DeFi has lost $1.3 billion to hacks in 2026 and the same attack keeps working

Compromised keys, not broken code, now drive the majority of crypto theft, and North Korea is cashing the checks.

Eight months into the year, and the crypto industry has already replayed the same failure mode enough times to fill a textbook. The attack surface has not changed. Protocols keep trusting a small number of keys, signers, and verification nodes, and attackers keep finding that it is cheaper to compromise one person than to break one smart contract.

The numbers are stark. CertiK’s Hack3d H1 2026 report and Forbes both put total crypto hack losses at $1.3 billion through the first half of the year. TRM Labs arrived at a similar figure, noting that losses were trending just below the $1 billion mark for DeFi alone. The rekt.news leaderboard, which tracks individual exploits above $3 million, lists more than 30 incidents from 2026 so far, with the top two alone accounting for $575 million.

What separates 2026 from prior years is not the dollar amount. It is the attack taxonomy. The year’s biggest thefts did not exploit reentrancy bugs, flash loan loops, or oracle manipulation. They exploited people. Social engineering, session hijacking, validator key theft, and governance capture now drive the majority of losses by dollar value. The code passed every audit. The humans around it did not.

Two hacks, one playbook, $575 million gone

The year’s defining moment happened in an 18-day window between April 1 and April 18.

On April 1, attackers drained Drift Protocol of $285 million in 128 seconds. Drift was Solana’s largest perpetuals exchange. The exploit did not touch a single line of smart contract logic. The attackers had spent months posing as a quantitative trading firm, attending conferences, meeting Drift contributors in person across multiple countries, and building the kind of trust that this industry runs on.

By the time they struck, they had obtained pre-signed authority from Drift’s Security Council using a durable nonce, a legitimate Solana feature. They whitelisted a worthless token called CVT, deposited 500 million of it as collateral against a fake oracle they had controlled for three weeks, and withdrew $285 million in USDC, SOL, and ETH.

Neodyme’s 2024 audit had flagged the exact mechanism. The report noted that admin instructions like InitializeSpotMarket accepted an oracle account with zero validation. It was rated informational, reasoning that only the admin could call it. Two years later, the admin key was in the wrong hands, and the informational finding became a nine-figure exit.

Seventeen days later, on April 18, KelpDAO lost $290 million through its LayerZero bridge. The method was entirely different. No conference circuit, no fake trading desk. Someone social-engineered a LayerZero Labs developer on March 6, lifted their session keys, and used that access to poison the RPC infrastructure feeding LayerZero’s verifier network. External nodes were DDoS-ed into silence. The remaining compromised nodes signed off on a forged cross-chain message, and the bridge minted 116,500 unbacked rsETH.

The stolen rsETH went straight into Aave as collateral, borrowed real WETH against itself, and moved out before the emergency multisig had assembled enough signatures to pause. Aave’s total value locked dropped $6.28 billion in 48 hours. Nine protocols froze markets. Arbitrum’s Security Council used emergency powers to seize 30,766 ETH from the attacker’s wallet on-chain, a move that split opinion almost as much as the exploit itself.

Both hacks passed their audits. Both teams had followed standard security practices. Both lost everything to a single compromised key.

The Lazarus assembly line

Investigators linked both Drift and KelpDAO to TraderTraitor, a subgroup of North Korea’s Lazarus Group. Mandiant, CrowdStrike, Elliptic, and LayerZero jointly confirmed the KelpDAO attribution. Elliptic tied Drift to the same unit with medium-high confidence.

This is not new. Lazarus was behind the $1.5 billion Bybit hack in February 2025, identified by on-chain investigator ZachXBT within hours. Before that, the same group hit Radiant Capital, the Ronin Bridge, WazirX, and Harmony’s Horizon Bridge across 2022 through 2024. The U.S. Treasury, FBI, and CISA have all published joint advisories naming the group and its tactics.

What changed in 2026 is the sophistication of the social engineering layer. The Drift attackers built relationships over months. The KelpDAO attackers targeted a specific developer’s session credentials. In both cases, the initial breach happened through trust, not technology. The technical exploitation only began after the human layer was already compromised.

CertiK’s Ronghui Gu put it plainly in an interview with Forbes: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.” That quote now reads more like a warning label than an observation.

Bybit has since sued North Korea, its intelligence agency, and the Lazarus Group in U.S. federal court, trying to recover assets from the $1.5 billion hack. The legal theory is novel, but it underscores how few options victims have when the attacker is a sovereign state.

The math is uncomfortable. Drift ($285 million) plus KelpDAO ($290 million) equals $575 million from a single threat actor in 18 days. Against a total 2026 loss figure of $1.3 billion, Lazarus accounts for at least 44% of all stolen funds. If you include the Bybit hack from late February 2025, the group’s rolling 18-month tally exceeds $2 billion.

Bridges keep breaking the same way

Bridges are crypto’s soft underbelly. They have been since the Ronin Bridge hack in 2022 ($624 million), the Wormhole hack ($326 million), and the Nomad hack ($190 million). Four years later, the pattern has not changed.

In 2026, bridge exploits include KelpDAO ($290 million, single-verifier compromise), AFX Trade ($24.15 million, five compromised validator signatures on an Arbitrum USDC bridge), and VerusCoin ($19.14 million across two separate exploits of the same Ethereum bridge in May and July). The Cosmos EVM underflow bug hit three chains in quick succession: MANTRA ($3.6 million), TAC ($7.5 million), and KiiChain ($9.7 million), all through the same cross-shard receipt replay vulnerability.

The common thread is verification. Bridges must confirm that a message or transaction on one chain is valid before executing it on another. That confirmation almost always relies on a small set of signers, validators, or oracle nodes. Compromise enough of them, and the bridge does exactly what it was designed to do: release funds on the destination chain against what it believes is a legitimate request from the source chain.

AFX Trade is a case study in how thin the margins are. On July 22, five compromised validator signatures cleared the two-thirds quorum on its Arbitrum bridge, draining $24.15 million in USDC. The attacker moved the funds to Ethereum, swapped for 12,467.5 ETH, and consolidated into a single wallet. All of this happened 49 days after AFX had proudly promoted a security audit from Zellic. That audit documented zero test coverage and left acknowledgments unfixed. The dispute window on the bridge was 200 seconds. It disputed nothing.

The VerusCoin Bridge was hit twice: $11.6 million in May, then $7.54 million in July. Same bridge, different gap in the same broken trust boundary. The second time, there was no statement, no bounty offer, no communication at all.

The fix is known but rarely applied. Multi-verifier configurations, where a bridge requires confirmation from multiple independent verification networks before releasing funds, would have stopped both the KelpDAO and AFX Trade exploits. LayerZero publicly blamed KelpDAO for running a single-verifier setup. KelpDAO fired back with Dune data showing 47% of all LayerZero OApp contracts, more than 1,200 of them, use the exact same configuration. Over two and a half years and eight documented integration conversations, KelpDAO says LayerZero reviewed its setup each time and raised no objections.

This is the real scandal. The fix exists. The infrastructure supports it. Almost nobody uses it.

Audits are checking the wrong surface

Rekt.news published an editorial in July 2026 titled “Wrong Attack Surface” that crystallized what the year’s exploits had been screaming: the biggest losses all passed their audits because auditors were checking the code, and the code was fine.

CredShields put it directly in their Drift post-mortem: the attack surface has moved “up the stack to governance, to signers, and to the people building the protocols themselves.”

Traditional smart contract audits review Solidity or Rust for reentrancy, overflow, and access control bugs. They do not review operational security practices, key management procedures, social engineering resilience, or the off-chain infrastructure that feeds data to on-chain contracts. The KelpDAO exploit happened in LayerZero’s RPC infrastructure, which sat outside every audit scope. The Drift exploit happened through social engineering that compromised an admin key, which no code audit is designed to catch.

The Coldcard exploit is the most extreme example. On July 30, 2026, attackers began draining Bitcoin wallets secured by Coldcard hardware devices. A firmware bug had swapped the hardware random number generator for a predictable software fallback, shrinking the entropy of wallet seeds to a brute-forceable range. No phishing, no malware, no stolen device. Attackers ran the math on their own machines, derived candidate addresses, matched them against the public blockchain, and extracted the private keys for free.

Galaxy Research traced the initial wave to 1,082.65 BTC stolen from 1,196 addresses in 41 minutes. By August 7, the high-confidence tally had grown to 1,596 BTC from roughly 7,300 addresses, with candidate-inclusive estimates pushing past 2,055 BTC, or roughly $130 million. More than 25 separate attack patterns were identified. At least 15 independent attackers exploited the same flaw.

Coinkite, the maker of Coldcard, issued a preliminary advisory the same day and CEO NVK posted a public apology. But a firmware update could not fix wallets whose seeds had already been generated with the broken entropy. Those seeds needed to be replaced entirely.

The Coldcard incident is not a DeFi hack in the traditional sense. It is something worse: proof that the compromised key problem runs deeper than protocol governance. Even users who did everything the self-custody playbook recommends, hardware wallet, offline signing, no third-party custody, lost funds because the key generation itself was flawed.

What actually fixes this

The boring answer is the correct one. The 2026 exploit pattern has three failure points, and each has a known mitigation that most protocols have not adopted.

Key management: Multi-party computation (MPC) wallets and hardware security modules (HSMs) with threshold signing eliminate the single-key risk that enabled the Drift hack. Timelock delays on admin actions, combined with on-chain monitoring that alerts when privileged transactions are queued, give security teams a window to respond. Drift’s 128-second drain worked because there was no delay between key compromise and fund extraction.

Bridge verification: Multi-verifier configurations, where two or more independent verification networks must agree before a bridge releases funds, are the direct answer to the KelpDAO single-verifier failure. LayerZero supports this natively. The fact that 47% of its applications still run single-verifier setups is a configuration problem, not a technology problem.

Operational security: No code audit can protect against social engineering. Protocols handling nine-figure TVL need dedicated operational security programs: hardware-enforced authentication for all privileged access, mandatory multi-signature requirements that cannot be bypassed by a single signer, and security training that treats social engineering as a primary threat vector.

The Cosmos EVM underflow bug offers a different lesson. Cosmos Labs had known about the bug since April 2026 but misjudged its severity. When it was finally exploited across MANTRA, TAC, and KiiChain in August, all three chains halted too late. The funds had already bridged out. Responsible disclosure only works if the recipients treat the disclosure with urgency.

Term Labs’ governance attack ($8.5 million, August 2026) points to another gap. Near-zero voter participation let one wallet seize control of the protocol’s vaults for minimal cost, bypassing the governance delay entirely. When nobody votes, governance is just another attack surface. Quorum requirements, vote-locking periods, and guardian mechanisms that can veto suspicious proposals during a review window are standard tools that Term Labs had not implemented.

What to watch

The second half of 2026 will determine whether the industry treats these failures as lessons or as tolerable costs of doing business. Five indicators will tell the story:

Multi-verifier adoption rate on LayerZero: If the percentage of single-verifier OApps drops meaningfully from 47% by year-end, the KelpDAO lesson landed. If it holds steady, expect a repeat.

Timelock adoption on admin keys: Watch for protocols above $100 million TVL implementing mandatory delays on privileged transactions. Drift’s 128-second drain should make this non-negotiable.

Lazarus Group attribution in new exploits: The U.S. Treasury, Chainalysis, and TRM Labs all track Lazarus activity. Any new attribution to TraderTraitor signals that the group’s social engineering pipeline remains operational.

Cosmos EVM patch adoption across IBC chains: The underflow bug hit three chains. Dozens more run the same codebase. The speed of patching across the Cosmos ecosystem will show whether cross-chain coordination has improved.

Insurance protocol payouts and capacity: On-chain insurance providers like Nexus Mutual and Sherlock absorbed significant claims in H1 2026. If underwriting capacity shrinks or premiums spike, it signals that the market is pricing in continued attacks at current levels.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions. Information is accurate as of Sept. 4, 2026.