DeFi and cross-chain exploit losses have already reached about $816.9 million across the major named incidents tracked so far in 2026, putting the year on pace to become one of the most damaging periods for onchain security.
The wider crypto security picture is even larger. Total Web3 hack and exploit losses have reached about $1.1 billion across 185 incidents this year, with bridge attacks, governance compromise, oracle manipulation, supply-chain failures, signer compromise, admin-key incidents and phishing-linked infrastructure attacks all contributing to the total.
The largest damage came from two incidents. Drift Protocol lost about $285 million, while KelpDAO lost about $292 million to $293 million. Together, those two attacks drained about $577 million and accounted for most of the year’s crypto hack value through April, with DPRK-linked groups tied to the biggest losses.
Largest Reported 2026 Losses
| Incident | Reported Loss |
|---|---|
| KelpDAO / LayerZero bridge exploit | ~$292M–$293M |
| Drift Protocol governance / oracle / social-engineering hack | ~$285M |
| Step Finance treasury-wallet compromise | ~$30M–$40M |
| Truebit exploit | ~$26.4M |
| Resolv Labs / USR minting exploit | ~$23M |
| Rhea Finance slippage / routing exploit | ~$18.4M |
| SwapNet exploit | ~$13.4M |
| Grinex exchange hack | ~$13M |
| Verus–Ethereum Bridge exploit | ~$11.58M |
| THORChain Asgard vault compromise | ~$10.7M |
| YieldBlox oracle-manipulation exploit | ~$10.2M |
| IoTeX / ioTube bridge compromise | ~$8.3M |
| SagaEVM supply-chain / bridge exploit | ~$7M |
| TrustedVolumes RFQ swap-proxy exploit | ~$6.7M |
| Wasabi Protocol admin-key / infrastructure compromise | ~$5M–$5.7M |
| MakinaFi exploit | ~$4.1M |
| Aperture Finance exploit | ~$4M |
| Venus Protocol / THE market exploit | ~$3.7M |
| Volo Protocol vault compromise | ~$3.5M |
| CrossCurve bridge exploit | ~$3M |
| Sweat Foundation token-contract exploit | ~$2.5M–$3.5M |
| TAC Cross-Chain Layer / TON-side exploit | ~$2.8M |
| StablR stablecoin contracts exploit | ~$2.8M |
| Solv Protocol double-mint exploit | ~$2.7M |
| RetoSwap / Haveno protocol-logic exploit | ~$2.7M |
| Hyperbridge forged cross-chain transaction exploit | ~$2.5M |
| FOOMCASH zk-proof / verifier exploit | ~$2.26M |
| Dango smart-contract exploit | ~$1.9M |
| Transit Finance legacy TRON contract exploit | ~$1.88M |
| BSC / TMM reserve-manipulation exploit | ~$1.6M |
| Purrlend multisig / bridge-role compromise | ~$1.5M |
| TMX / TMXTribe exploit | ~$1.4M |
| Ekubo Protocol extension-contract exploit | ~$1.4M |
| GiddyDeFi / GiddyVault exploit | ~$1.3M |
| CoW Swap DNS / phishing redirect incident | ~$1.2M |
| Aftermath Finance fee-accounting exploit | ~$1.14M |
Using midpoint estimates for the reported ranges, the named incident list totals about $816.9 million. Additional smaller incidents tracked through exploit databases push the wider 2026 crypto security loss total toward the $1.1 billion mark.
Bridge And Governance Failures Lead The Damage
Bridge and cross-chain systems remain the highest-risk layer. The KelpDAO exploit released about 116,500 rsETH after attackers abused off-chain infrastructure and a single-verifier setup, turning the $294 million KelpDAO exploit into the largest DeFi-linked loss of the year.
Drift Protocol added a different failure pattern. The attack involved social engineering, governance access, pre-signed transactions and fake collateral mechanics rather than a simple contract bug. The two incidents together have already shaped the year’s loss table, with Drift and KelpDAO driving most North Korea-linked crypto hack losses through April.
Cross-chain risk also widened beyond the biggest bridge failure. Verus–Ethereum Bridge, ioTube, Hyperbridge, TAC Cross-Chain Layer, CrossCurve and SagaEVM all appeared in the 2026 loss list. Bridge losses alone have already reached about $328.6 million in 2026.
Smaller Protocol Exploits Keep Adding Up
The second layer of damage came from mid-sized and smaller protocol failures. Truebit, Resolv Labs, Rhea Finance, SwapNet, YieldBlox, TrustedVolumes, Wasabi Protocol, Venus/THE, Solv Protocol and StablR all added seven- or eight-figure losses.
These incidents hit different parts of DeFi infrastructure: oracle pricing, routing logic, minting controls, vault accounting, RFQ swap proxies, token contracts, admin keys and fee systems. The spread shows that 2026 losses are not concentrated in one exploit class. Attackers are finding value wherever permissions, price feeds, bridges, liquidity routing or governance controls can be bent.
April alone brought more than $620 million in crypto exploit losses, followed by another Wasabi Protocol admin-key incident with losses estimated around $4.5 million.
2026 Losses Put Security Back At The Center Of DeFi
The year’s loss profile now covers nearly every major DeFi risk category. Bridges account for the largest headline damage, governance compromise created one of the biggest single losses, and smaller protocol bugs continue to drain capital across vaults, swaps, stablecoins and perps.
The running total leaves DeFi with little room for weak controls. Signer management, verifier diversity, oracle design, timelocks, routing checks, mint limits, admin-key security, incident response and bridge monitoring are now direct market risks rather than technical back-office details.
If losses continue at the current pace, 2026 will remain in contention for one of the heaviest exploit years on record. The damage so far is already clear: about $816.9 million from major named DeFi and cross-chain incidents, and roughly $1.1 billion across the broader crypto hack landscape.
