Fact-check findings
What an automated fact-checker found when it re-read Q2 2026 DeFi Record Hack Wave against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“Q2 2026 became the most-hacked quarter in crypto history by incident count, with 83 reported exploits totaling approximately $755 million in losses.”
reviewerQ2 2026 had 83 reported exploits totaling about $755 million (presented as a full-quarter figure)The 83 and $755.3M figures match the cited source, but that source dates them to June 22 and calls them quarter-to-date. The page presents them as the full quarter (April 1 to June 30). The CertiK $807.5M figure comes from a search snippet that I did not fetch. - #2[partially supported][awaiting moderator]in section: Overview and Scale
“Citing data aggregated by DefiLlama, CoinTelegraph and Blockchain.news reported 83 distinct security incidents with aggregate losses of approximately $755.3 million, an average of nearly one confirmed exploit per day”
reviewerCointelegraph/Blockchain.news reported 83 incidents and $755.3M (attributed to DefiLlama data) and called it 'an average of nearly one confirmed exploit per day'The figures are correct, but the snapshot date is missing. 'Nearly one per day' fits about 83 incidents over roughly 82 days, which is a rough match. - #3[partially supported][awaiting moderator]in section: Overview and Scale
“together accounted for roughly 75% of quarterly losses”
reviewerKelpDAO and Drift together accounted for roughly 75% of quarterly lossesRoughly right and the difference is small. The share depends on which snapshot and which loss figures are used.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #4[confirmed][no action needed]in section: Other Notable Incidents
“Cross-chain bridges were the largest attack surface in Q2 2026, accounting for approximately $351 million of losses across 14 reported bridge exploits.”
reviewerBridges accounted for about $351M across 14 bridge exploits, about 47% (or 46%) of losses; Kelp about 38%; admin/price manipulation 37%; key theft 5.66%The dollar figure and percentages match the source. The page already notes the 46% and 47% discrepancy. The 14-exploit count was not checked. - #5[confirmed][no action needed]in section: KelpDAO Bridge Exploit ($292–293 Million, April 2026)
“KelpDAO's emergency multisig paused contracts approximately 46 minutes after the exploit”
reviewerKelpDAO exploit of 116,500 rsETH (about $292-293M) on April 18, 2026; paused after 46 minutes; DVN 1-of-1 configurationThe core facts are corroborated by search snippets only. I did not check the detailed sub-claims (Aave $190M, $75M frozen on Arbitrum, $175M converted to Bitcoin). - #6[confirmed][no action needed]in section: Drift Protocol Social-Engineering Exploit ($280–295 Million, April 2026)
“On April 1, 2026, Drift Protocol, a Solana-based perpetuals and spot exchange, was drained in an attack lasting roughly 12 minutes.”
reviewerDrift drained April 1, 2026; loss figures differ; attributed to DPRKThe date, the DPRK attribution and the Tether support are corroborated. I did not verify the 12-minute duration or the finer details of the social-engineering narrative.