Crypto recorded 207 hacks in the first half of 2026 — a record count — while total stolen funds fell 57% to about $972 million, according to TRM Labs. More attacks, less money. That pairing is being read as evidence that security is improving. Look at how the two largest breaches actually happened and a less comfortable reading emerges: the honeypots got harder, and the ones that fell did not fall to cryptography. They fell to configuration.
Five decentralised finance (DeFi) protocols accounted for roughly $955.9 million of losses between January and June. The largest, KelpDAO, lost $292 million on April 18 — and its root cause was a single line of trust.
KelpDAO fell on a default, not a zero-day
KelpDAO, a liquid restaking protocol on Ethereum, was drained of 116,500 restaked Ether (rsETH) worth roughly $293 million through a compromised supply chain combined with a distributed denial-of-service attack.
The mechanism deserves attention from anyone running cross-chain infrastructure. KelpDAO used a 1-of-1 verifier configuration for messages arriving over LayerZero: a single node checked inbound cross-chain messages before funds were released. Compromise that node and the protocol has no second opinion. That is not an exotic cryptographic failure — it is a quorum of one, left in production.
Drift Protocol, a DeFi trading venue on Solana, lost about $285 million on April 1. Between them, the two incidents account for the majority of the half-year’s DeFi losses. Neither required breaking a hash function. Both required someone to find the weakest link in an operational setup and pull it.
The $3,000 server that could have taken $70 billion
The counterexample is instructive. Security researchers at Hexens found a stale-cache bug in the Aptos Move virtual machine that produced a type-confusion vulnerability — the ability to treat one class of on-chain resource as another, which in practice meant seizing protocol permissions such as stablecoin minting rights and bridge controls. Direct Aptos-native assets at risk were around $250 million. Counting cross-chain bridges, stablecoin administration flows and centralised exchange exposure, the systemic figure was approximately $70 billion (CoinDesk).
The researchers reproduced it on a $3,000 server, with a success rate near 90% across roughly 20 attempts. No validator access, no insider knowledge, no special permissions.
“It ran as claimed, and the exploit made sense,” said Mudit Gupta, chief technology officer at Polygon, who reviewed the finding.
Aptos patched it within hours of the February 25 disclosure, deploying a private-validator fix ahead of the public commit on February 27. “A fix was developed, tested, and deployed to mainnet within hours of discovery. No users or funds were impacted at any point,” an Aptos spokesperson said.
The response was exemplary. The implication is not. Justus Hanna, chief executive of Grego AI, put the counterfactual bluntly: attackers “would have been able to take all [the] TVL that they want[ed].”
The honest reading of the data
Put the two halves together and the sector’s security posture looks less like a system that has hardened and more like one that got lucky on the tail. The record count tells you attackers are probing constantly and finding small doors. The falling loss total tells you large protocols have raised their floors — audits, multisigs, bounties. But the KelpDAO post-mortem tells you a top-tier protocol still shipped a one-of-one verifier, and the Aptos case tells you the difference between a $70 billion systemic event and a routine patch note was which team found the bug first.
State-linked activity compounds the concentration risk. North Korea-linked actors alone are estimated to have stolen $643 million in the first half — a majority of the total, and a category that does not respond to bug bounties.
What operators should take from this
Three conclusions for anyone running a protocol, a bridge, or an exchange integration. First, cross-chain messaging verifier configurations are now the highest-leverage audit item in DeFi. A 1-of-1 verifier is a single point of failure with the entire treasury behind it, and KelpDAO is the proof.
Second, systemic exposure is no longer measurable at the chain level. Aptos-native TVL was $250 million; the blast radius was $70 billion. The gap is bridges, stablecoin admin keys and exchange integrations — which means a chain’s risk is a function of what is plumbed into it, not of what sits on it.
Third, the institutional cohort is drawing the obvious conclusion. Custody and settlement are moving toward permissioned infrastructure — the direction of travel behind Swift’s blockchain ledger going live with 17 banks — while retail users, prompted by regulation, are moving the other way, with 70% of Binance’s EU users self-custodying after MiCA. Both cohorts are reducing exposure to the same layer: the smart-contract middle.
The loss figure fell this half. The count did not. And the mechanism behind 2026’s largest DeFi hack was a configuration choice any reviewer could have caught — the least reassuring finding in the dataset, because it means the ceiling on losses is set by attacker attention, not defensive depth. The next stablecoin consortium shipping cross-chain infrastructure should read the KelpDAO post-mortem before its own launch deck.
Karthik Subramanian
Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem. He covers token economics, L1/L2 infrastructure, DeFi protocols, wallets/custody, and the bridge between crypto and forex—broker technology, liquidity, and macro drivers. Karthik’s writing focuses on clear, practical frameworks that help professionals evaluate new products and on-chain innovation alongside FX market realities.
