If you ask most people how a major crypto hack happens, they’d probably picture broken code, smart contract bugs, or even Hollywood-style cyberattacks. The largest crypto thefts in the first half of 2026 were on a new level. This time, attackers relied on patience, deception, and operational weaknesses rather than software flaws to launch attacks.
According to Chainalysis, the attackers behind the $280 million Drift Protocol exploit spent months posing as a quantitative trading firm, meeting contributors in person across multiple jurisdictions before bypassing the protocol through a sophisticated social engineering operation. A few weeks later, under a similar ploy, KelpDAO lost $292 million to someone who had quietly compromised a bridge verifier long before and simply waited for the right moment to pounce.
So, this half, staggering sums of money were lost due to individuals getting compromised, hijacked infrastructure, and stolen credentials. Familiar security issues, like logic errors and oracle manipulation, still occurred early in the year, but the biggest incidents targeted bridges, private keys, DNS systems, and access controls, areas that code audits usually miss. In response, there has been a marked uptick in crypto protocols focusing more on blockchain forensics, AI monitoring, and insurance products to maintain safety and minimize damage from breaches.
TL;DR
- Crypto security in 2026 has moved decisively from smart contract exploits to human and infrastructure-layer attacks.
- North Korean state-affiliated actors accounted for 76% of all crypto hack value globally through April 2026, with just two attacks, Drift Protocol ($280M) and KelpDAO ($292M), representing the majority of stolen funds despite making up only 3% of the total incident count.
- Cross-chain bridges remain the ecosystem’s most structurally dangerous component, concentrating value across isolated networks in ways that turn a single verification failure into an immediate multi-chain liquidity event.
- Traditional audits are losing ground as a primary defence, with detection accuracy ranging from 31% to 94%, and real-world exploits increasingly emerging from cross-system interactions and off-chain attack paths that standard audit scope never covers.
Major Security Breaches in H1 2026
In Q1 2026, Web3 security losses reached roughly $450M across 145 incidents, including retail rug pulls, phishing scams, and major protocol hacks. Attackers focused heavily on people and infrastructure.
The quarter was heavily influenced by a single $282M social engineering and phishing attack, which pushed January’s losses to about $370 million. Activity then dropped sharply in February to $26.5 million, the lowest monthly total in nearly a year, before rising again to $52 million across 20 incidents in March.
By Q2, total losses exceeded $840M across 50+ incidents, which points to a diversion away from isolated smart contract bugs toward credential theft and infrastructure compromise.
April was the most damaging month, with more than $630 million lost across 14 major incidents. Two attacks alone, Drift Protocol ($280 million) and KelpDAO ($292 million), accounted for over 90% ($577M) of the month’s losses.
May losses fell sharply to $68.3 million across 12 major incidents, but the underlying attack patterns remained unchanged. Cross-chain bridges still accounted for 42% of monthly losses, while other incidents involved stolen access credentials, DNS hijacking, weak permission controls, and bridge logic flaws rather than vulnerabilities in core smart contracts.
By June, the trend had shifted even further toward access-layer compromises. The Humanity Protocol exploit began after attackers stole a private key belonging to a foundation member, allowing them to drain more than $30 million before extending the attack across multiple chains. The incident showed that compromising a single credential could still result in significant losses even when the protocol code remained secure.
Unlike previous years, most losses did not come from smart contract bugs. Instead, attackers increasingly targeted people and infrastructure through phishing, private key compromises, cloud systems, and bridge validators, bypassing secure code altogether.
Drift Protocol Showed That People Had Become the Weakest Link
The Drift Protocol hack was not caused by a bug in the protocol’s smart contracts. Instead, attackers spent months tricking trusted people into giving them the access they needed.
Based on our investigation to date:
– This was not the result of a bug in Drift’s programs or smart contracts
– There is no evidence of compromised seed phrases
– The attack involved unauthorized or misrepresented transaction approvals obtained prior to execution, likely…— Velocity (@VelocityDEX) April 2, 2026
According to Drift’s post-mortem investigation, the group posed as a legitimate quantitative trading firm and built relationships with Drift contributors through Telegram chats, conference meetings, and product discussions over about six months. They even deposited more than $1 million into the protocol to appear like genuine users and gain trust.
Once they had earned that trust, the attackers convinced members of Drift’s Security Council, the group responsible for approving sensitive protocol changes, to sign transactions that appeared harmless. In reality, those transactions secretly transferred administrative control of the protocol to the attackers.
With admin access, the attackers created a fake token that looked valuable because they controlled its price and trading activity. They configured the protocol to accept the token as collateral, deposited hundreds of millions of dollars’ worth of the fake asset, and used it to borrow and withdraw about $280 million in real cryptocurrencies from Drift’s vaults.
Within minutes, the stolen assets were swapped, bridged to other blockchains, and moved through multiple wallets, making recovery far more difficult.
Drift Protocol has now rebranded to Velocity DEX, saying its new name reflects “a cleaner architecture, a stronger security foundation, and a clearer sense of what this platform was built for.”
The attack showed that even well-audited protocols can be compromised when attackers gain access to trusted administrators. Rather than exploiting the code itself, they exploited the people and operational processes that controlled it.
Cross-Chain Bridges Are The Hottest Targets
Cross-chain bridges have become one of the biggest security risks in crypto because they move assets between blockchains that cannot directly verify each other’s transactions. Instead, they rely on external systems to confirm that an asset has been locked on one chain before releasing it on another. If that verification process is compromised, attackers can withdraw real assets without making a legitimate deposit.
KelpDAO exposed a weakness beyond smart contracts
The $292M KelpDAO exploit, which took place on April 19, showed that attackers no longer need to break a protocol’s code to steal funds. Instead of exploiting a smart contract bug, they targeted the off-chain infrastructure responsible for verifying cross-chain transactions.
KelpDAO used LayerZero to move rsETH between blockchains. Before assets could be released on the destination chain, LayerZero’s verification network had to confirm that the same assets had been burned or locked on the source chain.
The attackers compromised internal RPC nodes that supplied blockchain data to LayerZero’s verification network. At the same time, they launched a distributed denial-of-service (DDoS) attack against external RPC providers, forcing the verifier to rely almost entirely on the compromised nodes.
Those manipulated nodes falsely reported that 116,500 rsETH had been burned on the source chain, even though no such transaction had occurred. Believing the information was legitimate, the bridge released approximately $292 million worth of rsETH on Ethereum to the attackers. Every transaction appeared valid on-chain because the verification system itself had been deceived.
KelpDAO quickly paused the affected bridge, blacklisted the attacker’s addresses, and worked with security responders to stop a second attempt that could have drained another 40,000 rsETH, worth roughly $95 million. Days later, the Arbitrum Security Council froze a significant portion of the stolen assets before they could be fully laundered.
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times,…
— Arbitrum (@arbitrum) April 21, 2026
Bridge attacks are becoming more common
KelpDAO was not an isolated case. Earlier in the year, the ioTube Bridge lost $4.4 million after attackers compromised private keys, while CrossCurve suffered a $3 million exploit caused by missing validation checks in its bridge contract. Hyperbridge also lost $2.5 million, and Dango experienced a bridge-related smart contract exploit. Together, these incidents show that attackers are exploiting every layer of bridge infrastructure, from private keys and validation logic to off-chain messaging systems.
Smart Contract Failures and Audit Limitations
Smart contract exploits are mostly caused by flawed protocol design, weak access controls, and business logic mistakes, not basic coding errors.
In Q1, smart contract-related exploits accounted for approximately $86.2M in direct losses.
Limits of traditional auditing methods in complex protocols
Despite widespread adoption of security audits, 2026 data shows that audit coverage does not reliably prevent exploitation. According to ResearchGate, security tools used in audits exhibit highly variable performance, with detection accuracy ranging from 31% to 94% and false-positive rates of up to 32.6%, limiting their reliability in complex environments.
In simple terms, passing a security audit does not guarantee a protocol is safe. Audits are designed to check whether smart contract code works as intended, but they can miss flaws in how protocols interact with governance systems, cross-chain infrastructure, and other off-chain components. As attacks become more sophisticated, audits alone are no longer enough to prevent major security breaches.
A move toward non-code exploitation
The smart contracts in many of these incidents ran exactly as they were written. The problem was who was sending the instructions. Attackers gained control through compromised identities, stolen credentials, and manipulated authorization systems, then used that access to direct protocols that were working perfectly against their own users.
Rise of Social Engineering and Human-Level Exploits
Hardening smart contract code has pushed attackers toward the humans who operate the systems around it.
Human access points have become the preferred attack surface
There were several big losses that resulted from the manipulation of authorization, credentials, and trust relationships in H1 2026. Finding exploitable bugs in audited code has become harder and slower. Going after the person with admin access is faster and, based on the Q1 numbers, considerably more profitable.
High-value phishing campaigns replaced broad exploit attempts
Attackers are now positioning themselves between users and the services they trust, waiting for the moment a credential or approval passes through.
Weak operational controls now drive many major breaches
A pattern across incidents in H1 shows that the entry point was usually not the blockchain itself. Insider misuse, compromised email accounts, exposed admin panels, and weak signing permissions repeatedly served as the first step before attackers move into financial infrastructure.
Identity security is becoming as important as smart contract security
Attackers increasingly use social engineering because it’s often easier and cheaper than finding smart contract bugs, while delivering similar financial rewards.
Code audits check what a protocol does. They say nothing about who controls it or how access to that control is protected. Protocols may remain technically secure while still suffering significant losses through human and operational weaknesses.
RELATED: Crypto Security Remains the Industry’s Most Expensive Weakness
Growth of Security Tooling and Monitoring Systems
Security tooling has changed from investigating what went wrong to trying to catch it in progress. Chainalysis now monitors more than 150 blockchains and thousands of tokens in real time, giving investigators visibility across almost the entire crypto ecosystem.
Some tools have moved past detection into automated intervention. For instance, advanced monitoring software, such as Forta, uses automation features, such as “pause and respond,” which can stop or slow down any malicious behaviour by the smart contract. The approach focuses on blocking rather than just detecting potential threats.
Moreover, AI-driven tools are significantly faster compared to traditional methods for checking security threats. These tools can identify attack patterns in seconds and detect multi-step attack sequences that are invisible to conventional rule-based tools. That matters specifically in DeFi, where multi-step exploits unfold across several transactions before the damage becomes visible.
On the user’s side, the prototype CryptoGuard dashboard can demonstrate how AI can be used to analyze the behaviour of the wallet in real-time and notice abnormal activities, including sudden big transactions or dangerous contract interactions.
Role of blockchain transparency in improving detection
Blockchain analytics platforms like TRM Labs provide real-time AML screening and transaction risk scoring across multiple chains, using the public nature of blockchain data as the foundation for ongoing monitoring rather than post-incident investigation.
Institutional systems now apply Know Your Transaction (KYT) monitoring across hundreds of thousands of wallets. What used to be a passive property of public blockchains is now active infrastructure for compliance and threat detection.
Security platforms now integrate real-time on-chain analytics with risk-scoring dashboards, providing continuous visibility into protocol health and abnormal transaction flows across ecosystems.
Insurance and Risk Mitigation Mechanisms
As crypto losses scale into hundreds of millions per incident, insurance and structured risk transfer mechanisms are becoming a parallel security layer in 2026.
How crypto insurance markets are evolving
The global crypto insurance market is estimated at $13.8 billion in 2026 and projected to reach $192.72 billion by 2033. This is driven by the growth of institutional custody and the rising frequency of exploits.
DeFi insurance platforms such as Nexus Mutual have already provided about $6.96 billion in crypto coverage since inception, showing that demand for on-chain coverage exists even if the market is still early.
Insurance solutions in DeFi include coverage for smart contract exploits, protocol failures, stablecoin depegging, and exchange hacks, using pooled capital and payout mechanisms enabled by smart contracts.
Use of treasury risk strategies and reserve management
Some of the leading insurance pools like Nexus Mutual have shared capital reserves that are used to pay for exploit claims. They behave similarly to shared balance sheet reserves in the traditional insurance system.
DeFi insurance protocols are run through capital pools raised by underwriters and liquidity providers, who receive premium payments in exchange for risk exposure or risk-to-yield conversion.
Parametric insurance is a new form of insurance that triggers payouts and ensures automatic payment upon fulfilment of preconditions, rather than requiring a manual claim review process. At the same time, on-chain coverage systems such as those developed by Nexus Mutual are moving toward more structured, expert-led claims assessment and more efficient use of reserve capital.
New approaches like OpenCover’s Covered Vaults are also embedding insurance directly into DeFi vault products rather than treating coverage separately. Both changes aim to make payouts more predictable and keep reserves solvent as exploit frequency increases.
Security Is a Constant Race With No Final Winner
Crypto security in H1 2026 does not reach a “safe point”. Every defensive improvement creates pressure on the other side to find a way around it. The gap between an attack and a defence has stayed narrow throughout H1 2026, and there is no obvious reason that changes.
The protocols and custodians that held up best in the first half of 2026 were not the ones that avoided being targeted; they were the ones that were able to monitor their systems and build enough stamina to limit the damage and wreckage when something got through. Perhaps the right question to ask going forward is not whether these attacks can be stopped entirely, but whether systems can absorb them without experiencing catastrophic failure.
Disclaimer: This article is intended solely for informational purposes and should not be considered trading or investment advice. Nothing herein should be construed as financial, legal, or tax advice. Trading or investing in cryptocurrencies carries a considerable risk of financial loss. Always conduct due diligence.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
