Crypto Hacks Surged to $763M in Q2 2026 as Operational Failures Spike

Crypto hacks stole $763,971,791 across 67 incidents in Q2 2026, with accessibility weaknesses the single biggest point of failure.

The state of crypto hacks in Q2 2026

According to a recent report by blockchain security and compliance firm Hacken, Q2 saw crypto hacks rise by 58.3% from Q1’s $482.7 million and netted the highest losses since Q2 2025.

Source: hacken.io

Drift Protocol and KelpDAO suffered the two biggest capital extractions at about $290 million each.

While smart contract bugs accounted for most incidents, their cumulative loss only mounted to just 11% of all losses. Operational and infrastructural failures, including compromised keys and signers, took the bigger pie at 88.3% of all losses.

As for the perpetrators, 75.5% of the funds drained were attributed to Democratic People’s Republic of Korea (DPRK) actors.

Note that Consensys, the company behind Ethereum’s wallet MetaMask, recently acknowledged hiring a software developer linked to North Korea. Realizing this a month later, the individual was fired and his system access revoked. The firm reported the incident to law enforcement while reassuring users that no funds were lost, no data was leaked, and no malicious code was deployed.

The report also documents that Q2 witnessed the first case of AI malicious prompt injection causing an exfiltration of $174,000. Here, the firm notes that failure comes from “inadequate review, missing variants and weak testing.”

The state of regulatory compliance in Q2 2026

In terms of regulatory compliance, US crypto regulations under the GENIUS Act will be effective in early 2027.

In the European Union, the grace period for crypto players to pursue a full license expired on July 1. By this time, only about 215 Crypto-Asset Service Providers (CASPs) had acquired Markets in Crypto-Assets Regulation (MiCA) authorization despite 1,200 expressing interest.

Binance, MEXC and HTX (formerly Huobi) are among the most prominent exchanges that were forced to shut down under this rule. Additionally, Circle’s USDC is so far the only MiCA-compliant stablecoin out of the top 10 in terms of market cap.

Nonetheless, Hacken notes that the most trusted counterparties in the future will be the ones that prove safety first, regardless of their existence period, their audits, and total value locked.