Q2 2026 Bridge Exploit Wave
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4Jt19z…jdXRSummary
The second quarter of 2026 (April–June) saw a record-breaking wave of cross-chain bridge exploits, with at least six distinct incidents draining approximately $340 million from bridge protocols alone, out of $755 million stolen across 83 crypto hacks industry-wide. The largest single events — the Drift Protocol ($285M) and KelpDAO LayerZero bridge ($292M) exploits — were attributed with medium confidence to North Korea's Lazarus Group / TraderTraitor subunit. Attack vectors ranged from social engineering of governance signers and RPC infrastructure poisoning, to smart contract proof-validation gaps and private key leakage.
Connected Entities
27 entities · 59 linked investigations- Syscoin→mentioned with→Binance(65%)
- Syscoin→mentioned with→Ethereum(65%)
- Syscoin→mentioned with→Hyperbridge(60%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Ethereum(80%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Syscoin(80%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Kelp(70%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Polkadot(80%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Solana(70%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Arbitrum(60%)
- Q2 2026 Bridge Exploit Wave→mentioned with→Drift(85%)
- + 112 more
Timeline(18 events)
September 2025
Alleged start of DPRK social engineering operation targeting Drift Protocol Security Council members (approximate date; campaign reported as beginning in fall 2025)
The Hacker News6 March 2026
KelpDAO attack begins: threat actor alleged to have socially engineered a LayerZero Labs developer to harvest session keys and gain access to RPC cloud environment
LayerZero Labs Incident Report11 March 2026
On-chain staging for Drift exploit begins: 10 ETH withdrawn from Tornado Cash to fund deployment of CarbonVote (CVT) fake token
ChainalysisApril 2026
Drift Protocol exploited for approximately $285 million on Solana; 31 rapid withdrawals executed in ~12 minutes after admin control obtained via pre-signed durable nonce transactions
Bloomberg13 April 2026
Hyperbridge (Polkadot) bridge exploited via forged Merkle Mountain Range proofs; 1 billion bridged DOT minted; initial loss estimate ~$237K, later revised to ~$2.5M
CoinDesk16 April 2026
Hyperbridge revises loss estimate upward to ~$2.5 million; reports stolen funds traced to Binance and coordination with exchange compliance and law enforcement
Yahoo Finance18 April 2026
KelpDAO LayerZero bridge exploited for ~$292 million (116,500 rsETH) via RPC infrastructure poisoning enabling false chain state to be fed to single-DVN verifier
CoinDesk20 April 2026
LayerZero publishes incident report attributing KelpDAO exploit to Lazarus Group / TraderTraitor; Kelp DAO disputes responsibility, alleging LayerZero approved the single-DVN configuration
CoinDesk22 April 2026
UPI and multiple outlets publish North Korea attribution for KelpDAO hack, citing Lazarus Group / TraderTraitor indicators
UPI5 May 2026
Kelp DAO publishes statement claiming LayerZero approved the configuration blamed for the $292 million hack
CoinDesk13 May 2026
THORChain attacker node (later identified as malicious) joins active validator set with ~635,000 RUNE bonded
THORChain official blog15 May 2026
THORChain exploit: rogue node reconstructs vault private key via GG20 key shard leakage, drains ~$10.7M from one vault; network auto-halts within 52 minutes
CryptoTimes18 May 2026
Verus-Ethereum bridge exploited for ~$11.58M via missing value-binding check (no verification that source input matched Ethereum payout); funds routed through Tornado Cash
CoinDesk7 June 2026
Syscoin bridge exploit: cross-layer parsing mismatch between Syscoin Core and NEVM relay exploited to mint 5 billion SYS tokens (~$10M); bridge paused, tokens later burned
Halborn22 June 2026
Taiko (Ethereum L2) bridge exploited for ~$1.7M after SGX signing key for proof generator Raiko was exposed publicly on GitHub; block production halted, users urged to withdraw
CoinDesk25 June 2026
Taiko announces plan to fully restore bridge backing following the $1.7M exploit
CryptoTimes30 June 2026
Q2 2026 closes with 83 crypto hack incidents and $755.3M in total losses — most hacked quarter on record by incident count; bridge exploits account for ~$351M (46.5%) of losses
CoinTelegraphDecision Log
- hash: EYuLxEbrSUoEr5zF33G3aj9agavU2LnGZuLrWPQYPzG1
- hash: Enu6jcxcPeqFnqEVTpqBKgAuZR2MTpuPuLqCUkKz6CN4
- hash: 47JrxK5fYghVMHxBpMA6fUaq1BXCmu4YnTjZN3wQxG6A
This investigation is cryptographically anchored to the Solana blockchain (3 events). 32 of 33 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/29/2026, 11:25:48 PM
last updated: 8/26/2026, 7:07:33 AM
5 viewsavoid.net — verified advice for a post-truth world