DeFi just had its worst quarter for attack volume on record, and the money hasn’t stopped moving since. DefiLlama’s tracker logged 99 separate exploits against decentralized finance protocols in the second quarter of 2026, the highest count for any three-month stretch since the data begins. A separate tally from The Defiant put the same quarter at 70 incidents and $746 million in losses. Both numbers describe the same story: DeFi exploits are happening more often in 2026 than at any point since the sector’s 2022 peak, even as the average payout per hack keeps shrinking.
The pattern matters because it cuts against the industry’s own narrative. For three years, DeFi teams have pointed to falling total losses as proof that audits, bug bounties, and better tooling were working. That’s still technically true on a dollar basis. But the frequency data tells a different story: attackers are hitting more targets, more often, and increasingly through stolen keys and cross-chain bridges rather than through the smart contract bugs that dominated headlines in 2021 and 2022. This piece breaks down what changed, why the trackers disagree, and what it means for anyone holding funds in a bridge or liquidity pool right now.
DeFi Exploits Set a New Record for Attack Frequency in Q2 2026
DefiLlama’s newsletter, published in July, called Q2 2026 “the most hacked quarter in DeFi history,” citing 99 exploits logged in its database for the three-month window. That beats every prior quarter the tracker has recorded, including the chaotic stretch after Terra’s collapse in 2022. Across the full 2026 year to date, DefiLlama counts more than 140 exploits totaling over $1 billion in stolen funds, a run rate that puts 2026 on pace to outstrip 2025 in sheer incident count even if the dollar total lands lower.
Security firm Immunefi frames the same period differently. Its H1 2026 report puts DeFi-specific exploit losses at roughly $680.3 million, down 74% from the 2022 peak of $2.62 billion, with the median loss per incident falling around 75% over the same stretch. Read together, the two data sets aren’t contradictory. Attacks are getting cheaper to pull off and smaller in individual payout, but there are simply a lot more of them. Blockchain intelligence firm TRM Labs counted 207 total crypto hacks and exploits across all categories in H1 2026, adding up to $972 million stolen, with 125 of those incidents classified as smart contract exploits touching DeFi protocols specifically.
Attack frequency growth shows up clearly year over year. One tracker cited by CryptoTimes counted 47 separate DeFi incidents in the first four and a half months of 2026, versus 28 in the same window a year earlier, a 68% jump in attack count. Altfins puts the January-through-May 2026 loss figure at more than $840 million, a 70% increase over the same period in 2025. Whichever dataset you trust, the direction is the same: DeFi exploits are accelerating in 2026, not slowing down.
April’s $600 Million Month: KelpDAO and Drift Protocol
April 2026 alone accounted for more than $600 million of the year’s DeFi losses, according to Yahoo Finance’s review of on-chain data. Two incidents drove most of that figure. Restaking protocol KelpDAO lost $292 million in a single exploit, and Solana-based trading platform Drift Protocol was hit for $285 million days later. Combined, those two attacks totaled $577 million, more than the entire first quarter of 2026 put together.
The size of those two incidents illustrates a recurring pattern in DeFi exploits: a handful of large attacks against protocols holding concentrated value can swing the entire year’s numbers, even while the underlying trend is toward more frequent, smaller hits elsewhere. Compare that to Q1 2026, when 15 DeFi protocols were exploited for a combined $137.7 million, with about $9 million recovered, a recovery rate near 6.5%, according to CoinPaprika’s Q1 security report. The largest single Q1 hit was against Solana yield platform Step Finance in January, at $27.3 million, a fraction of what KelpDAO and Drift lost individually three months later.
Cross-Chain Bridges Become DeFi’s Weakest Link
If one category defines 2026’s DeFi exploit wave, it’s the cross-chain bridge. PeckShield tracked eight separate bridge-related hacks in 2026 that together drained $328.6 million from cross-chain protocols, a figure Bitcoin.com News reported in May. Bridges hold an outsized share of risk relative to their footprint. Altfins estimates bridges collectively carry about $21.94 billion in total value locked, making them, dollar for dollar, the single highest-risk surface in DeFi infrastructure.
Two incidents from spring 2026 show how these attacks actually work. On April 12, a critical flaw in Hyperbridge’s token minting function let an attacker drain $12 million across three separate chains, according to security firm Autheo’s incident writeup. The bug sat in how the bridge validated mint requests before releasing wrapped assets on the destination chain. Then on May 18, a separate exploit against a Verus-Ethereum bridge integration drained roughly $11.58 million by exploiting weaknesses in how the bridge verified source-chain transactions before releasing funds, CryptoTimes reported.
The June Bridge Attack: $127 Million in 12 Minutes
The starkest example came in mid-June. Over a 12-minute window beginning at 03:42 UTC on June 14, attackers drained $127 million from three DeFi protocols by exploiting a cross-chain bridge’s message verification module, according to a report from Nadcab Labs. The bridge’s validators signed cross-chain messages without including a chain-specific nonce or block height, which meant a legitimate signature authorizing a transaction on Ethereum could be replayed to authorize a fraudulent withdrawal on Arbitrum or Polygon. Attackers used that gap to drain liquidity pools that institutional market makers had trusted as settlement rails. It’s the kind of bug that’s simple to describe and expensive to have missed: the bridge checked that a signature was valid, but never confirmed the transaction it referenced had actually finalized on the chain it claimed to come from.
A more recent example shows the pattern hasn’t slowed as summer wore on. On August 9, exchange Coinsbuy lost more than $8 million in a coordinated attack spanning TRON and Ethereum, CoinDesk reported. The attacker started with a single 5 USDT test transaction, then drained eight TRON wallets of roughly 6.04 million USDT before moving funds across chains to obscure the trail. Small opening transaction, cross-chain cleanup, minimal footprint until the funds were already gone. That’s become close to a template for 2026’s exploit wave.
DeFi’s Biggest Exploits of 2026 So Far
| Protocol / Target | Date | Amount Lost | Attack Vector |
|---|---|---|---|
| KelpDAO | April 2026 | $292 million | Restaking protocol exploit |
| Drift Protocol | April 2026 | $285 million | Solana trading platform breach |
| Cross-chain bridge (3 protocols) | June 14, 2026 | $127 million | Signature replay, no chain-specific nonce |
| Step Finance | January 2026 | $27.3 million | Largest single Q1 DeFi hit |
| Hyperbridge | April 12, 2026 | $12 million | Flawed token minting function |
| Verus-Ethereum bridge | May 18, 2026 | $11.58 million | Weak source-chain transaction verification |
| Coinsbuy exchange | August 9, 2026 | $8 million | Coordinated TRON-Ethereum cross-chain attack |
Why the Attack Vector Is Shifting from Code to Credentials
The most useful number in TRM Labs’ H1 2026 report isn’t the $972 million total. It’s the breakdown of where that money came from. Infrastructure and operational compromise, meaning stolen private keys, compromised admin credentials, and social engineering against team members, accounted for only about 15% of incidents in H1 2026. Yet that 15% produced roughly 76% of total dollar losses. Smart contract bugs, by contrast, made up the bulk of incident count (125 of 207 total hacks) but a smaller share of the money stolen.
Altfins reports a similar split for the January-through-May window: 72% of losses in that period came from stolen keys and credential theft rather than smart contract bugs. That’s a meaningful shift from the DeFi exploit landscape of 2021 and 2022, when reentrancy bugs, flash loan manipulation, and price oracle attacks against unaudited code dominated the incident list. Audits still matter, and DeepStrike’s research notes that protocols which skip third-party audits remain disproportionately represented among 2026 victims. But the money is increasingly following whoever controls the keys, not whoever wrote the weakest contract.
Common Bridge Vulnerabilities Behind the 2026 Losses
Bridge-specific incidents in 2026 trace back to a narrower set of root causes than the broader DeFi category. Missing input validation shows up repeatedly: a Hyperbridge incident tied to roughly $237,000 in losses stemmed from a missing boundary check on a parameter called leaf_index, while a separate CrossCurve incident around $3 million traced to insufficient caller verification. Both bugs are the kind that a routine boundary-check review would likely have caught before deployment. The pattern across nearly every bridge hack this year is the same: the bridge trusted a message, a signature, or a mint request without independently confirming the underlying state it claimed to represent.
How 2026 Compares to DeFi’s 2022 Peak
DeFi exploits aren’t new, and the sector has been through worse dollar totals before. The 2022 cycle, capped by the Terra/LUNA collapse and the Ronin bridge hack, remains the high-water mark for total losses. Immunefi’s comparison, cited by The Block, puts 2022’s DeFi exploit total at $2.62 billion against H1 2026’s $680.3 million, a 74% decline. Median loss per exploit has fallen an estimated 75% over that same window, which tracks with what the incident data shows: fewer catastrophic nine-figure hits against a single undercollateralized protocol, and more frequent mid-size hits spread across a wider set of targets.
| Period | DeFi-Specific Losses | Source |
|---|---|---|
| 2022 (full year, peak) | $2.62 billion | Immunefi |
| Q1 2026 (Jan-Mar) | $137.7 million | CoinPaprika |
| Jan-May 2026 | $840 million+ | Altfins |
| H1 2026 (Jan-Jun) | $680.3 million | Immunefi |
| Q2 2026 (Apr-Jun) | $746 million (70 incidents), or 99 incidents by count | The Defiant / DefiLlama |
| Full-year 2026 (YTD, all categories) | $1 billion+ (140+ exploits) | DefiLlama |
Why the Trackers Don’t Agree on the Numbers
Anyone comparing DeFi exploit statistics across sources will notice the figures don’t line up cleanly, and that’s worth explaining rather than glossing over. DefiLlama’s 99-exploit count for Q2 2026 and The Defiant’s 70-incident, $746 million figure for the same quarter both come from real on-chain tracking, but they use different inclusion criteria. Some trackers count every flagged incident regardless of confirmed size, including small opportunistic drains under $50,000. Others set a minimum threshold or exclude incidents still under investigation. TRM Labs’ 207-incident, $972 million H1 total includes categories DefiLlama and Immunefi treat separately, like exchange-adjacent hacks and custodial breaches that touch DeFi rails without being DeFi protocol exploits themselves.
The practical takeaway: treat any single headline number with some skepticism, and look at the trend across multiple trackers instead of anchoring on one figure. Every methodology used here agrees on the direction. Attack frequency in 2026 is up sharply from 2025, and cross-chain bridges have become a disproportionate source of losses relative to the value they hold.
Market Impact: TVL, Confidence, and the Insurance Gap
CoinPaprika’s Q1 2026 report puts sector-wide DeFi total value locked at over $60 billion even as $137.7 million was drained from protocols that quarter, meaning that quarter’s losses represented roughly 0.23% of total value locked. That’s a far cry from 2022, when major hacks could wipe out double-digit percentages of a protocol’s entire TVL in a single incident. Capital hasn’t fled DeFi broadly, but it has become more concentrated in protocols with visible audit histories, bug bounty programs, and insurance coverage.
On-chain insurance and coverage products remain a small fraction of total TVL, and most bridge hacks in 2026 left affected users without a path to recovery. CoinPaprika’s recovery-rate figure for Q1 2026, about 6.5% of stolen funds returned, illustrates the gap. Once funds cross a bridge and get laundered through a mixer or a chain with weaker compliance tooling, recovery odds drop fast. That asymmetry, high loss frequency paired with low recovery odds, is part of why institutional market makers named in the June bridge incident are reportedly pushing for stricter finality guarantees before committing further liquidity to cross-chain rails.
Root Cause Breakdown: Where DeFi’s Money Actually Goes Missing
| Attack Category | Share of Incidents (H1 2026) | Share of Dollar Losses (H1 2026) |
|---|---|---|
| Smart contract exploits | ~60% (125 of 207 incidents) | Minority of total dollar losses |
| Infrastructure / key compromise | ~15% | ~76% |
| Other (phishing, rug pulls, exchange-adjacent) | ~25% | Remainder |
Source: TRM Labs H1 2026 crypto crime data, as reported via DeepStrike’s 2026 DeFi security statistics roundup.
Which Chains and Bridge Designs Are Holding Up Best
Not every chain or bridge architecture has taken equal damage in 2026. Ethereum mainnet and its major L2s (Arbitrum, Polygon) show up repeatedly as both attack origin points and destinations in the incidents catalogued here, largely because that’s where the deepest liquidity sits, not because the underlying chains are uniquely flawed. Solana-based protocols, including Drift and Step Finance, accounted for two of the year’s largest single losses, which trackers attribute to the concentration of high-TVL trading and restaking products on that chain rather than any Solana-specific vulnerability class.
A 2026 bridge security landscape analysis groups this year’s incidents by root vulnerability type rather than by chain, and the pattern is consistent: missing input validation, weak signature verification, and flawed minting logic account for most losses, regardless of which chains sit on either end of the bridge. That suggests the fix isn’t “move to a safer chain.” It’s tighter verification logic in the bridge contracts themselves, independent of which networks they connect.
What Security Teams Are Changing in Response
DeepStrike’s research points to a handful of concrete shifts among protocols trying to get ahead of the 2026 exploit wave. Teams are moving toward requiring finality confirmation, not just signature validity, before releasing funds on a destination chain, directly addressing the replay-style bug behind the June $127 million bridge attack. Bug bounty programs have expanded in scope to cover bridge relayer and validator logic specifically, an area that was historically underweighted relative to core contract audits. And a growing number of protocols now run continuous on-chain monitoring that flags anomalous mint or withdrawal patterns in real time, aiming to catch an attack mid-execution rather than after the fact, since incidents like the June attack unfolded in just 12 minutes, faster than most manual review processes can respond.
Key management has also become a bigger focus than contract-level audits for many teams, a direct response to the finding that infrastructure compromise drives roughly three-quarters of dollar losses despite being a minority of incidents. That means multisig threshold increases, hardware security module custody for admin keys, and stricter separation between deployment keys and operational keys are becoming standard practice rather than a nice-to-have.
Predictions: Where DeFi Exploits Go From Here
- Attack frequency keeps climbing through late 2026. With Q2 already setting a record for incident count, expect Q3 and Q4 to stay elevated as more capital flows into newer, less-audited protocols chasing yield.
- Average payout per incident keeps shrinking. The 75% drop in median loss per exploit since 2022 should continue as protocols adopt tighter TVL caps and circuit breakers that limit how much a single exploit can drain before automated pauses kick in.
- Bridges remain the top target through 2027. Until finality-based verification becomes the default rather than the exception, cross-chain infrastructure will keep absorbing a disproportionate share of losses relative to its TVL.
- Credential and key-compromise attacks overtake smart contract bugs as the top dollar-loss category. If the 76%-of-losses-from-15%-of-incidents pattern holds, expect more headline-grabbing nine-figure hacks to trace back to a stolen key rather than a code flaw.
- Insurance and recovery infrastructure becomes a competitive differentiator. Protocols that can point to real coverage and a track record of fund recovery, rather than just an audit badge, will have an edge in attracting institutional liquidity after a year of high-profile losses.
Frequently Asked Questions
How much has DeFi lost to exploits in 2026?
Figures vary by tracker. DefiLlama counts more than $1 billion stolen across 140+ exploits year-to-date, while Immunefi’s more conservative DeFi-specific figure puts H1 2026 losses at $680.3 million. TRM Labs’ broader crypto-hack total, which includes non-DeFi incidents, reaches $972 million for H1 2026 alone.
Why did Q2 2026 set a record for DeFi exploits?
DefiLlama logged 99 separate incidents in Q2 2026, the highest quarterly count in its database. Analysts attribute the spike to a growing number of newer, less-audited protocols entering the space alongside a rise in credential and key-compromise attacks that don’t require finding a code bug.
Are cross-chain bridges more dangerous than other DeFi protocols?
The data suggests yes, relative to their size. Bridges hold an estimated $21.94 billion in TVL but accounted for $328.6 million in losses across just eight incidents in 2026, a disproportionate share driven by weak signature verification and missing finality checks.
What caused the $127 million June 2026 bridge hack?
Attackers exploited a signature replay vulnerability. The bridge’s validators signed cross-chain messages without a chain-specific nonce or block height, so a valid signature from one chain could be reused to authorize a fraudulent withdrawal on another, draining $127 million from three protocols in 12 minutes.
Is DeFi getting safer or more dangerous in 2026?
Both, depending on the metric. Total dollar losses are down 74% from the 2022 peak and median loss per exploit has fallen 75%. But attack frequency is up sharply, with Q2 2026 setting an all-time record for incident count, so the risk of any individual protocol being hit has arguably increased even as catastrophic losses have become less common.
What percentage of DeFi losses come from smart contract bugs versus stolen keys?
TRM Labs’ H1 2026 data shows infrastructure and key compromise made up about 15% of incidents but roughly 76% of dollar losses, while smart contract exploits made up the majority of incident count but a smaller share of total money stolen.
How much of stolen DeFi funds get recovered?
Recovery rates remain low. CoinPaprika’s Q1 2026 data shows about $9 million recovered out of $137.7 million stolen, a recovery rate near 6.5%, underscoring how quickly stolen funds move beyond reach once they cross a bridge or hit a mixer.
What can users do to reduce their exposure to DeFi exploits?
Favor protocols with public audit histories, active bug bounty programs, and transparent multisig or hardware-backed key management. Limit exposure on any single bridge, and treat cross-chain transfers as higher-risk than same-chain activity given the concentration of 2026’s losses in bridge infrastructure.
Related Coverage
- Bridge Crypto Safely: 12 Steps After $328M in Hacks
- Coreum Bridge Hack Drains 200K XRP in 97 Minutes
- Harmony ONE Crashes 37% as Hacker Mints 4B Tokens
- Bitcoin Hacks Hit $130M as Red Team Finds 85 Bugs
- Smart Contract Audit: 12 Steps, 90 Min
- More Cryptocurrency Coverage
Sources: DefiLlama newsletter: 99 exploits, the most hacked quarter in DeFi history, DeepStrike: DeFi Hacks & Exploits Statistics 2026, CryptoTimes: crypto bridge hacks top $328M in 2026, CoinPaprika: DeFi Exploits in 2026, Bitcoin.com News: crypto bridge exploits hit $328.6M in May, Altfins: DeFi Hacks 2026 full incident list, and Autheo: Hyperbridge cross-chain bridge exploit.
