The decentralized finance sector has endured a tumultuous year, with 121 separate security breaches in 2026 alone leading to losses of nearly $942 million. Industry data points to a notable surge in attack activity, highlighting the persistent vulnerabilities within DeFi protocols. With market participation weakening, investor confidence has been put under significant strain, raising key questions about the industry’s risk management.
Losses accelerate in the second quarter
According to CryptoRank, the second quarter of 2026 proved to be one of the most devastating periods for the crypto industry. In just three months, approximately $775 million was stolen across 85 distinct attacks. This single quarter accounted for over 80% of all funds lost throughout the year, making it the most intense quarter ever recorded for DeFi exploits.
The data also reveals that the number of incidents surged by 49 attacks compared to the next busiest quarter; however, the total financial damage did not eclipse earlier peak periods. This was primarily due to only two truly large-scale breaches dominating the quarter. Losses related to Drift Protocol and KelpDAO exceeded $590 million, which represented nearly half of all DeFi losses for the year.
CryptoRank underscores that the second quarter alone accounted for more than 80% of annual losses, revealing just how rapidly attack techniques continue to evolve across the DeFi ecosystem.
Drift Protocol and KelpDAO take center stage in major breaches
CryptoRank notes that some $285 million in assets was siphoned from Drift Protocol users in a coordinated social engineering attack. Blockchain intelligence firm TRM Labs has linked this breach to hacker groups associated with North Korea. The attackers reportedly convinced members of the Drift Security Council to authorize seemingly routine transactions which secretly conferred elevated permissions to the malicious actors.
Mini glossary: Social engineering is an attack method that exploits human behavior rather than technical flaws. Attackers deceive authorized individuals into approving apparently benign actions, thereby gaining critical system access.
Just weeks later, the infamous Lazarus Group targeted KelpDAO, exploiting a flaw in the LayerZero bridge infrastructure. The hackers made off with around $290 million in rsETH. KelpDAO is known as a DeFi protocol built around re-staked assets.
According to Chainalysis, the perpetrators took control of validator infrastructure, forged cross-chain messages, and managed to mint tokens on Ethereum without burning corresponding assets on Unichain.
Chainalysis explains that the attackers seized the protocol’s validator infrastructure, generated fraudulent cross-chain messages, and bypassed security checks. This opened the door for tokens to be minted on the Ethereum network without destroying equivalent assets on Unichain, creating a critical exploit path.
Mini glossary: LayerZero is an interoperability platform designed to facilitate asset and message transfers between different blockchains. Vulnerabilities in its validation layer can enable fraudulent cross-chain activity.
Total value locked falls as capital flight intensifies
The uptick in DeFi breaches coincided with already weakening market conditions. CryptoRank observed that the total value locked (TVL) in DeFi declined every month throughout the year, slipping from roughly $115.3 billion in January to just over $70 billion by end-June. Although security lapses were not the only cause, experts suggest the succession of high-profile incidents further accelerated the capital outflows.
The attack on KelpDAO notably increased the pressure in the market. Lending protocol Aave experienced an outflow of around $12 billion in under 24 hours. This sharp withdrawal caused Aave’s TVL to plummet from $26.4 billion to $14.3 billion, underscoring the contagious effect of loss of trust on major protocols.
| Indicator | Before | After |
|---|---|---|
| Annual TVL | $115.3 billion | Just over $70 billion |
| Aave TVL | $26.4 billion | $14.3 billion |
Fragmentation grows between blockchain platforms
Analysts stress that current conditions differ markedly from the sector-wide DeFi collapse of 2021 and 2022. CryptoRank emphasizes that there is now broader stablecoin supply, tokenization of real-world assets, and greater diversification of capital into lending, derivatives, and infrastructure layers.
Looking across chain platforms, Tron and Hyperliquid emerged as the only networks to record TVL growth in 2026. In stark contrast, Plasma and Arbitrum saw the sharpest declines, highlighting how sector turbulence is leading to a divergence between different blockchain ecosystems.
