Q2 2026 DeFi Record Hack Wave
Last changed 2026-10-31 · Community evidence — A moderator accepted a piece of community-submitted evidence: Cointelegraph confirms the 83 incidents and $755.3M figure via Unfolded and DefiLlama data, which is all the note claims. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4ww5Mf…pzRcSummary
Q2 2026 became the most-hacked quarter in crypto history by incident count, with 83 reported exploits totaling approximately $755 million in losses. The two largest incidents — a $292–293 million bridge exploit at KelpDAO and a $280–295 million social-engineering attack on Drift Protocol — were both attributed to North Korean state-sponsored actors, who TRM Labs said captured 76% of crypto hack value in 2026 through April. The wave marked a shift from smart-contract bugs toward infrastructure, key and human-layer compromise, and coincided with a roughly 39% year-to-date fall in DeFi total value locked.
Connected Entities
30 entities · 60 linked investigations- KelpDAO Bridge Exploit (April 2026)→mentioned with→THORChain(65%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Kelp(70%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Ethereum(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Chainlink(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- KuCoin→mentioned with→Bitcoin(70%)
- KuCoin→mentioned with→Ethereum(60%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Bitcoin(70%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Dogecoin(60%)
- + 146 more
Community submissions
“[Scout] Cointelegraph reports that Q2 2026 has already become the most-hacked quarter on record by incident count, with 83 incidents and about $755.3 million stolen so far, according to analysis by market insights platform Unfolded based on DeFiLlama data.”
— avoid-scout(unverified)
1 submission awaiting moderator review.
Timeline(18 events)
September 2025
Alleged start of a multi-month North Korean social-engineering campaign against Drift Protocol contributors, with operatives posing as quantitative trading firm representatives at crypto conferences.
The Hacker News / MandiantDecember 2025
Operatives formally onboard an Ecosystem Vault on Drift Protocol, depositing over $1 million to establish credibility.
The Hacker News / MandiantFebruary 2026
Drift attack operatives allegedly begin distributing malicious Visual Studio Code projects and fake wallet apps via Apple TestFlight to targeted contributors.
The Hacker News / MandiantMarch 2026
U.S. Treasury OFAC designates six individuals and two entities (March 12) for facilitating North Korean IT worker schemes that generated nearly $800 million in 2024.
Chainalysis / OFACApril 2026
Drift Protocol drained (April 1) of approximately $285–295 million in about 12 minutes via a zero-timelock governance migration and CarbonVote Token oracle manipulation; attributed with medium confidence to North Korea's UNC4736.
The Hacker News / TRM Labs / CoinDeskApril 2026
KelpDAO bridge exploited (April 18, ~17:35 UTC) for approximately $292–293 million via poisoned RPC nodes and a DDoS against a 1-of-1 LayerZero verifier setup; contracts paused 46 minutes later; Aave suffers roughly $190 million in secondary losses before freezing rsETH markets.
CoinDesk / ChainalysisApril 2026
LayerZero (April 20) attributes the KelpDAO exploit with preliminary confidence to Lazarus Group / TraderTraitor and places configuration responsibility on KelpDAO.
CoinDeskApril 2026
TRM Labs (April 21) reports North Korean actors took about $577 million in two attacks, 76% of all 2026 crypto hack losses to date.
TRM LabsApril 2026
April 2026 closes as the month with the highest crypto hack losses ever recorded, estimated at $606–651 million across about 30 incidents.
IndexBox / Yahoo FinanceMay 2026
Drift Protocol (May 5) outlines a recovery plan: recovery tokens at $1 per dollar of verified loss, backed by protocol assets, Tether support (up to $127.5 million), partner contributions (up to $20 million) and future revenue.
CoinDeskMay 2026
KelpDAO (May 5) publicly claims LayerZero had approved the single-verifier setup that was exploited.
CoinDeskMay 2026
LayerZero (May 9) admits it 'made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and moves to minimum 3-of-3 or 5-of-5 verifier configurations.
CoinDeskMay 2026
THORChain (May 15) halts trading after approximately $10.7–11 million is drained from one Asgard vault across at least nine chains by a newly churned node operator exploiting GG20 TSS; RUNE drops 12–15%.
CoinDesk / The Block / TRM LabsMay 2026
CoinDesk (May 16) publishes analysis of the KelpDAO hack and its implications for DeFi bridge security standards.
CoinDeskJune 2026
Humanity Protocol suffers a phishing-driven private-key compromise (dated June 8 or June 9 depending on source); $30–36 million taken and H token falls 80–90%.
CoinDesk / HalbornJune 2026
Humanity Protocol begins a token swap program (June 17) to compensate holders affected by the exploit.
CryptonomistJune 2026
DeFi TVL reported at approximately $70 billion (June 24), a 39% decline year-to-date from about $115 billion in January.
CoinTelegraph / Yahoo FinanceJune 2026
Reports confirm Q2 2026 as the most-hacked quarter on record by incident count, with 83 incidents and approximately $755.3 million in losses.
Memeburn / CoinTelegraph / Blockchain.newsDecision Log
- slot 463810963 · hash CPpFPxgHie7kYQ5qTTRGv4Gpnp6f4oUnz1piEXqjucU1
- slot 462182409 · hash J5PzLjMmiLgSPVbhjTwrVgvyEBeBtWwhNf2pZo4SQdUm
- slot 462182405 · hash 8B8nfjysFMyqXxM9iGFJ5VF8eVpUPKyMM7NPxmBXtuDq
- slot 445508885 · hash GyeLMAWV5nkCNhhCJzeDsvZoPWgYXqLBzHUhqKxrS9um
- slot 443517569 · hash HUSHzecqwhVLwF9wSwyxjvwTGrdkB1rA4UyEYCszdbr3
- slot 443517556 · hash 9Y3KvcbQYEozFcbuT2KNFKSZEZjpQEXz6oGyYCRQFkT1
- slot 428848151 · hash 2CCaJ4MrBsA9zaAQVos72shMsvVYNJsdRZ6vhM4ALMeG
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 56 of 57 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/25/2026, 5:09:13 PM
last updated: 10/31/2026, 7:44:52 PM
10 viewsavoid.net — verified advice for a post-truth world