← Q2 2026 Bridge Exploit Wavereviewed 2026-10-16 · 20 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Q2 2026 Bridge Exploit Wave against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
3 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in section: Overview and Scale
“The two largest individual exploits of the quarter (Drift Protocol at $285M and KelpDAO LayerZero at $292M) together represented over 76% of bridge-related losses.”
reviewerDrift Protocol ($285M) and KelpDAO ($292M) together represented over 76% of bridge-related losses.This is a math/categorization error. Drift was not a bridge exploit (admin-key/governance takeover on a Solana DEX), so it cannot be counted inside the page's own $351M bridge-loss total: $285M + $292M = $577M, which is 164% of $351M, an impossible result. $577M is, however, almost exactly 76% of total quarterly losses ($755.3M), indicating the page used the wrong denominator.Proposed correction (not yet applied)The two largest individual exploits of the quarter (Drift Protocol at $285M and KelpDAO LayerZero at $292M) together represented over 76% of total quarterly losses. - #4[disputed][awaiting moderator]in the summary
“with at least six distinct incidents draining approximately $340 million from bridge protocols alone, out of $755 million stolen across 83 crypto hacks industry-wide”
reviewerAt least six distinct bridge incidents drained approximately $340 million from bridge protocols in Q2 2026.Internal inconsistency: the summary and the Overview section give two different totals ($340M vs $351M) for what should be the same number (total Q2 bridge losses). The externally verified figure is $351M.Proposed correction (not yet applied)with at least six distinct incidents draining approximately $351 million from bridge protocols alone, out of $755 million stolen across 83 crypto hacks industry-wide - #13[disputed][awaiting moderator]in section: THORChain Vault Exploit — May 15, 2026 (~$10.7M)
“The network resumed operations following a v3.19.0 security upgrade released in early June 2026.”
reviewerTHORChain network resumed operations following a v3.19.0 security upgrade released in early June 2026.The v3.19.0 release date (June 9) is correct and is 'early June,' but the text implies the network resumption itself happened in early June. Multiple independent outlets confirm trading did not actually resume until June 23, 2026.Proposed correction (not yet applied)The v3.19.0 security upgrade was released on June 9, 2026, but the network did not resume full trading operations until June 23, 2026, following a validator-wide keyshare verification process.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: Drift Protocol Exploit — April 1, 2026 (~$285M)
“deposited 500 million CVT as collateral, and executed 31 rapid withdrawals”
reviewerThe attacker deposited 500 million CVT as collateral before draining Drift's vaults.The broader mechanism (fabricated token deposited as fraudulent collateral) is well corroborated, but the specific '500 million' figure could not be independently confirmed and conflicts loosely with other reporting of a 750 million total mint. - #11[unverifiable][awaiting moderator]in section: Hyperbridge (Polkadot) Exploit — April 13, 2026 (~$2.5M)
“The attacker submitted a forged cross-chain message via dispatchIncoming, which was routed to TokenGateway.onAccept, and exploited a zero-second challenge period that permitted immediate execution.”
reviewerHyperbridge attack path involved dispatchIncoming, TokenGateway.onAccept, and a zero-second challenge period permitting immediate execution.These specific function names and the 'zero-second challenge period' detail were not found in the cited official source or in secondary reporting I could access; plausible but not independently corroborated. - #15[unverifiable][awaiting moderator]in section: Verus-Ethereum Bridge Exploit — May 18, 2026 (~$11.6M)
“an absence of validation confirming that the input amount specified on the Verus side matched the payout amount on Ethereum within the checkCCEValues function”
reviewerThe Verus bridge's checkCCEValues function lacked validation that the Verus-side input amount matched the Ethereum-side payout.The broader vulnerability class is well confirmed; the specific function name could not be independently verified from accessible secondary sources (may be accurate per Halborn's technical writeup, which I could not fully fetch).
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #16[partially supported][awaiting moderator]in section: Syscoin Bridge Exploit — June 7, 2026 (~$10M)
“The team subsequently recovered the minted tokens and destroyed them using the OP_RETURN mechanism, restoring the on-chain SYS supply to its expected level.”
reviewerSyscoin bridge exploit: a parsing-error/cross-layer mismatch let an attacker mint 5 billion SYS (~$10M), later paused and the minted tokens destroyed via OP_RETURN.Core mechanism and recovery are plausible but the full-recovery/destruction detail rests on a single source (rekt.news) whose account of deal terms is itself unconfirmed, and the dollar value cited on the page ($10M) is at the high end of a $8.56M–$10M range reported elsewhere.
confirmed
13 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Overview and Scale
“Q2 2026 (April 1 – June 30) became the most-hacked quarter on record by incident count, with 83 exploits reported industry-wide and $755.3 million in total losses”
reviewerQ2 2026 (April 1 – June 30) was the most-hacked quarter on record by incident count, with 83 exploits and $755.3 million in total losses.Figure independently confirmed by both the primary cited source and a secondary KuCoin flash report citing the same DefiLlama dataset. - #2[confirmed][no action needed]in section: Overview and Scale
“Cross-chain bridges were the single largest loss category, accounting for approximately $351 million — 46.5% of quarterly losses.”
reviewerCross-chain bridges were the largest Q2 2026 loss category at approximately $351 million (46.5% of quarterly losses).Confirmed verbatim against the primary cited source. - #5[confirmed][no action needed]in section: Drift Protocol Exploit — April 1, 2026 (~$285M)
“Using Solana's 'durable nonces' feature, they induced council members to unknowingly pre-sign transactions that transferred administrative control.”
reviewerDrift Protocol exploit mechanics: durable-nonce pre-signed transactions obtained via social engineering of Security Council members, fabricated CVT token used as collateral, 31 withdrawals in ~12 minutes.Core mechanics corroborated by TRM Labs, Bloomberg, and multiple secondary outlets (BleepingComputer, Crowdfund Insider, rekt.news). - #7[confirmed][no action needed]in section: KelpDAO LayerZero Bridge Exploit — April 18, 2026 (~$292M)
“89,567 rsETH were subsequently deposited on Aave as collateral to borrow approximately $190 million in WETH”
reviewerKelpDAO exploit mechanics: LayerZero developer session-key compromise, RPC node poisoning, DDoS-forced failover, single-DVN point of failure, 89,567 rsETH deposited on Aave to borrow ~$190 million in WETH.Core figures and mechanism confirmed across The Block, CoinDesk, and The Defiant. - #8[confirmed][no action needed]in section: KelpDAO LayerZero Bridge Exploit — April 18, 2026 (~$292M)
“Kelp alleged LayerZero had approved the single-DVN configuration; LayerZero stated the configuration was the protocol's own choice.”
reviewerKelp DAO alleged LayerZero approved the single-DVN configuration; LayerZero stated the configuration was the protocol's own choice.Accurately summarized. - #9[confirmed][no action needed]in section: Hyperbridge (Polkadot) Exploit — April 13, 2026 (~$2.5M)
“Initial estimates placed losses at approximately $237,000 in ETH realized from dumping the minted DOT tokens; however, Hyperbridge revised the loss figure to approximately $2.5 million on April 16”
reviewerHyperbridge exploit: forged Merkle Mountain Range proof minted 1 billion bridged DOT; initial loss ~$237K, later revised to ~$2.5M; funds traced to Binance.Both the loss-revision timeline and the Binance-tracing claim are directly confirmed by the cited Yahoo Finance article. - #10[confirmed][no action needed]in section: Hyperbridge (Polkadot) Exploit — April 13, 2026 (~$2.5M)
“The vulnerability resided in the VerifyProof() function of the HandlerV1 contract, specifically a missing bounds check (leaf_index < leafCount) in the Merkle Mountain Range proof verification.”
reviewerHyperbridge root cause: missing bounds check (leaf_index < leafCount) in VerifyProof() of the HandlerV1 contract.Verified directly against the cited primary source. - #12[confirmed][no action needed]in section: THORChain Vault Exploit — May 15, 2026 (~$10.7M)
“THORChain's automatic solvency detection systems triggered within minutes and halted trading and signing across Ethereum, Avalanche, BNB Chain, Base, Dogecoin, and Gaia integrations within 52 minutes, preventing further losses.”
reviewerTHORChain exploit: a node that joined the active validator set on May 13, 2026 with ~635,000 RUNE bonded reconstructed a vault private key via GG20 key-shard leakage, draining ~$10.7M from one of five vaults; automatic solvency checks halted trading within 52 minutes.Matches the cited official THORChain report closely, including the exact 52-minute halt figure. Flagging for awareness only: an independent rekt.news report states six vaults rather than five, a minor discrepancy between sources that does not change the page's reliance on the primary source. - #14[confirmed][no action needed]in section: Verus-Ethereum Bridge Exploit — May 18, 2026 (~$11.6M)
“The attacker extracted 1,625 ETH, 103.6 tBTC, and approximately 147,659 USDC, subsequently converting them to approximately 5,402 ETH and routing them through Tornado Cash.”
reviewerVerus-Ethereum bridge exploit: missing value-binding check allowed theft of ~$11.58M in ETH, tBTC, and USDC, later converted to ~5,402 ETH and routed through Tornado Cash.Figures and mechanism independently corroborated. - #17[confirmed][no action needed]in section: Taiko Bridge Exploit — June 22, 2026 (~$1.7M)
“The exploit stemmed from the accidental public exposure of a signing key for Raiko, Taiko's trusted execution environment (SGX-based) proof generator.”
reviewerTaiko bridge exploit: a leaked SGX signing key for the Raiko prover, publicly exposed, allowed forged withdrawal proofs that drained ~$1.7M on June 22, 2026; Taiko halted block production and urged withdrawals.Core mechanism, date, and dollar figure independently confirmed by multiple outlets. - #18[confirmed][no action needed]in section: Taiko Bridge Exploit — June 22, 2026 (~$1.7M)
“Taiko subsequently announced plans to fully restore bridge backing following the incident.”
reviewerTaiko announced plans to fully restore bridge backing following the exploit.Confirmed by a secondary source describing the follow-through on the restoration announcement. - #19[confirmed][no action needed]in section: State-Sponsored Attribution (Lazarus Group / TraderTraitor)
“If both attributions are correct, Lazarus Group extracted over $575 million from DeFi in 18 days through two structurally distinct attack vectors”
reviewerIf both attributions are correct, Lazarus Group extracted over $575 million from DeFi in 18 days through the Drift and KelpDAO attacks.Arithmetic and hedging both check out; the page correctly flags this as conditional on unconfirmed attribution. - #20[confirmed][no action needed]in section: State-Sponsored Attribution (Lazarus Group / TraderTraitor)
“UPI.com and BeInCrypto reported the KelpDAO attribution publicly on April 22, 2026.”
reviewerUPI reported the KelpDAO North Korea attribution publicly on April 22, 2026.UPI's publication date is directly confirmed by its URL structure and archive timestamp; BeInCrypto's specific publication date was not independently checked but is a plausible, low-stakes secondary detail.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.