Drift

2026

LayerZero

Tornado

Plasma

According to this week’s report from crypto market tracker CryptoRank, DeFi platforms suffered 121 hacks so far this year, resulting in approximately $942 million in losses.
The second quarter accounted for 85 incidents and about $775 million stolen, placing it as the most active period ever for exploits in the crypto sector.
The surge in attacks is against a backdrop of a crypto market struggle, pervaded by weakening investor confidence. Total value locked (TVL) in DeFi protocols has fallen every month this year, dropping from about $115 billion in January to $70 billion in late June.
<h2 id="drift-protocol-kelpdao-exploits-hiked-q2-losses">Drift Protocol, KelpDAO Exploits Hiked Q2 Losses</h2>
Per CryptoRank’s data, Q2 2026’s 85 <a href="https://cryptorank.io/insights/analytics/defi-tvl-downtrend-2026" rel="noopener noreferrer nofollow">incidents</a> are 49 more than the period with the second-highest frequency of exploits, which happens to be Q1 2026. However, total dollar-denominated losses were not as high as previous peaks, with the data provider reporting that two back-to-back attacks in April <a href="https://cryptopotato.com/kelpdao-and-drift-lead-devastating-650m-crypto-hack-wave-of-april/" rel="noopener noreferrer nofollow">accounted</a> for the majority of losses recorded in the quarter.
Drift Protocol and KelpDAO lost a combined $590 million, which is more than half of all the DeFi losses recorded in 2026. Drift Protocol disclosed that attackers had stolen about $285 million in user assets, with blockchain intelligence firm TRM Labs’s investigations linking the operation to hacking outfits connected with North Korea.
According to TRM, preparations for the attack started on-chain as early as March 11 with a 10 ETH withdrawal from Tornado Cash. The crypto tumbler transaction came after months of in-person meetings between the Pyongyang proxies and Drift employees.
<blockquote>
 “The attacker used social engineering to induce Drift Security Council multisig signers into pre-signing transactions that appeared routine but carried hidden authorizations for critical admin actions,” the firm <a href="https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks?scLang=en" rel="noopener noreferrer nofollow">wrote</a> in a report published April 30.
</blockquote>
Just over two weeks later, North Korea’s Lazarus Group exploited the liquid restaking protocol KelpDAO’s LayerZero bridge infrastructure and <a href="https://cryptopotato.com/the-biggest-hack-of-2026-what-we-know-about-the-294m-kelpdao-exploit/" rel="noopener noreferrer nofollow">stole</a> roughly $290 million worth of rsETH.
Chainalysis mentioned at the time that the attackers forged a cross-chain message on April 18 after <a href="https://www.chainalysis.com/blog/crypto-hacking-stolen-funds-2026/" rel="noopener noreferrer nofollow">compromising</a> two remote procedure call nodes used by LayerZero’s Decentralized Verifier Network. At the same time, the criminals struck a third node with a distributed denial-of-service attack, making the system use compromised verifiers.
The verification process was rigged to allow for the creation of rsETH tokens on Ethereum without burning the corresponding assets on Unichain. Within days of the attack, lending protocol Aave’s TVL dropped from $26.4 billion to $14.3 billion, clocking $12 billion in withdrawn funds and a decline of about 46%.
<h2 id="hacks-were-one-problem-a-shrinking-market-was-another">Hacks Were One Problem; a Shrinking Market Was Another</h2>
Aave’s TVL dip wasn’t unique, with CryptoRank’s data showing the value locked in all of DeFi falling every single month in 2026, going from $115.3 billion in January to just over $70 billion in June. And while hacks were not the main reason for the <a href="https://cryptopotato.com/defi-tvl-plummets-across-top-chains-after-kelpdao-hack/" rel="noopener noreferrer nofollow">decline</a>, the firm noted that the frequency of incidents likely made users less confident, leading to a wider rotation away from the sector.
But the drop hasn’t been as bad as the one in the 2021-2022 cycle when the DeFi TVL tanked more than 70% in seven months. The current dip has been much slower, and the market has also been different structurally, CryptoQuant says, with the stablecoin supply growing to about $300 billion, real-world asset tokenization expanding, and capital dispersed across more sectors like derivatives, infrastructure, and lending, instead of being concentrated in a handful of AMMs and yield farms.
However, among the largest ecosystems by TVL, only Tron and Hyperliquid have managed to grow this year, with the former gaining 5% and the latter adding nearly 7% as it became the dominant venue for on-chain perpetuals. The rest of the top 10 chains are deeply in the red, with the worst hit being Plasma and Arbitrum, which have so far seen their TVL plunge by 74.6% and 55%, respectively.
The post <a href="https://cryptopotato.com/report-q2-2026-becomes-worst-quarter-ever-for-crypto-hacks/" rel="noopener noreferrer nofollow">Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Report: Q2 2026 Becomes Worst Quarter Ever for Crypto Hacks

Table of Contents

CryptoPotato_News

Other articles published on Jun 28, 2026

Join our free newsletter for daily crypto updates!