In response to this week’s report from crypto market tracker CryptoRank, DeFi platforms suffered 121 hacks thus far this yr, leading to roughly $942 million in losses.
The second quarter accounted for 85 incidents and about $775 million stolen, putting it as probably the most energetic interval ever for exploits within the crypto sector.
The surge in assaults is in opposition to a backdrop of a crypto market wrestle, pervaded by weakening investor confidence. Whole worth locked (TVL) in DeFi protocols has fallen each month this yr, dropping from about $115 billion in January to $70 billion in late June.
Drift Protocol, KelpDAO Exploits Hiked Q2 Losses
Per CryptoRank’s knowledge, Q2 2026’s 85 incidents are 49 greater than the interval with the second-highest frequency of exploits, which occurs to be Q1 2026. Nevertheless, complete dollar-denominated losses weren’t as excessive as earlier peaks, with the information supplier reporting that two back-to-back assaults in April accounted for almost all of losses recorded within the quarter.
Drift Protocol and KelpDAO misplaced a mixed $590 million, which is greater than half of all of the DeFi losses recorded in 2026. Drift Protocol disclosed that attackers had stolen about $285 million in consumer property, with blockchain intelligence agency TRM Labs’s investigations linking the operation to hacking outfits linked with North Korea.
In response to TRM, preparations for the assault began on-chain as early as March 11 with a ten ETH withdrawal from Twister Money. The crypto tumbler transaction got here after months of in-person conferences between the Pyongyang proxies and Drift staff.
“The attacker used social engineering to induce Drift Safety Council multisig signers into pre-signing transactions that appeared routine however carried hidden authorizations for crucial admin actions,” the agency wrote in a report printed April 30.
Simply over two weeks later, North Korea’s Lazarus Group exploited the liquid restaking protocol KelpDAO’s LayerZero bridge infrastructure and stole roughly $290 million value of rsETH.
Chainalysis talked about on the time that the attackers cast a cross-chain message on April 18 after compromising two distant process name nodes utilized by LayerZero’s Decentralized Verifier Community. On the similar time, the criminals struck a 3rd node with a distributed denial-of-service assault, making the system use compromised verifiers.
The verification course of was rigged to permit for the creation of rsETH tokens on Ethereum with out burning the corresponding property on Unichain. Inside days of the assault, lending protocol Aave’s TVL dropped from $26.4 billion to $14.3 billion, clocking $12 billion in withdrawn funds and a decline of about 46%.
Hacks Had been One Drawback; a Shrinking Market Was One other
Aave’s TVL dip wasn’t distinctive, with CryptoRank’s knowledge exhibiting the worth locked in all of DeFi falling each single month in 2026, going from $115.3 billion in January to only over $70 billion in June. And whereas hacks weren’t the primary motive for the decline, the agency famous that the frequency of incidents seemingly made customers much less assured, resulting in a wider rotation away from the sector.
However the drop hasn’t been as unhealthy because the one within the 2021-2022 cycle when the DeFi TVL tanked greater than 70% in seven months. The present dip has been a lot slower, and the market has additionally been totally different structurally, CryptoQuant says, with the stablecoin provide rising to about $300 billion, real-world asset tokenization increasing, and capital dispersed throughout extra sectors like derivatives, infrastructure, and lending, as an alternative of being concentrated in a handful of AMMs and yield farms.
Nevertheless, among the many largest ecosystems by TVL, solely Tron and Hyperliquid have managed to develop this yr, with the previous gaining 5% and the latter including practically 7% because it grew to become the dominant venue for on-chain perpetuals. The remainder of the highest 10 chains are deeply within the purple, with the worst hit being Plasma and Arbitrum, which have thus far seen their TVL plunge by 74.6% and 55%, respectively.
The submit Report: Q2 2026 Turns into Worst Quarter Ever for Crypto Hacks appeared first on CryptoPotato.