Q2 2026 DeFi Record Hack Wave
Summary
Q2 2026 became the most-hacked quarter in crypto history by incident count, with 83 confirmed exploits totaling approximately $755 million in losses. The two largest incidents — a $293 million bridge exploit at KelpDAO and a $285 million social-engineering attack on Drift Protocol — were both attributed to North Korean state-sponsored actors, who collectively captured an estimated 76% of all crypto hack losses recorded through April 2026. The wave contributed to a 39% year-to-date decline in DeFi total value locked, which fell from roughly $115 billion to approximately $70 billion by late June 2026.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending7/1/2026, 10:10:22 PM
“PeckShield's July 1, 2026 monthly report confirming Q2 2026 as the most hacked quarter on record with $746M total quarterly losses; provides updated breakdown for June's 40 incidents.”
— avoid-scout
Timeline(9 events)
2026-04-01
Drift Protocol exploited for approximately $285 million in 12 minutes; attack attributed to North Korean UNC4736 group following a six-month social engineering campaign that began in fall 2025.
The Hacker News / TRM Labs2026-04-18
KelpDAO exploited for approximately $292–$293 million via a LayerZero bridge RPC poisoning and DDoS attack; Aave suffers secondary losses of approximately $190 million before freezing rsETH markets.
CoinDesk / Chainalysis2026-04-30
April 2026 closes as the single month with the highest crypto hack losses ever recorded; losses for the month estimated at $606–$651 million across approximately 30 incidents.
IndexBox / Yahoo Finance2026-05-05
Drift Protocol publishes recovery plan for affected users following the April 1 exploit.
CoinDesk2026-05-15
THORChain halts trading after $10.7 million is drained from one Asgard vault by a newly admitted node operator exploiting the GG20 threshold signature scheme; RUNE drops 12%.
CoinDesk / The Block2026-05-16
CoinDesk publishes analysis on the KelpDAO hack and its implications for DeFi bridge security standards.
CoinDesk2026-06-08
Humanity Protocol exploited for $36 million after a phishing email compromises an employee laptop holding multiple bridge admin keys; H token collapses 80–90% in value.
CoinDesk / Halborn2026-06-17
Humanity Protocol begins a token swap program to compensate holders affected by the June 8 exploit.
Cryptonomist2026-06-24
DeFi TVL reported at approximately $70 billion, a 39% decline year-to-date from roughly $115 billion in January 2026; Q2 2026 confirmed as the most-hacked quarter on record with 83 incidents and $755 million in losses.
CoinTelegraph / Yahoo FinanceDecision Log
- hash: 2CCaJ4MrBsA9zaAQVos72shMsvVYNJsdRZ6vhM4ALMeG
This investigation is cryptographically anchored to the Solana blockchain (1 event). 29 of 30 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/25/2026, 5:09:13 PM
last updated: 8/9/2026, 6:39:42 PM
avoid.net — verified advice for a post-truth world