Q2 crypto hacks hit new record

TLDR

Q2 2026 set a new all-time high for crypto hacks by number of incidents, even though total losses stayed below past single quarter peaks.

1. DefiLlama reports around 70 exploits and about $746 million stolen in Q2 2026, roughly double the previous record by incident count and nearly one attack per day.
2. Losses were dominated by a few huge DeFi exploits, while most attacks were smaller and increasingly targeted bridges, infrastructure and key management instead of only smart contract code.
3. For everyday users, risk is becoming more about constant background exploits in DeFi and bridges, so protocol choice, operational security and wallet hygiene matter more than chasing the highest yield.

Deep Dive

1. Record Q2 Numbers

According to a DefiLlama-based analysis, Q2 2026 is the most hacked quarter in crypto history, with around 70 separate exploits and roughly $746 million in losses, a new record for incident count. The previous quarterly incident high was significantly lower, so this is roughly a doubling in the number of hacks even though dollar losses remain below prior mega-loss quarters.

April 2026 was particularly bad, with about 28 to 30 hacks and over $625 million stolen, driven mainly by the Drift Protocol exploit (~$285 million) and the KelpDAO breach (~$293 million), which together made up about 93% of April losses. Q1 2026 already saw $169 million stolen across 34 protocols, and over the last decade crypto hacks have cumulatively taken more than $17 billion, so this quarter fits into a long trend of persistent security pressure.

2. Changing Attack Patterns

The data shows a shift from a few massive, isolated blows to a steady stream of smaller attacks. Outside of giants like Drift and KelpDAO, most Q2 incidents were sub $5 million, many under $1 million, but they add up.

Attackers are also moving up the stack. Several of the largest Q2 incidents involved operational or infrastructure failures, such as bridge verification bypasses, multisig tampering and vault address poisoning, rather than pure contract logic bugs. Cross-chain bridges are a recurring weak point, and analysts highlight more key theft via phishing and social engineering, indicating that humans and infrastructure are now as exposed as on-chain code.

3. Impact On Users And Projects

For DeFi users, the biggest risk clusters today are cross-chain bridges, restaking and yield aggregators that depend on complex infrastructure rather than simple spot transfers. These systems are attractive because they pool a lot of value behind relatively few keys or verification paths.

Concrete mitigations include favoring well-audited, battle-tested protocols, being conservative with bridge usage, limiting approvals and exposure size per app, and treating unsolicited DMs, links and signing requests as high risk. Projects, meanwhile, are being pushed toward better key management, segmented treasuries, faster incident response and more layered security on bridges and infrastructure.

Conclusion

Q2 2026s record hack count shows that crypto security has improved in some ways, with fewer single blowout events, but attackers have adapted by spreading smaller exploits across many protocols and chains. The practical takeaway is that bridges, infrastructure and human-facing weaknesses are now the main fault lines, and both users and projects should treat yield and cross-chain features as compensation for taking on these specific, evolving risks.