Q2 2026 Record Crypto Hack Wave
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4mwKov…PsBrSummary
The second quarter of 2026 became the most-hacked quarter on record by incident count, with 83 confirmed crypto security incidents totaling approximately $755.3 million in losses. Two attacks — KelpDAO ($292–293 million) and Drift Protocol ($280–285 million) — together accounted for roughly 75% of quarterly losses and were both attributed by blockchain intelligence firms to North Korea's Lazarus Group and its TraderTraitor subunit. The quarter marked a structural shift in dominant attack methodology away from smart contract code vulnerabilities toward infrastructure misconfiguration, private key compromise, and multi-month social engineering campaigns.
Connected Entities
26 entities · 60 linked investigations- KelpDAO Bridge Exploit (April 2026)→mentioned with→THORChain(65%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Arbitrum(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Kelp(70%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Ethereum(80%)
- KelpDAO Bridge Exploit (April 2026)→mentioned with→Chainlink(60%)
- Ethereum→mentioned with→Bitcoin(60%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Bitcoin(70%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Dogecoin(60%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Solana(70%)
- Q2 2026 Record Crypto Hack Wave→mentioned with→Ethereum(60%)
- + 126 more
Timeline(14 events)
September 2025
Alleged start of multi-month Lazarus Group social engineering campaign against Drift Protocol contributors, with operatives posing as quantitative trading firm representatives at crypto conferences
The Hacker News / MandiantDecember 2025
North Korean operatives formally onboard an Ecosystem Vault on Drift Protocol, depositing over $1 million to establish credibility; integration conversations begin
The Hacker News / MandiantFebruary 2026
Drift attack operatives begin distributing malicious Visual Studio Code projects and fake wallet applications via Apple TestFlight to targeted contributors
The Hacker News / Mandiant12 March 2026
U.S. Treasury OFAC designates six individuals and two entities for facilitating North Korean IT worker schemes that generated nearly $800 million in 2024
Chainalysis / OFACApril 2026
Drift Protocol drained of approximately $285–295 million in approximately 12 minutes via zero-timelock governance migration and fabricated CarbonVote Token oracle manipulation; operatives delete all evidence immediately after execution
CoinDesk / The Hacker News18 April 2026
KelpDAO bridge exploited for approximately $292–293 million at 17:35 UTC via compromised RPC nodes and DDoS attack forcing LayerZero's single-verifier configuration to rely on poisoned servers; contracts paused 46 minutes later
CoinDesk20 April 2026
LayerZero attributes KelpDAO exploit with preliminary confidence to North Korea's Lazarus Group and TraderTraitor subunit; places configuration responsibility on KelpDAO
CoinDesk21 April 2026
TRM Labs reports North Korean operators linked to Lazarus Group have drained over $575 million from DeFi across just two attacks in 18 days, representing 76% of all 2026 crypto hack losses through that date
TRM Labs5 May 2026
Drift Protocol outlines recovery plan for affected users: recovery tokens pegged at $1 per dollar of verified loss, backed by protocol assets, Tether support (up to $127.5 million), partner contributions (up to $20 million), and future exchange revenue
CoinDesk5 May 2026
KelpDAO publicly claims LayerZero had approved the single-verifier setup that was exploited, contradicting LayerZero's earlier statements
CoinDesk9 May 2026
LayerZero reverses its position and admits it 'made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions'; announces migration to minimum 3-of-3 or 5-of-5 verifier configurations
CoinDesk15 May 2026
THORChain exploited for approximately $10.7–11 million across nine blockchain networks via alleged GG20 TSS vulnerability exploited by a newly churned node operator; automated halt triggers within minutes, freezing trading for approximately 13 hours
CoinDesk / TRM Labs9 June 2026
Humanity Protocol suffers private key theft via phishing email impersonating Bithumb; attacker drains approximately 17 project wallets for $32–36 million; $H token crashes 80–90%
CoinDesk / Halborn25 June 2026
Q2 2026 formally closes; multiple reports confirm 83 incidents and approximately $755.3 million in total losses, making it the most-hacked quarter on record by incident count
Memeburn / CoinTelegraph / Blockchain.newsDecision Log
- hash: BwLiqTmz2M4qGgamAt3hvHSwaopwWYqUWiubreD3tyxn
- hash: 74UPCx78EjAW9NbDvusABtgMLTfXxCM33RFfMkaJju2n
- hash: FnScmDfetn5CU2452i1D7YSqCMpXYXevsLLntrvo7rxh
This investigation is cryptographically anchored to the Solana blockchain (3 events). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/29/2026, 12:36:49 PM
last updated: 8/25/2026, 10:19:40 PM
4 viewsavoid.net — verified advice for a post-truth world