Report: The second quarter of 2026 becomes the most serious hacking season in cryptocurrency history

Report: The second quarter of 2026 becomes the most serious quarter in the history of cryptocurrency hacking

According to a report released this week by cryptocurrency market tracker CryptoRank, the DeFi platform has suffered 121 hacking attacks so far this year, causing approximately US$942 million in losses. Among them, a total of 85 incidents occurred in the second quarter, with approximately US$775 million stolen, making it the most active period for hacking in the history of the cryptocurrency field.

The background of the surge in attacks is the overall downturn in the cryptocurrency market and the continued weakening of investor confidence. The total locked value (TVL) in the DeFi agreement has declined month by month this year, from about $115 billion in January to $70 billion at the end of June.

Drift Protocol and KelpDAO vulnerabilities drive up Q2 losses

According to CryptoRank, the 85 attacks in the second quarter of 2026 are 49 more than the second most frequent period of hacking attacks (i.e., the first quarter of 2026). However, total losses in dollar terms did not reach their previous peak. Data providers pointed out that two consecutive attacks in April accounted for the vast majority of losses in the quarter.

Drift Protocol and KelpDAO combined losses of US$590 million, accounting for more than half of DeFi\'s total losses in 2026. Drift Protocol disclosed that the attackers stole approximately $285 million in user assets. An investigation by blockchain intelligence company TRM Labs linked the operation to North Korea-related hacking groups.

According to TRM, preparations for the attack began on-chain as early as March 11-with 10 ETH extracted from Tornado Cash. The cryptocurrency mix-up followed months of face-to-face meetings between Pyongyang agents and Drift employees. The company wrote in a report released April 30:\"Attackers used social engineering to induce multi-signers on the Drift Security Board to pre-sign seemingly routine transactions that conceal authorization for critical administrator operations.\"

Just over two weeks later, North Korea\'s Lazarus Group used the LayerZero Bridge infrastructure of the liquidity re-pledge agreement KelpDAO to steal rsETH worth approximately US$290 million. Chainalysis mentioned at the time that the attacker forged a cross-chain message on April 18 by invading two remote procedure call nodes used by LayerZero\'s decentralized tester network. At the same time, criminals launched a distributed denial of service attack on the third node, causing the system to use an compromised validator.

The verification process was tampered with, allowing attackers to create rsETH tokens on Ethereum without having to destroy the corresponding assets on Unichain. In the days after the attack, the TVL of the loan agreement Aave plummeted from $26.4 billion to $14.3 billion, with divestments reaching $12 billion, a drop of about 46%.

Hacking is one problem, market shrinkage is another problem

Aave\'s TVL decline is not an isolated case. CryptoRank data shows that the value of locked positions for all DeFi will decline every month in 2026, from $115.3 billion in January to just over $70 billion in June. Although hacking attacks were not the main reason for the decline, the company pointed out that frequent incidents are likely to weaken user confidence and lead to a wider withdrawal of funds from the field.

However, the current decline is not as severe as in the 2021-2022 cycle-when DeFi\'s TVL plunged more than 70% in seven months. CryptoQuant said the current decline is much slower and the market structure is different: the supply of stablecoins has grown to about $300 billion, real-world asset tokenization is expanding, and capital is dispersed into more areas such as derivatives, infrastructure and lending, rather than concentrated among a few automated market makers and revenue farms.

However, among TVL\'s largest ecosystems, only Tron and Hyperliquid have achieved growth this year: the former grew by 5% and the latter grew by nearly 7%, becoming the main venue for sustainable contracts on the chain. The remaining ten major public chains are all in a state of deep losses, with the biggest declines being Plasma and Arbitrum, whose TVL dropped by 74.6% and 55% respectively.