Q2 2026 exposed a darker shift in DeFi security. The biggest losses were not just contract bugs, but failures in bridges, key management, messaging layers and hidden control points. The attack surface has moved beyond the code, into everything the code is forced to trust.
Humanity Protocol has lost administrative control of its token bridges on the Ethereum and BNB Chain networks after an attacker acquired control of three of the six private keys governing its Gnosis Safe multisignature wallet.
Three protocols, Virtuals Protocol, Pleasing Market, and Zest Protocol, have announced the migration of their cross-chain infrastructure from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The announced value of the assets and infrastructure covered by these moves exceeds $1.
The Gravity Bridge, a protocol for asset transfers between Ethereum and Cosmos ecosystem chains, has been halted by its validators. The action followed a security incident where an attacker drained approximately $5.4 million in digital assets from the bridge’s primary Ethereum smart contract. The st
On 17 May 2026, an attacker exploited a vulnerability in the Verus-Ethereum bridge, extracting digital assets valued at approximately $11.6 million. The stolen assets, which included various tokens native to the Verus ecosystem, were immediately swapped for Ether (ETH) on decentralized exchanges. Th
After watching clients walk out the door with what was left of their assets, LayerZero Labs has finally taken some responsibility for a $292 million theft. The admission follows a period of blaming the victim, liquid restaking protocol Kelp DAO, for choosing an insecure setting. With Kelp and anothe
Anchorage Digital is preparing to onboard roughly twenty banks and technology corporations as stablecoin issuers, consolidating the post-GENIUS Act market into a single federally chartered chokepoint. The firm has reportedly secured every meaningful issuance mandate awarded inside the United States
The decentralised finance sector recorded its highest monthly incident count in April, with 28 separate exploits resulting in the loss of 635.2 million dollars. This figure represents a fourfold increase over the total losses recorded in the first quarter of the year. While the volume of attacks has
The landscape of digital asset security is shifting from simple protocol bugs to sophisticated social engineering and infrastructure compromises. Recent data indicates that over 600 million dollars has been lost to exploits in early 2026, driven largely by state-sponsored actors targeting systemic v
The Financial Conduct Authority, in coordination with HM Revenue and Customs and regional crime units, has conducted raids on eight locations across the United Kingdom. These operations targeted individuals and entities suspected of facilitating peer to peer cryptocurrency trading without state auth
Aave has partially restored functionality to its Wrapped Ether (WETH) reserves on the Ethereum Core V3 market, following a total freeze triggered by a $290 million exploit of the Kelp liquid restaking protocol. The incident began when an attacker manipulated a vulnerability in Kelp’s LayerZero bridg
Aave service providers have published an incident report detailing the protocol’s exposure to the April 18 exploit of the Kelp DAO rsETH bridge. The report outlines two primary scenarios for bad debt, ranging from 123.7 million to 230.1 million dollars, depending on how Kelp DAO chooses to allocate