Q2 crypto hacks hit record incident count

TLDR

Q2 2026 has logged the highest number of crypto hacks ever recorded, with many small and mid-sized exploits piling up across DeFi.

1. DefiLlama tracks roughly 70 exploits and about $746 million stolen in Q2 2026, making it the most-hacked quarter on record by incident count.
2. The pattern is shifting from a few mega hacks to a near-daily stream of smaller attacks, heavily targeting bridges and key management weaknesses.
3. For users and protocols, the practical risk is a permanently elevated background of exploits, making venue choice, bridge exposure, and key security more important than headline totals.

Deep Dive

1. Scale Of Q2 Attacks

DefiLlamas data shows Q2 2026 as the most-hacked quarter in crypto history, with about 70 separate exploits and roughly $746 million in losses, or nearly one attack per day across the ecosystem. This is roughly double the previous record for incident count, even though the total stolen is lower than some past peaks, which were dominated by one or two huge hacks.

April 2026 was the worst month on record, with around 30 incidents and more than $625 million stolen, concentrated in a handful of big exploits such as Drift Protocol and KelpDAO, while most other incidents were under $5 million each, many below $1 million. By the end of May, cumulative DeFi losses for 2026 were already over $840 million across more than 50 incidents, around a 70 percent year over year increase in frequency compared with the same period in 2025, according to the same DefiLlama based report.

2. Why Incidents Are Rising

Analysts highlight a structural shift from rare, massive contract bugs to a constant flow of smaller exploits that focus on operational weaknesses. Cross chain bridges are a major target because they pool large amounts of funds with complex architectures, enlarging the attack surface.

There is also a move from pure smart contract bugs toward key theft, social engineering, and compromised signing flows. Reports note that over the past decade, crypto hacks have exceeded $17 billion in total losses, but the more recent wave increasingly involves phishing, compromised multisig signers, and misconfigured access controls rather than novel code vulnerabilities.

Advanced AI tools are another factor. Security experts expect AI to speed up both vulnerability discovery and social engineering, even if it does not invent brand new exploit types, which reinforces the trend toward faster, more frequent attacks.

3. How Users And Protocols Should React

For everyday users, the main levers are venue and key hygiene. Focusing on battle tested protocols, limiting exposure to experimental bridges, and using hardware wallets and clear signing can materially reduce common attack paths.

For protocols and DAOs, segmentation and process design matter. Spreading funds across vaults, tightening signer policies, using time locks for large movements, and running continuous monitoring can limit blast radius when (not if) incidents occur.

Conclusion

Q2 2026 confirms that crypto security has entered a phase where hacks are frequent, varied, and often operationally driven. While individual losses per incident are trending smaller than past giga exploits, the near daily cadence of attacks means users and protocols need to prioritize bridge risk, key management, and process controls as part of normal crypto participation.