Eight months into 2026, the numbers tell an uncomfortable story: crypto has lost roughly $1.3 billion to hacks so far this year, and the industry's security spending was mostly aimed at the wrong layer. CertiK's Hack3d H1 2026 report, Forbes, and TRM Labs all converge on the same nine-figure total — and on the same taxonomy shift. For the first time on record, compromised private keys and the humans behind them, not broken smart contracts, drove the majority of losses by dollar value.
The rekt.news leaderboard counts more than 30 incidents above $3 million in 2026, and its July editorial "Wrong Attack Surface" crystallized the pattern: the biggest losses of the year all passed their audits. The code was fine. The keys, signers, and verification nodes around it were not.
Two Hacks, One Playbook, $575 Million
The year's defining window ran from April 1 to April 18.
On April 1, Solana's largest perpetuals exchange Drift Protocol lost $285 million in 128 seconds. The attackers never touched the protocol's smart-contract logic. According to the subsequent reconstruction, they spent months posing as a quantitative trading firm — attending conferences, meeting Drift contributors in person across multiple countries — until they obtained pre-signed authority from Drift's Security Council using a durable nonce, a legitimate Solana feature. They whitelisted a worthless token, deposited 500 million of it as collateral against an oracle they had controlled for three weeks, and withdrew $285 million in USDC, SOL, and ETH.
Neodyme's 2024 audit of Drift had flagged the exact mechanism — an admin instruction that accepted an oracle account with no validation — and rated it informational, reasoning that only the admin could call it. Two years later, the admin key was in the wrong hands, and the informational finding became a nine-figure exit. The rating was not wrong; the threat model was.
Seventeen days later, KelpDAO lost $290 million through its LayerZero bridge. The method was different but the surface was the same: a single person. Someone social-engineered a LayerZero Labs developer on March 6, lifted their session keys, and used the access to poison the RPC infrastructure feeding LayerZero's verifier network. External nodes were DDoS-ed into silence, the remaining compromised nodes signed a forged cross-chain message, and the bridge minted 116,500 unbacked rsETH. The stolen tokens went into Aave as collateral, real WETH was borrowed against them, and the funds moved before the emergency multisig could assemble enough signatures to pause. Aave's total value locked fell $6.28 billion in 48 hours, and nine protocols froze markets.
One Threat Actor, 44% of the Year
Investigators attributed both hacks to TraderTraitor, a subgroup of North Korea's Lazarus Group. Mandiant, CrowdStrike, Elliptic, and LayerZero jointly confirmed the KelpDAO attribution; Elliptic tied Drift to the same unit with medium-high confidence. Add the two together and a single state actor accounts for at least $575 million — roughly 44% of the year's total losses.
This is the same unit behind the $1.5 billion Bybit hack of February 2025, Radiant Capital, the Ronin Bridge, WazirX, and Harmony's Horizon Bridge. The U.S. Treasury, FBI, and CISA have published joint advisories naming the group. What changed in 2026 is the patience of the social-engineering layer: relationships built over months at conferences in Drift's case, a specific developer's session credentials in KelpDAO's. The technical exploitation began only after the human layer had already fallen.
Bridges Keep Breaking the Same Way
The bridge tier — where a small set of signers, validators, or verifier nodes must confirm that a message on one chain is valid before funds release on another — produced the year's other headline failures. AFX Trade lost $24.15 million in July when five compromised validator signatures cleared the two-thirds quorum on its Arbitrum USDC bridge, 49 days after the platform had promoted a security audit from Zellic that documented zero test coverage and left acknowledged findings unfixed; the bridge's 200-second dispute window disputed nothing. VerusCoin's Ethereum bridge was drained twice, $11.6 million in May and $7.54 million in July — same bridge, different gap in the same trust boundary, no communication the second time. The Cosmos EVM underflow bug took $20.8 million across MANTRA, TAC, and KiiChain in a single week.
The fix is known: multi-verifier configurations requiring several independent verification networks before release would have stopped both the KelpDAO and AFX Trade drains. LayerZero publicly blamed KelpDAO for running a single-verifier setup; KelpDAO countered with Dune data showing that 47% of all LayerZero OApp contracts — more than 1,200 of them — use the same configuration, reviewed by LayerZero across eight documented integration conversations over two and a half years with no objection raised. The infrastructure supports the defense. Almost nobody applies it.
The compromised-key problem is not confined to DeFi. July's Coldcard firmware vulnerability — a hardware RNG flaw that silently fell back to a guessable software source — let attackers brute-force seeds offline, with roughly $130 million reported stolen across thousands of wallets, no phishing or malware required.
What the Year Actually Teaches
CertiK co-founder Ronghui Gu put it plainly: a protocol can pass a flawless code audit and still lose everything to a compromised admin key. The 2026 evidence converts that from caution to base rate. Human-reviewed engagements examine smart-contract logic; the losses are coming from key custody, signer independence, verifier redundancy, and the people who hold those credentials.
That gap is where the industry's attention now has to move: how many independent verifiers stand behind a bridge, whether admin authority can be exercised instantly or only after delay, what happens to a "deleted" data-retention promise at a third-party vendor, and whether a session token held by one developer can mint unbacked assets on another chain. None of those questions are answered by a clean audit report — and all of them were decisive in 2026's largest thefts.
TrustGrade is building security scoring for exactly this gap — verifier configuration, key-management posture, and operational signals around the code, not just the code itself. Verified, registry-backed scores arrive with TrustGrade Code Scoring in December 2026.