Crime & Security1 min readThe AssayerLook-back
Q2 2026 in crypto hacks: Drift and Kelp lost $588 million within 17 days
Crypto losses rose to $818.1 million in the second quarter of 2026, from $168.2 million in the first, according to the Bitminer.io failures ledger. The number of incidents more than doubled, to 113 from 49. Most of the extra incidents were small: 69 were under $1 million, against 18 in the second quarter of 2025.
Most of the money went in two attacks, 17 days apart.
Drift
On April 1, attackers took admin control of Drift Protocol, a Solana trading platform. They got members of its Security Council to pre-sign transactions that could be held and sent later, then used a fake collateral token to drain about $295 million. Security firms linked the attack to North Korea’s Lazarus Group. It ranks 14th of the 1,272 incidents with a known loss.
Kelp
On April 18, the rsETH bridge run by Kelp DAO lost $293 million. Attackers used social engineering to reach LayerZero RPC nodes, the servers that supply blockchain data to the bridge’s verifier, and injected fake cross-chain messages. The bridge relied on a single verifier, which left 20 chains exposed. The attack was attributed to Lazarus Group.
Together the two made up $588 million, or 71.9% of the quarter’s losses.
The rest of the quarter
Humanity Protocol lost about $32 million from its admin wallets in June after the private key of a foundation member was compromised, and 447 million H tokens were minted without authorisation. Rhea Lend, a lending platform on NEAR, lost about $18.4 million when an attacker set up fake tokens and pools over several days and got its price feed to accept their prices.The quarter’s only exchange loss was at Grinex, which lost about $13.74 million from its wallets on Tron and Ethereum and then suspended operations. OFAC had designated Grinex in August 2025, linking it to the Garantex exchange.
Nine incidents of $10 million or more made up 85.5% of losses. DeFi protocols lost $739.8 million across 77 incidents.
Sources
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
More on North Korea, Bridge hacks
