Crypto protocols endured an unprecedented 83 attacks in the second quarter of 2026, marking the highest frequency of exploits on record, according to an analysis by Unfolded based on data from DefiLlama. This surge in incidents contrasts with a total loss figure of approximately $755.3 million for the quarter, significantly below the $3.56 billion stolen in Q4 2020. Today, THORChain announced the full resumption of its cross-chain trading, following a 39-day halt caused by a $10.7 million exploit in May.

Global markets exhibit caution, with major tech indices declining while Bitcoin and Ethereum experience downward pressure, gold retreats, and the DOW maintains a flat trajectory.

Exploit Frequency Surges Amid Reduced Aggregate Losses

The second quarter of 2026 recorded 83 distinct crypto exploits, an all-time high in terms of incident count. This marks a notable shift from previous years, which saw fewer, but often larger, “mega-exploits.”

Despite the record number of attacks, the total value stolen in Q2 2026 stands at approximately $755.3 million. This figure is considerably lower than the $3.56 billion lost in Q4 2020, which remains the costliest quarter for crypto heists. This suggests attackers are targeting a broader array of smaller vulnerabilities rather than concentrating on single, high-value targets.

Cross-Chain Bridges Dominate Attack Vectors

Bridge exploits emerged as the most common and costly form of attack in Q2 2026, accounting for $351 million in stolen funds. These incidents exploit vulnerabilities in protocols designed to transfer assets between different blockchain networks.

The LayerZero OFT Bridge exploit, linked to the KelpDAO incident, was a primary contributor to these losses. It resulted in the theft of $293 million through a cross-chain bridge vulnerability. Another significant incident involved the Drift Protocol, which experienced a $280 million breach attributed to social engineering tactics, including those by North Korea’s Lazarus Group.

THORChain Navigates Recovery Post-$10.7 Million Breach

THORChain, a decentralized cross-chain liquidity protocol, announced on June 23, 2026, that it had fully restored trading operations. This follows a 39-day suspension initiated after a $10.7 million exploit on May 15, 2026.

The May exploit targeted one of THORChain’s Asgard vaults, exposing weaknesses in its GG20 Threshold Signature Scheme (TSS). Investigators determined a malicious node operator, who joined the network days prior, reconstructed a private key through progressive material leakage. The protocol addressed this by patching the flaw, implementing a new KeyVerify vault verification system, and undertaking an 11-stage security overhaul. This recovery effort underscores the ongoing challenges and adaptive measures within the DeFi sector following security breaches.

Sources:

• Crypto Sector Sees Record 83 Hacks in Q2 2026, Most-Exploited Quarter to Date: Report — Provides the core data on 83 hacks in Q2 2026 and total losses.
• Q2 2026 ramps up to close as crypto’s most hacked quarter on record – Cryptopolitan — Details the largest exploits like KelpDAO and Drift Protocol, and the shift to more frequent, smaller attacks.
• THORChain trading resumes after $10.7m exploit and month-long halt – Crypto News — Confirms THORChain’s resumption of trading today, detailing the exploit and recovery process.
• Q2 2026 Sets All-Time High for DeFi Hack Count With ~70 Exploits, $746M Stolen – “The Defiant” — Reinforces the record exploit count and the nature of these attacks.