DeFi: $169 million stolen in Q1 2026 despite falling losses

DeFi didn't have its most explosive quarter, but it remains an open target. In the first quarter of 2026, hackers stole approximately $168.6 million to $169 million from 34 DeFi protocols. The figure drops significantly compared to the first quarter of 2025, but it reminds us of a simple thing: in crypto, a lull never means security.

A falling total, but not a real relief

The breakage slows down in appearance, not in its logic. Last year, the first quarter turned into carnage with more than $1.63 billion lost, largely inflated by the giant attack against Bybit. This year, the amount is much lower, but the risk area remains intact.

In other words, DeFi is not out of the woods. It just avoided, over the first three months of 2026, a shock of the caliber of Bybit. This contrast can give an illusion of respite, even though it is above all a provisional photograph.

The real message is there. Even when losses decrease, attacks continue to strike quickly, hard, and often on very ordinary points: access, private keys, governance, human errors. Crypto doesn't just suffer from spectacular bugs. It also suffers from poorly locked details.

Crypto: the three attacks that marked the quarter

The biggest hit of the quarter hit Step Finance in January. The platform lost approximately $40 million after a compromise involving management team devices and several cash wallets. This is not a simple technical incident. It’s a stark reminder that operational security matters as much as code.

The second major attack targeted Truebit on January 8. According to data from ChallengeLlamaa smart contract manipulation made it possible to siphon $26.4 million in ether. There, we return to the classic DeFi scenario: poorly defended contractual logic, then rapid, clean, almost clinical execution.

The third important case concerns Resolv Labs, targeted on March 21 by a private key compromise. Three attacks, three different anglesbut the same result: money goes where the defense becomes unequal. That's what makes this quarter interesting. There was no single dominant attack pattern. There were several cracks exploited with discipline.

Why hackers strike when value accumulates

According to Nick Percoco, head of security at Kraken, criminal activity in crypto follows market cycles and major events more than the calendar. When liquidity becomes concentrated, attackers get closer. When a sector accelerates, they test the seams.

This is why bullish phases, product launches or rapid growth spurts are so sensitive. The faster the value accumulates, the more pressure mounts on infrastructures that are sometimes still young. In DeFi, speed is often sold as a strength. In security, it sometimes becomes a debt.

But the most important idea lies elsewhere. Attacks don't go away when the market slows down. They just change pace and focus. A complex protocol, poorly thought-out access control or a team that grows too quickly are enough to reopen the door.

The real flaw is not always in the crypto smart contract

The classic DeFi hack story is about code flaws. This quarter tells something else. Between Step Finance, Resolv Labs and even the giant attack that targeted Drift Protocol in early April, the question of private keys is coming back to center stage. In the case of Drift, preliminary analyzes suggest a compromise of administrator keys which made it possible to drain most of the liquidity.

This changes the reading of risk. The threat does not only come from a poorly audited contract. It also comes from access management, devices used, internal procedures and the human factor. Crypto likes to talk about decentralized infrastructure. Attackers often look for the hidden point of centralization.

The threat landscape remains broad and evolving. Experts anticipate more credential theft, social engineering and AI-assisted attacks in 2026. DeFi is therefore not entering a calmer era. It is entering a more demanding era.