Crypto hackers stole approximately $75.9 million across 40 major incidents in June, a 7.1% drop from May's $81.7 million, according to blockchain security firm PeckShield. The decline offered limited relief, as losses remained widespread across bridges, private-key compromises, trading bots, deprecated infrastructure, and user-facing platforms, underscoring the broad nature of crypto security risks.
The largest incident was the Humanity Protocol exploit, with PeckShield estimating the loss at $31 million. The project's own investigation later placed the figure closer to $36 million. Founder Terence Kwok attributed the breach to a compromised private key. Onchain analyst Specter first reported the draining of over $31 million from connected wallets on June 9. PeckShield noted that the exploiter laundered stolen funds across Bitcoin, Solana, Hyperliquid, and BNB Chain, with some proceeds commingled with funds linked to the earlier Kelp DAO exploit, suggesting a possible connection between the two attacks.
Syscoin Bridge suffered a $10 million loss due to a validation flaw that allowed an attacker to mint billions of unbacked SYS tokens without a corresponding burn. A bot tied to the address JaredFromSubway.eth, known for MEV sandwich attacks, was itself exploited for $7.5 million. Other notable incidents included Secret Network, Polymarket users, SecondFi, and TESSERA, with losses ranging from $2.4 million to $4.67 million. Aztec's deprecated infrastructure was hit twice, with $2.16 million lost from the Aztec Bridge and $2.1 million from Aztec Connect, totaling roughly $4 million. These contracts, which the Aztec Foundation no longer controls or can pause, highlight the persistent danger of immutable legacy contracts.
Rounding out the top 10 were Taiko Bridge ($1.7 million), Token of Power ($1.58 million), Raydium ($1.34 million), and LABUBU/OLPC ($1.1 million). So far in 2026, crypto hacks and exploits have cost the industry well over $750 million, driven largely by two North Korea-linked attacks in April: Drift Protocol's $285 million loss via social engineering of governance signers, and Kelp DAO's $292 million bridge drain through a compromised verifier network.
