Q2 crypto hacks surge to $764M

TLDR

Q2 2026 saw roughly 764 million dollars stolen in crypto hacks, making it the most aggressively exploited quarter for Web3 since 2025.

1. Security firm Hacken reports 763.9 million dollars lost across 67 incidents in Q2, up 58 percent from Q1 and the worst quarter since Q2 2025.
2. Most losses came from operational failures like compromised keys and signers, with mega exploits at Drift Protocol and KelpDAO and a large share attributed to North Korean actors.
3. Institutions and regulators are pivoting toward continuous monitoring and stronger login and key controls, a shift individual users should track when choosing protocols and venues.

Deep Dive

1. Scale Of Q2 Losses

Hackens Q2 2026 Security and Compliance Report estimates that attackers stole about 763.9 million dollars across 67 Web3 incidents, a 58.3 percent jump from Q1s 482.7 million and the heaviest loss quarter since Q2 2025 %%CKPROTECTED0%%.

Other trackers such as CryptoRank and PeckShield put Q2 losses in a similar range, around 775 million dollars and 70 to 85 incidents, reflecting different coverage but agreeing that Q2 2026 was the most hack intensive period on record for crypto exploits CryptoRank data.

Across the first half of 2026, CertiK counts 1.32 billion dollars lost to 344 incidents, seemingly lower than 2025 but distorted by a single 1.4 billion dollar Bybit hack last year, meaning underlying risk has not truly improved CertiK Hack3D overview.

Confidence: high because multiple independent firms report similar magnitudes and trends.

2. Why Hacks Are Increasing

Hacken finds a decisive shift in where attacks land: only about 11 percent of Q2 losses came from smart contract bugs, while 88.3 percent were due to compromised keys, signers, and infrastructure such as bridge validators and backend systems institutional security analysis.

Two April exploits at Drift Protocol and KelpDAO together accounted for roughly 580 to 590 million dollars, using social engineering of multisig signers and compromised cross chain validators rather than novel contract logic, with attribution linked to North Korean groups Drift and KelpDAO case study.

CertiK also highlights wallet takeovers and phishing as a dominant theme, with Q2 wallet compromises alone associated with over 800 million dollars in losses and physical wrench attacks against holders rising in parallel wallet and physical threat report.

3. How Security Is Responding

Institutional allocators are shifting trust away from one off audits toward live monitoring, hardened key management, and clear incident response plans, noting that traditional audit plus track record signals failed to predict many exploited projects institutional due diligence trends.

Regulators are tightening operational standards: Hong Kongs SFC is forcing licensed platforms to abandon SMS and app codes in favor of phishing resistant passkeys and hardware backed authentication after hundreds of millions in social engineering losses Hong Kong login rules.

Geopolitically, the United States, Japan, and South Korea have launched a joint initiative targeting North Koreas crypto theft operations after data showing it responsible for most global hack losses early in 2026 %%CKPROTECTED0%%.

Conclusion

Q2 2026s roughly 764 million dollars in hack losses reflect a regime where the main weak points are keys, signers, and infrastructure rather than only contract code. Large, often state linked actors exploit operational gaps while incident counts remain high, eroding confidence in DeFi and cross chain systems. The emerging edge is with projects and venues that treat security as a continuous process, pairing audits with live monitoring and robust key management, a shift that will likely shape which parts of the crypto ecosystem retain trust and capital over time.