Crypto: A record quarter of hacks, never seen before

The crypto market ends the second quarter of 2026 under extreme pressure. Approximately $775 million was stolen in 85 incidents, a record for frequency. Two major attacks concentrated the bulk of the losses, while DeFi saw its total value locked fall almost $70 billion.

85 attacks recorded in three months

The second quarter recorded 85 crypto incidents, compared to 36 during the first three months of the year. This explosion places the period at the top of the historical ranking by number of attacks. Since January, crypto hacks have already affected 121 protocols or platforms.

Cumulative losses for the quarter reach approximately $775 million. Over the entire year, nearly $942 million was stolen. The figure is heavy, but it does not exceed certain financial records from previous cycles.

The distinction matters. The second quarter of 2026 is not necessarily the most expensive in history in dollar terms. It appears above all to be the most intense. Attacks are increasingeven when each of them does not produce a gigantic loss.

This frequency creates a permanent climate of insecurity. Users no longer face an isolated incident. They see the alerts follow one another, the withdrawals increase and the confidence cracks from week to week.

Two crypto attacks crush the statistics

Drift Protocol and KelpDAO alone account for nearly $577 million in losses. The two attacks occurred in April, just weeks apart. They thus concentrate the majority of stolen funds in the second quarter.

Drift Protocol lost around $285 million. According to investigators, the operation was based on several months of social engineering. The attackers allegedly gained the trust of project members before obtaining administrative permissions hidden in seemingly ordinary transactions.

This method shows an evolution of crypto risk. Code is no longer the only target. Hackers attack teams, internal procedures and people capable of validating sensitive operations.

The KelpDAO attack followed on April 18. Approximately $292 million worth of rsETH was fraudulently created or transferred after verification infrastructure linked to the LayerZero bridge was compromised.

In this case, the problem did not come directly from a classic flaw in a smart contract. The attackers manipulated off-chain elements used to confirm messages between networks. The system then accepted a transaction that should never have been validated.

DeFi loses billions and trust declines

The total value locked in DeFi increased from around $115 billion in January to almost $70 billion at the end of June. This represents a drop of almost 39% in just six months. Hacks are not enough to explain all this decline. Falling crypto prices mechanically reduce the dollar value of deposited assets. Investors are also moving their capital towards stablecoins, tokenized products or less exposed strategies.

However, repetition of attacks accelerates withdrawals. After the KelpDAO incident, Aave's TVL dropped sharply. Users preferred to withdraw their funds rather than wait to know the true extent of the risk.

The situation remains less brutal than during the 2021-2022 crisis. The crypto market now has more tokenized stablecoins, derivatives, and real-world assets. Capital therefore does not always disappear. They move to other segments.

However, this diversification does not protect all networks. Among the large DeFi ecosystems, only Tron and Hyperliquid have recorded progress since January. Several other chains showed very significant declines.

The second quarter does not mark the disappearance of DeFi. However, it requires a more severe examination of its foundations. Without better protection of teams and infrastructures, each new product also increases the attack surface. International pressure, notably the G7 response, shows that crypto security now goes beyond the technological framework.