Q2 becomes crypto's most-hacked quarter

TLDR

New data shows Q2 2026 is the most hacked quarter in crypto history, with more attacks than ever but a shift toward smaller, more frequent exploits.

1. DefiLlama tracks about 70 exploits and roughly 746 million dollars stolen in Q2 2026, with April alone seeing over 625 million dollars in losses.
2. The surge is driven by cross chain bridges, key theft, social engineering, and faster attacker workflows powered by advanced AI tools.
3. For users, protocol choice, bridge exposure, and basic key and device security matter more than ever as the sector nears one successful attack per day.

Deep Dive

1. Record Q2 Hack Metrics

According to DefiLlama, Q2 2026 already counts about 70 separate exploits and roughly 746 million dollars stolen, making it the most hacked quarter in crypto history by incident count and a major loss event overall. The previous record for number of incidents has been doubled, while the total stolen is lower than past peak quarters, meaning the average exploit size has shrunk even as frequency rises.

April 2026 was the worst month on record, with around 30 incidents and over 625 million dollars lost, dominated by two large hits on Drift Protocol and KelpDAO that together accounted for about 93 percent of Aprils losses. By the end of May, cumulative DeFi losses in 2026 had already exceeded 840 million dollars across more than 50 incidents, up about 70 percent in frequency over the same period in 2025, based on DefiLlama data for Q2 2026.

2. Why Attacks Are Rising

The pattern has shifted from a few mega exploits to a constant stream of smaller hacks, which are harder for teams and users to track in real time. Cross chain bridges remain prime targets because they pool large amounts of locked liquidity behind complex contracts and validation setups.

At the same time, many of the biggest recent losses have come from operational failures, key theft, and social engineering rather than new smart contract bugs. Security experts warn that powerful AI models can dramatically speed up code review, phishing, and reconnaissance, which may help both attackers and defenders, but they caution that AI safety guardrails are not a reliable control against determined adversaries, as highlighted in recent security analysis of AI and DeFi hacks.

On the retail side, rug pulls, honeypots, and fake tokens dominate the long tail of scams. One recent study found rug pulls alone account for more than half of newly detected crypto scams, with millions of malicious contracts flagged, according to recent scam data.

3. How Users Can Respond

For everyday users, the main levers are venue and protocol risk, not just price volatility. Concentrated risks include lightly audited DeFi apps, newer cross chain bridges, anonymous teams, and contracts that allow privileged upgrades or pausing.

Practical defenses are mostly boring but important: hardware wallets, careful signing, avoiding blind approvals, preferring established bridges and protocols with public audits and bug bounties, and treating high yield with extra skepticism. Teams are increasingly segmenting funds so that any single exploit drains less, which helps explain smaller average losses even as the attack rate climbs.

Conclusion

Q2 2026 shows a clear regime change in crypto security: fewer single shock events and many more rapid, smaller exploits aimed at bridges, keys, and operational weak spots. For users and builders, the opportunity is not in predicting the next hack, but in steadily tightening key management, protocol selection, and fund segmentation so that when incidents happen, their impact on your own capital is limited.