According to a report from CryptoRank, the second quarter of 2026 set an all-time record for cryptocurrency exploits, with 85 incidents resulting in approximately $775 million stolen — the highest number of hacks ever recorded in a single quarter. The first half of the year saw a total of 121 DeFi attacks and $942 million in losses, while total value locked (TVL) in DeFi protocols continued its monthly decline from $115.3 billion in January to just over $70 billion in late June.
Drift Protocol and KelpDAO account for the bulk of losses
Two back-to-back attacks in April were responsible for more than half of the 2026 DeFi losses so far. Drift Protocol lost $285 million after attackers used social engineering to trick Drift Security Council multisig signers into pre-signing transactions that carried hidden admin authorizations. Blockchain intelligence firm TRM Labs traced the operation to North Korean hacking outfits, noting that preparations began on-chain as early as March 11 with a 10 ETH withdrawal from Tornado Cash — preceded by months of in-person meetings between Pyongyang proxies and Drift employees.
Less than three weeks later, the Lazarus Group struck KelpDAO, exploiting its LayerZero bridge infrastructure. The attackers forged a cross-chain message after compromising two remote procedure call nodes used by LayerZero’s Decentralized Verifier Network, while a third node was hit with a DDoS attack, forcing the system to rely on compromised verifiers. This allowed the minting of approximately $290 million worth of rsETH on Ethereum without burning the corresponding assets on Unichain.
Market impact extends beyond individual exploits
While hacks were not the sole driver of the TVL decline, CryptoRank noted that the frequency of incidents likely eroded user confidence and accelerated the rotation away from DeFi. Aave’s TVL, for instance, dropped from $26.4 billion to $14.3 billion within days of the KelpDAO attack — a 46% plunge representing $12 billion in withdrawn funds.
The current DeFi drawdown, however, has been structurally different from the 2021–2022 cycle. Stablecoin supply has grown to around $300 billion, real‑world asset tokenization is expanding, and capital is now spread across derivatives, infrastructure, and lending rather than being concentrated in a few AMMs and yield farms. Even so, only Tron (+5%) and Hyperliquid (+7%) managed to increase their TVL this year, while other major chains are deeply in the red — Plasma tumbled 74.6% and Arbitrum fell 55%.
