":"DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything — Altfins","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Cross-chain bridges were the largest attack surface in Q2 2026, accounting for approximately $351 million of losses across 14 reported bridge exploits. Reports differ slightly on the share: about 47% of quarterly losses per one summary of CoinTelegraph and Blockchain.news data, nearly 46% per another. The KelpDAO exploit alone accounted for roughly 38% of the quarter's stolen value. Per Blockchain.news and CoinTelegraph, compromised administrator accounts and token price manipulation accounted for approximately 37% of losses and private key theft for about 5.66%, with smart-contract logic flaws accounting for the remainder. Across 2026 as a whole, altfins reported that 72% of losses came from stolen keys and credential theft rather than code vulnerabilities. Bridges have accumulated an estimated $2.8 billion in cumulative losses since 2022, about 40% of all value ever hacked in Web3, according to Memeburn and other secondary analyses; bridge TVL was approximately $21.94 billion as of March 2026. Analysts described a tactical shift away from smart-contract bugs toward attacks on off-chain infrastructure (KelpDAO's RPC poisoning and 1-of-1 verifier), multi-month social engineering of multisig signers and core contributors (Drift), and phishing-driven key compromise (Humanity Protocol). altfins and the thirdweb blog characterized this as attackers recognizing that 'the code layer has become harder to crack' and moving to the 'human layer.' Practitioners said operational security, personnel vetting, multi-party authorization design and verifier configuration have become as critical as smart-contract audits. Several security firms, and Immunefi's vulnerability scoreboard and CEO commentary, flagged AI-assisted exploitation and vulnerability discovery as an emerging factor in rising incident frequency and sophistication.","heading":"Attack Vectors: Bridges and Human-Layer Compromise","sources":[{"url":"https://blockchain.news/news/q2-2026-most-hacked-quarter","name":"Q2 2026 Breaks Record with 83 Crypto Hacks, $755M Stolen — Blockchain.news","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/q2-2026-most-hacked-quarter-record-83-incidents","name":"Q2 2026 Emerges as Most-Hacked Quarter on Record with 83 Incidents — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://altfins.com/blog/defi-hacks-2026/","name":"DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything — Altfins","type":"news_article","credibility":2},{"url":"https://blog.thirdweb.com/defi-lost-840-million-in-2026-so-far-heres-what-builders-need-to-know-about-the-security-crisis/","name":"DeFi Security Crisis 2026: $840M Lost, AI Exploits and What Builders Must Know — Thirdweb Blog","type":"research","credibility":2},{"url":"https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","name":"Every Major DeFi Hack in 2026 So Far: Bridge Exploits Dominate — Phemex","type":"news_article","credibility":2},{"url":"https://1inch.com/blog/post/the-biggest-bridge-hacks-in-2026","name":"The biggest bridge hacks in 2026 — 1inch Blog","type":"research","credibility":2},{"url":"https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","name":"Top Crypto Hacks of 2026: Bridge Exploits and Sophisticated Operations Drive Over $750 Million in Losses — KuCoin Blog","type":"news_article","credibility":2},{"url":"https://immunefi.com/blog/research/the-ecosystem-vulnerability-scoreboard-6-years-of-defi-loss-data/","name":"The Ecosystem Vulnerability Scoreboard: 6 Years of DeFi Loss Data — Immunefi","type":"research","credibility":2}],"severity":"critical"},{"content":"TRM Labs reported (April 21, 2026) that North Korean state-sponsored actors captured approximately $577 million — 76% of all tracked crypto hack value in 2026 through April — via just two attacks: Drift Protocol ($285 million) and KelpDAO ($292 million). Accounts of TRM's attribution describe the group differently: one says TRM attributed the Drift attack to UNC4736 (AppleJeus, Citrine Sleet, Golden Chollima, Gleaming Pisces) and described it as distinct from the better-known TraderTraitor Lazarus subgroup; another says both attacks were attributed with medium confidence to the Lazarus Group and its TraderTraitor subunit, tracked by Mandiant as UNC4736. LayerZero attributed the KelpDAO exploit with preliminary confidence to Lazarus and TraderTraitor on April 20, 2026. TraderTraitor is described as targeting crypto-industry employees through social engineering, fake recruiter pitches, malware-laced pre-employment tests and compromise of wallet and administrative systems. KelpDAO attribution relied on on-chain analysis of pre-funding wallets and post-hack laundering flows; funding wallets were traced to Wu Huihui, a Chinese crypto broker previously indicted (in 2023) for laundering Lazarus proceeds. Quantstamp attributed the Humanity Protocol malware to North Korean actors. Monthly totals vary by source: a KuCoin news note stated Lazarus actors stole $635 million from crypto protocols in April 2026, while IndexBox estimated April losses at $606–651 million. Laundering reportedly used intermediary wallets, DEX swaps, cross-chain bridges (including THORChain for ETH-to-BTC conversion), no-KYC swap services, the Umbra privacy tool and Chinese intermediary networks — patterns Chainalysis described as consistent with prior DPRK operations such as the February 2025 Bybit hack. About $75 million in KelpDAO proceeds was frozen on Arbitrum; Drift proceeds remained largely dormant as of reporting. Per TRM Labs data, North Korea's share of annual global crypto hack losses rose from about 10% in 2020–2021 to 22% (2022), 37% (2023), 39% (2024), 64% (2025) and 76% through Q2 2026. DPRK-linked actors stole $2.02 billion in 2025, a 51% year-on-year increase. Estimates of cumulative DPRK theft since 2017 differ: more than $6 billion before the Q2 incidents in one account, more than $6.75 billion in another. CryptoTimes linked KelpDAO to a broader Lazarus history including Bybit and Ronin.","heading":"North Korean State-Actor Attribution and Laundering","sources":[{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks — TRM Labs","type":"research","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero Blames Kelp's Setup for $290M Exploit, Attributes It to North Korea's Lazarus — CoinDesk","type":"news_article","credibility":1},{"url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","name":"What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026 — KuCoin","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/north-korean-lazarus-group-steals-635m-from-crypto-protocols-in-april-2026","name":"North Korean Lazarus Group steals $635 million from crypto protocols in April 2026 — KuCoin","type":"news_article","credibility":2},{"url":"https://www.indexbox.io/blog/crypto-losses-exceed-606m-in-april-2026-due-to-hacks-linked-to-lazarus-group/","name":"Crypto Hacks in April 2026: $606M Lost, DeFi Exodus — IndexBox","type":"news_article","credibility":2},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"The Lazarus Group and DPRK Crypto Theft in 2026: What Compliance Teams Need to Know — Sanctions.io","type":"research","credibility":2},{"url":"https://yellow.com/research/lazarus-kelp-hack-north-korea-crypto-heists","name":"Lazarus And The Kelp Hack: How North Korea's Crypto Heists Evolved — Yellow Research","type":"research","credibility":2},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1},{"url":"https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","name":"KelpDAO, Bybit, Ronin: Lazarus Group's Crypto Hacks Behind a $7.3B Heist Empire — CryptoTimes","type":"news_article","credibility":2}],"severity":"critical"},{"content":"On March 12, 2026 — weeks before the Q2 attacks — the U.S. Treasury's OFAC designated six individuals and two entities for facilitating North Korea's IT worker program, which had generated nearly $800 million in 2024 to fund DPRK weapons programs. The Lazarus Group itself was sanctioned by the U.S. Treasury in 2019. The SEC and CFTC issued a joint interpretation of federal securities laws as applied to crypto assets in March 2026 and signed a memorandum of understanding on regulatory harmonization the same month. No targeted enforcement actions arising specifically from Q2 2026 DeFi hacks had been publicly reported as of late June 2026. The incidents prompted industry discussion of cross-chain bridge security standards, DVN configuration requirements for LayerZero integrations and multisig key management. Chainalysis noted that after Tornado Cash, DPRK-linked actors shifted laundering to alternative mixers, peer-to-peer transactions in jurisdictions outside U.S. reach and privacy-coin conversions.","heading":"Sanctions and Regulatory Context","sources":[{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis Blog","type":"regulatory","credibility":1},{"url":"https://home.treasury.gov/news/press-releases/sm774","name":"Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups — U.S. Treasury","type":"regulatory","credibility":1},{"url":"https://www.fintechanddigitalassets.com/2026/03/sec-and-cftc-sign-landmark-memorandum-of-understanding-on-regulatory-harmonization/","name":"SEC and CFTC Sign Landmark Memorandum of Understanding on Regulatory Harmonization — Fintech and Digital Assets Blog","type":"regulatory","credibility":2},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"The Lazarus Group and DPRK Crypto Theft in 2026: What Compliance Teams Need to Know — Sanctions.io","type":"research","credibility":2},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1}],"severity":"medium"},{"content":"The hack wave coincided with a sustained DeFi TVL decline. CoinTelegraph, Crypto Economy and Yahoo Finance data show TVL falling about 39% from approximately $115 billion in January 2026 to about $70 billion by late June; another account measures from a 2021 peak of approximately $164 billion to roughly $71–73 billion by mid-2026, meaning the quarter's losses represented a higher share of available TVL than a nominally larger figure would have in 2021. Aave's TVL dropped from $26.4 billion to $14.3 billion after the KelpDAO exploit. Aave, SparkLend, Fluid and other major protocols paused rsETH markets over collateral exposure, and Lido Finance paused deposits in its earnETH product due to rsETH backing risk. ECIKS and CoinTribune reported roughly $14 billion withdrawn from DeFi lending platforms in the weeks after the major April incidents. Total crypto market capitalization fell from roughly $4.21 trillion to approximately $2.15 trillion between its 2026 peak and trough, per Yahoo Finance data. The Drift exploit affected Solana DeFi, and RUNE fell 12–15% after THORChain's own May exploit. Researchers at The Block noted that shrinking TVL reduced the target pool but did not meaningfully reduce incident frequency, suggesting improved attacker capability rather than expanding targets. Coverage described a broader loss of institutional and retail confidence in cross-chain bridge infrastructure.","heading":"Market and TVL Impact","sources":[{"url":"https://cointelegraph.com/news/defi-tvl-falls-39-2026-erases-45b-value","name":"DeFi TVL Down by $45B in 2026 Despite More Resilient Market Structure — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://crypto-economy.com/defi-tvl-falls-39-ytd-to-70b-as-exploits-and-market-slump-weigh-on-sector/","name":"DeFi TVL Falls 39% YTD to $70B — Crypto Economy","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/defi-total-value-locked-slides-072657247.html","name":"DeFi Total Value Locked Slides Every Month in 2026 to $70 Billion — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://memeburn.com/q2-2026-just-broke-the-record/","name":"Q2 2026 Just Broke the Record — Memeburn","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains — CoinDesk","type":"news_article","credibility":1},{"url":"https://eciks.org/10177-66183-decentralized-finance-investor-exodus-14-billion","name":"Nearly $14 billion withdrawn from DeFi sector following high-profile cyberattacks — ECIKS","type":"news_article","credibility":3},{"url":"https://www.cointribune.com/en/121-crypto-hacks-billions-evaporated-defi-faces-its-worst-year-since-2022/","name":"121 Crypto Hacks, Billions Evaporated: DeFi Faces Its Worst Year Since 2022 — CoinTribune","type":"news_article","credibility":2},{"url":"https://www.theblock.co/data/decentralized-finance/exploits","name":"DeFi Hacks and Recoveries Data — The Block","type":"research","credibility":1},{"url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","name":"Thorchain halts trading after $10 million cross-chain exploit, RUNE token drops 12% — CoinDesk","type":"news_article","credibility":1}],"severity":"high"}],"timeline":[{"date":"2025-09","event":"Alleged start of a multi-month North Korean social-engineering campaign against Drift Protocol contributors, with operatives posing as quantitative trading firm representatives at crypto conferences.","source":"The Hacker News / Mandiant","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2025-12","event":"Operatives formally onboard an Ecosystem Vault on Drift Protocol, depositing over $1 million to establish credibility.","source":"The Hacker News / Mandiant","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2026-02","event":"Drift attack operatives allegedly begin distributing malicious Visual Studio Code projects and fake wallet apps via Apple TestFlight to targeted contributors.","source":"The Hacker News / Mandiant","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2026-03","event":"U.S. Treasury OFAC designates six individuals and two entities (March 12) for facilitating North Korean IT worker schemes that generated nearly $800 million in 2024.","source":"Chainalysis / OFAC","source_url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/"},{"date":"2026-04","event":"Drift Protocol drained (April 1) of approximately $285–295 million in about 12 minutes via a zero-timelock governance migration and CarbonVote Token oracle manipulation; attributed with medium confidence to North Korea's UNC4736.","source":"The Hacker News / TRM Labs / CoinDesk","source_url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html"},{"date":"2026-04","event":"KelpDAO bridge exploited (April 18, ~17:35 UTC) for approximately $292–293 million via poisoned RPC nodes and a DDoS against a 1-of-1 LayerZero verifier setup; contracts paused 46 minutes later; Aave suffers roughly $190 million in secondary losses before freezing rsETH markets.","source":"CoinDesk / Chainalysis","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04","event":"LayerZero (April 20) attributes the KelpDAO exploit with preliminary confidence to Lazarus Group / TraderTraitor and places configuration responsibility on KelpDAO.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04","event":"TRM Labs (April 21) reports North Korean actors took about $577 million in two attacks, 76% of all 2026 crypto hack losses to date.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"date":"2026-04","event":"April 2026 closes as the month with the highest crypto hack losses ever recorded, estimated at $606–651 million across about 30 incidents.","source":"IndexBox / Yahoo Finance","source_url":"https://www.indexbox.io/blog/crypto-losses-exceed-606m-in-april-2026-due-to-hacks-linked-to-lazarus-group/"},{"date":"2026-05","event":"Drift Protocol (May 5) outlines a recovery plan: recovery tokens at $1 per dollar of verified loss, backed by protocol assets, Tether support (up to $127.5 million), partner contributions (up to $20 million) and future revenue.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit"},{"date":"2026-05","event":"KelpDAO (May 5) publicly claims LayerZero had approved the single-verifier setup that was exploited.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05","event":"LayerZero (May 9) admits it 'made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and moves to minimum 3-of-3 or 5-of-5 verifier configurations.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-05","event":"THORChain (May 15) halts trading after approximately $10.7–11 million is drained from one Asgard vault across at least nine chains by a newly churned node operator exploiting GG20 TSS; RUNE drops 12–15%.","source":"CoinDesk / The Block / TRM Labs","source_url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12"},{"date":"2026-05","event":"CoinDesk (May 16) publishes analysis of the KelpDAO hack and its implications for DeFi bridge security standards.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up"},{"date":"2026-06","event":"Humanity Protocol suffers a phishing-driven private-key compromise (dated June 8 or June 9 depending on source); $30–36 million taken and H token falls 80–90%.","source":"CoinDesk / Halborn","source_url":"https://www.coindesk.com/tech/2026/06/09/humanity-s-usd36-million-exploit-happened-because-a-multisig-wallet-lived-on-one-laptop"},{"date":"2026-06","event":"Humanity Protocol begins a token swap program (June 17) to compensate holders affected by the exploit.","source":"Cryptonomist","source_url":"https://en.cryptonomist.ch/2026/06/17/36-million-exploit-humanity-protocol-token-swap-begins/"},{"date":"2026-06","event":"DeFi TVL reported at approximately $70 billion (June 24), a 39% decline year-to-date from about $115 billion in January.","source":"CoinTelegraph / Yahoo Finance","source_url":"https://cointelegraph.com/news/defi-tvl-falls-39-2026-erases-45b-value"},{"date":"2026-06","event":"Reports confirm Q2 2026 as the most-hacked quarter on record by incident count, with 83 incidents and approximately $755.3 million in losses.","source":"Memeburn / CoinTelegraph / Blockchain.news","source_url":"https://memeburn.com/q2-2026-just-broke-the-record/"}],"sources_used":[{"url":"https://cointelegraph.com/news/q2-2026-most-hacked-quarter-record-83-incidents","name":"Q2 2026 Emerges as Most-Hacked Quarter on Record with 83 Incidents — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260704040129/https://cointelegraph.com/news/q2-2026-most-hacked-quarter-record-83-incidents","credibility":2,"archive_timestamp":"2026-07-04T04:01:29+00:00"},{"url":"https://blockchain.news/news/q2-2026-most-hacked-quarter","name":"Q2 2026 Breaks Record with 83 Crypto Hacks, $755M Stolen — Blockchain.news","type":"news_article","archive_url":"http://web.archive.org/web/20261013032141/https://blockchain.news/news/q2-2026-most-hacked-quarter","credibility":2,"archive_timestamp":"2026-10-13T03:21:41+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260804014915/https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","credibility":1,"archive_timestamp":"2026-08-04T01:49:15+00:00"},{"url":"https://www.coindesk.com/business/2026/04/19/the-usd292-million-kelp-exploit-how-it-happened-and-what-it-means-for-defi","name":"The $292 million Kelp crypto exploit: how it happened, and what it means for DeFi — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260422180732/https://www.coindesk.com/business/2026/04/19/the-usd292-million-kelp-exploit-how-it-happened-and-what-it-means-for-defi","credibility":1,"archive_timestamp":"2026-04-22T18:07:32+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","name":"The $293 million KelpDAO hack shows why DeFi is finally being forced to grow up — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526034615/https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","credibility":1,"archive_timestamp":"2026-05-26T03:46:15+00:00"},{"url":"https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","name":"$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260714204042/https://thehackernews.com/2026/04/285-million-drift-hack-traced-to-six.html","credibility":1,"archive_timestamp":"2026-07-14T20:40:42+00:00"},{"url":"https://shattered.io/drift-protocol-hack-285m/","name":"Drift Protocol Hack: $285M Stolen in 12 Min — Shattered.io","type":"news_article","archive_url":"http://web.archive.org/web/20261014092151/https://shattered.io/drift-protocol-hack-285m/","credibility":2,"archive_timestamp":"2026-10-14T09:21:51+00:00"},{"url":"https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","name":"Drift outlines a recovery plan for users after $295 million DPRK-linked exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260726100333/https://www.coindesk.com/business/2026/05/05/drift-outlines-a-recovery-plan-for-users-after-usd295-million-dprk-linked-exploit","credibility":1,"archive_timestamp":"2026-07-26T10:03:33+00:00"},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"North Korea Stole 76% of All Crypto Hack Value in 2026 With Just Two Attacks — TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260719135758/https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","credibility":1,"archive_timestamp":"2026-07-19T13:57:58+00:00"},{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-s-usd36-million-exploit-happened-because-a-multisig-wallet-lived-on-one-laptop","name":"Humanity's $36 million exploit happened because a 'multisig' lived on one laptop — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260718095540/https://www.coindesk.com/tech/2026/06/09/humanity-s-usd36-million-exploit-happened-because-a-multisig-wallet-lived-on-one-laptop","credibility":1,"archive_timestamp":"2026-07-18T09:55:40+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026","name":"Explained: The Humanity Protocol Hack (June 2026) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260718095540/https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026","credibility":2,"archive_timestamp":"2026-07-18T09:55:40+00:00"},{"url":"https://cryptobriefing.com/humanity-protocol-36m-hack-north-korean-hackers/","name":"Humanity Protocol's $36M hack linked to suspected North Korean hackers — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20261013024255/https://cryptobriefing.com/humanity-protocol-36m-hack-north-korean-hackers/","credibility":2,"archive_timestamp":"2026-10-13T02:42:55+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","name":"Thorchain halts trading after $10 million cross-chain exploit, RUNE token drops 12% — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260522045745/https://www.coindesk.com/tech/2026/05/15/thorchain-halts-trading-after-usd10-million-cross-chain-exploit-rune-token-drops-12","credibility":1,"archive_timestamp":"2026-05-22T04:57:45+00:00"},{"url":"https://blog.thorchain.org/thorchain-exploit-report-1","name":"THORChain Exploit Report #1 — THORChain Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260716110130/https://blog.thorchain.org/thorchain-exploit-report-1","credibility":2,"archive_timestamp":"2026-07-16T11:01:30+00:00"},{"url":"https://www.theblock.co/amp/post/401462/thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit","name":"THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260516025804/https://www.theblock.co/amp/post/401462/thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit","credibility":1,"archive_timestamp":"2026-05-16T02:58:04+00:00"},{"url":"https://www.cointribune.com/en/121-crypto-hacks-billions-evaporated-defi-faces-its-worst-year-since-2022/","name":"121 Crypto Hacks, Billions Evaporated: DeFi Faces Its Worst Year Since 2022 — CoinTribune","type":"news_article","archive_url":"https://web.archive.org/web/20260727010716/https://www.cointribune.com/en/121-crypto-hacks-billions-evaporated-defi-faces-its-worst-year-since-2022/","credibility":2,"archive_timestamp":"2026-07-27T01:07:16+00:00"},{"url":"https://altfins.com/blog/defi-hacks-2026/","name":"DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything — Altfins","type":"news_article","archive_url":"https://web.archive.org/web/20260727045534/https://altfins.com/blog/defi-hacks-2026/","credibility":2,"archive_timestamp":"2026-07-27T04:55:34+00:00"},{"url":"https://crypto-economy.com/defi-tvl-falls-39-ytd-to-70b-as-exploits-and-market-slump-weigh-on-sector/","name":"DeFi TVL Falls 39% YTD to $70B — Crypto Economy","type":"news_article","archive_url":"http://web.archive.org/web/20260625214927/https://crypto-economy.com/defi-tvl-falls-39-ytd-to-70b-as-exploits-and-market-slump-weigh-on-sector/","credibility":2,"archive_timestamp":"2026-06-25T21:49:27+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/defi-total-value-locked-slides-072657247.html","name":"DeFi Total Value Locked Slides Every Month in 2026 to $70 Billion — Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20260727171112/https://finance.yahoo.com/markets/crypto/articles/defi-total-value-locked-slides-072657247.html","credibility":2,"archive_timestamp":"2026-07-27T17:11:12+00:00"},{"url":"https://cointelegraph.com/news/defi-tvl-falls-39-2026-erases-45b-value","name":"DeFi TVL Down by $45B in 2026 Despite More Resilient Market Structure — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260709214734/https://cointelegraph.com/news/defi-tvl-falls-39-2026-erases-45b-value","credibility":2,"archive_timestamp":"2026-07-09T21:47:34+00:00"},{"url":"https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","name":"The Lazarus Group and DPRK Crypto Theft in 2026: What Compliance Teams Need to Know — Sanctions.io","type":"research","archive_url":"http://web.archive.org/web/20260727140815/https://www.sanctions.io/blog/the-lazarus-group-and-dprk-crypto-theft-in-2026","credibility":2,"archive_timestamp":"2026-07-27T14:08:15+00:00"},{"url":"https://www.kucoin.com/news/flash/north-korean-lazarus-group-steals-635m-from-crypto-protocols-in-april-2026","name":"North Korean Lazarus Group steals $635 million from crypto protocols in April 2026 — KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260727013619/https://www.kucoin.com/news/flash/north-korean-lazarus-group-steals-635m-from-crypto-protocols-in-april-2026","credibility":2,"archive_timestamp":"2026-07-27T01:36:19+00:00"},{"url":"https://www.indexbox.io/blog/crypto-losses-exceed-606m-in-april-2026-due-to-hacks-linked-to-lazarus-group/","name":"Crypto Hacks in April 2026: $606M Lost, DeFi Exodus — IndexBox","type":"news_article","archive_url":"https://web.archive.org/web/20260727012951/https://www.indexbox.io/blog/crypto-losses-exceed-606m-in-april-2026-due-to-hacks-linked-to-lazarus-group/","credibility":2,"archive_timestamp":"2026-07-27T01:29:51+00:00"},{"url":"https://www.theblock.co/data/decentralized-finance/exploits","name":"DeFi Hacks and Recoveries Data — The Block","type":"research","archive_url":"http://web.archive.org/web/20260506133429/https://www.theblock.co/data/decentralized-finance/exploits","credibility":1,"archive_timestamp":"2026-05-06T13:34:29+00:00"},{"url":"https://www.fintechanddigitalassets.com/2026/03/sec-and-cftc-sign-landmark-memorandum-of-understanding-on-regulatory-harmonization/","name":"SEC and CFTC Sign Landmark Memorandum of Understanding on Regulatory Harmonization — Fintech and Digital Assets Blog","type":"regulatory","archive_url":"http://web.archive.org/web/20260606073604/https://www.fintechanddigitalassets.com/2026/03/sec-and-cftc-sign-landmark-memorandum-of-understanding-on-regulatory-harmonization/","credibility":2,"archive_timestamp":"2026-06-06T07:36:04+00:00"},{"url":"https://cryptobriefing.com/q2-2026-sees-record-70-crypto-hacks-totaling-746m-in-losses/","name":"Q2 2026 sees record 70 crypto hacks totaling $746M in losses — Crypto Briefing","type":"news_article","archive_url":"https://web.archive.org/web/20260726234401/https://cryptobriefing.com/q2-2026-sees-record-70-crypto-hacks-totaling-746m-in-losses/","credibility":2,"archive_timestamp":"2026-07-26T23:44:01+00:00"},{"url":"https://financefeeds.com/q2-2026-records-highest-number-of-crypto-hacks/","name":"Q2 2026 Records Highest Number of Crypto Hacks Ever With 83 Incidents — FinanceFeeds","type":"news_article","archive_url":"https://web.archive.org/web/20260728041706/https://financefeeds.com/q2-2026-records-highest-number-of-crypto-hacks/","credibility":2,"archive_timestamp":"2026-07-28T04:17:06+00:00"},{"url":"https://en.cryptonomist.ch/2026/06/17/36-million-exploit-humanity-protocol-token-swap-begins/","name":"$36 million exploit: Humanity Protocol token swap begins — Cryptonomist","type":"news_article","archive_url":"https://web.archive.org/web/20260727000053/https://en.cryptonomist.ch/2026/06/17/36-million-exploit-humanity-protocol-token-swap-begins/","credibility":2,"archive_timestamp":"2026-07-27T00:00:53+00:00"},{"url":"https://cryptobriefing.com/thorchain-resumes-trading-after-exploit/","name":"THORChain resumes trading after five-week halt following $10.7M exploit — Crypto Briefing","type":"news_article","archive_url":"https://web.archive.org/web/20260727052740/https://cryptobriefing.com/thorchain-resumes-trading-after-exploit/","credibility":2,"archive_timestamp":"2026-07-27T05:27:40+00:00"},{"url":"https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","name":"What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026 — KuCoin","type":"news_article","archive_url":"http://web.archive.org/web/20261023193949/https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","credibility":2,"archive_timestamp":"2026-10-23T19:39:49+00:00"},{"url":"https://blog.thirdweb.com/defi-lost-840-million-in-2026-so-far-heres-what-builders-need-to-know-about-the-security-crisis/","name":"DeFi Security Crisis 2026: $840M Lost, AI Exploits and What Builders Must Know — Thirdweb Blog","type":"research","archive_url":"http://web.archive.org/web/20261023193317/https://blog.thirdweb.com/defi-lost-840-million-in-2026-so-far-heres-what-builders-need-to-know-about-the-security-crisis/","credibility":2,"archive_timestamp":"2026-10-23T19:33:17+00:00"},{"url":"https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","name":"Every Major DeFi Hack in 2026 So Far: Bridge Exploits Dominate — Phemex","type":"news_article","archive_url":"http://web.archive.org/web/20261021082652/https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained","credibility":2,"archive_timestamp":"2026-10-21T08:26:52+00:00"},{"url":"https://yellow.com/research/lazarus-kelp-hack-north-korea-crypto-heists","name":"Lazarus And The Kelp Hack: How North Korea's Crypto Heists Evolved — Yellow Research","type":"research","archive_url":"http://web.archive.org/web/20261023193720/https://yellow.com/research/lazarus-kelp-hack-north-korea-crypto-heists","credibility":2,"archive_timestamp":"2026-10-23T19:37:20+00:00"},{"url":"https://eciks.org/10177-66183-decentralized-finance-investor-exodus-14-billion","name":"Nearly $14 billion withdrawn from DeFi sector following high-profile cyberattacks — ECIKS","type":"news_article","archive_url":"http://web.archive.org/web/20261023193658/https://eciks.org/10177-66183-decentralized-finance-investor-exodus-14-billion","credibility":3,"archive_timestamp":"2026-10-23T19:36:58+00:00"},{"url":"https://www.cryptobreaking.com/q2-2026-becomes-record-breaking/","name":"Q2 2026 Becomes Record-Breaking Most-Hacked Quarter with 83 Incidents — CryptoBreaking","type":"news_article","archive_url":"http://web.archive.org/web/20261023193814/https://www.cryptobreaking.com/q2-2026-becomes-record-breaking/","credibility":2,"archive_timestamp":"2026-10-23T19:38:14+00:00"},{"url":"https://cryptopotato.com/report-q2-2026-becomes-worst-quarter-ever-for-crypto-hacks/","name":"Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks — CryptoPotato","type":"news_article","archive_url":"https://web.archive.org/web/20260726235005/https://cryptopotato.com/report-q2-2026-becomes-worst-quarter-ever-for-crypto-hacks/","credibility":2,"archive_timestamp":"2026-07-26T23:50:05+00:00"},{"url":"https://memeburn.com/q2-2026-just-broke-the-record/","name":"Q2 2026 Just Broke the Record — Memeburn","type":"news_article","archive_url":"http://web.archive.org/web/20260628110748/https://memeburn.com/q2-2026-just-broke-the-record/","credibility":2,"archive_timestamp":"2026-06-28T11:07:48+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero Blames Kelp's Setup for $290M Exploit, Attributes It to North Korea's Lazarus — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526220018/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-05-26T22:00:18+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp claims LayerZero approved the setup it blamed for $292M bridge hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260801083712/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-08-01T08:37:12+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260724213636/https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","credibility":1,"archive_timestamp":"2026-07-24T21:36:36+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Yahoo Finance","type":"news_article","archive_url":"https://web.archive.org/web/20260727000436/https://finance.yahoo.com/markets/crypto/articles/layerzero-pins-292m-kelpdao-bridge-113544792.html","credibility":2,"archive_timestamp":"2026-07-27T00:04:36+00:00"},{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis Blog","type":"regulatory","archive_url":"http://web.archive.org/web/20260420025036/https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","credibility":1,"archive_timestamp":"2026-04-20T02:50:36+00:00"},{"url":"https://home.treasury.gov/news/press-releases/sm774","name":"Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups — U.S. Treasury","type":"regulatory","archive_url":"http://web.archive.org/web/20260604214628/https://home.treasury.gov/news/press-releases/sm774","credibility":1,"archive_timestamp":"2026-06-04T21:46:28+00:00"},{"url":"https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","name":"Humanity Protocol token crashes more than 80% after a $32 million private-key hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260610155427/https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack","credibility":1,"archive_timestamp":"2026-06-10T15:54:27+00:00"},{"url":"https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","name":"THORChain Exploit Drains USD 11M+ Across at Least Nine Chains — TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260528032535/https://www.trmlabs.com/resources/blog/thorchain-exploit-drains-usd-11m-across-at-least-nine-chains-what-trm-knows-now","credibility":1,"archive_timestamp":"2026-05-28T03:25:35+00:00"},{"url":"https://immunefi.com/blog/research/the-ecosystem-vulnerability-scoreboard-6-years-of-defi-loss-data/","name":"The Ecosystem Vulnerability Scoreboard: 6 Years of DeFi Loss Data — Immunefi","type":"research","archive_url":"https://web.archive.org/web/20260727055033/https://immunefi.com/blog/research/the-ecosystem-vulnerability-scoreboard-6-years-of-defi-loss-data/","credibility":2,"archive_timestamp":"2026-07-27T05:50:33+00:00"},{"url":"https://nftplazas.com/crypto-hack-statistics/","name":"Crypto Hack Statistics in 2026: The Latest Data and Industry Insights — NFT Plazas","type":"news_article","archive_url":"http://web.archive.org/web/20260603214631/https://nftplazas.com/crypto-hack-statistics/","credibility":2,"archive_timestamp":"2026-06-03T21:46:31+00:00"},{"url":"https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","name":"KelpDAO, Bybit, Ronin: Lazarus Group's Crypto Hacks Behind a $7.3B Heist Empire — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260726102435/https://www.cryptotimes.io/2026/04/21/kelpdao-bybit-ronin-lazarus-groups-crypto-hacks-behind-a-7-3b-heist-empire/","credibility":2,"archive_timestamp":"2026-07-26T10:24:35+00:00"},{"url":"https://whale-alert.io/stories/99c0016d98d195/Immunefi-CEO-says-new-AI-models-are-worsening-crypto-security-as-2026-hacks-and-DeFi-exploits-surge","name":"Immunefi CEO says new AI models are worsening crypto security — Whale Alert / Immunefi","type":"news_article","archive_url":"http://web.archive.org/web/20261013031941/https://whale-alert.io/stories/99c0016d98d195/Immunefi-CEO-says-new-AI-models-are-worsening-crypto-security-as-2026-hacks-and-DeFi-exploits-surge","credibility":2,"archive_timestamp":"2026-10-13T03:19:41+00:00"},{"url":"https://news.bitcoin.com/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next/","name":"Drift Protocol Hack 2026: What Happened, Who Lost Money, and What's Next — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20261011232818/https://news.bitcoin.com/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next/","credibility":2,"archive_timestamp":"2026-10-11T23:28:18+00:00"},{"url":"https://www.cryptopolitan.com/experts-slam-drift-after-280m-hack/","name":"Crypto experts slam Drift Protocol after months-long hack drains $280M — Cryptopolitan","type":"news_article","archive_url":"http://web.archive.org/web/20261013051631/https://www.cryptopolitan.com/experts-slam-drift-after-280m-hack/","credibility":2,"archive_timestamp":"2026-10-13T05:16:31+00:00"},{"url":"https://www.ccn.com/education/crypto/humanity-protocol-private-key-hack-36m-h-token-crash/","name":"'Chinese Worldcoin' Crashes 85% After $36 Million+ Private Key Hack — CCN","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://finance.yahoo.com/markets/crypto/articles/humanity-protocol-token-crashes-88-024154068.html","name":"Humanity Protocol Token Crashes 88% Following Private Key Breach — Yahoo Finance","type":"news_article","archive_url":"http://web.archive.org/web/20261013032240/https://finance.yahoo.com/markets/crypto/articles/humanity-protocol-token-crashes-88-024154068.html","credibility":2,"archive_timestamp":"2026-10-13T03:22:40+00:00"},{"url":"https://memeburn.com/thorchain-asgard-vault-exploit-crashes-rune-may-2026/","name":"THORChain Asgard Vault Exploit Drains $10M, Crashes $RUNE 15% — Memeburn","type":"news_article","archive_url":"http://web.archive.org/web/20261013032912/https://memeburn.com/thorchain-asgard-vault-exploit-crashes-rune-may-2026/","credibility":2,"archive_timestamp":"2026-10-13T03:29:12+00:00"},{"url":"https://1inch.com/blog/post/the-biggest-bridge-hacks-in-2026","name":"The biggest bridge hacks in 2026 — 1inch Blog","type":"research","archive_url":"http://web.archive.org/web/20261013032846/https://1inch.com/blog/post/the-biggest-bridge-hacks-in-2026","credibility":2,"archive_timestamp":"2026-10-13T03:28:46+00:00"},{"url":"https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","name":"Top Crypto Hacks of 2026: Bridge Exploits and Sophisticated Operations Drive Over $750 Million in Losses — KuCoin Blog","type":"news_article","archive_url":"http://web.archive.org/web/20261006102127/https://www.kucoin.com/blog/top-crypto-hacks-2026-bridge-exploits","credibility":2,"archive_timestamp":"2026-10-06T10:21:27+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-25T17:09:13.416992+00:00","updated_at":"2026-11-06T09:15:02.746821+00:00"},"source_quality":{"total":57,"tier1":1,"tier2":18,"tier3":0,"unrated":38},"follower_count":null,"content_updated_at":"2026-10-31T19:44:52.487Z","last_fact_checked_at":"2026-10-27T19:04:44.172Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}