An attacker has drained $4.67 million from an Axelar-linked bridge on the Secret Network. The incident, which occurred on 10 June but was not detected until 17 June, exploited a critical vulnerability in a third-party smart contract responsible for managing wrapped assets.
Aztec Connect was already deprecated. The contracts were immutable. The funds were still there. That combination turned an old privacy bridge into a sitting target, and when the proof logic failed to bind what was verified to what was executed, $2.1M walked straight through the gap.
Q2 2026 exposed a darker shift in DeFi security. The biggest losses were not just contract bugs, but failures in bridges, key management, messaging layers and hidden control points. The attack surface has moved beyond the code, into everything the code is forced to trust.
A coordinated pattern of attacks targeting unverified smart contracts has led to the theft of at least $36 million across four separate DeFi protocols since January. The largest single loss was sustained by Truebit, an Ethereum-based project, which lost $26.2 million from an exploit of a contract.
Humanity Protocol has lost administrative control of its token bridges on the Ethereum and BNB Chain networks after an attacker acquired control of three of the six private keys governing its Gnosis Safe multisignature wallet.
Three protocols, Virtuals Protocol, Pleasing Market, and Zest Protocol, have announced the migration of their cross-chain infrastructure from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The announced value of the assets and infrastructure covered by these moves exceeds $1.
A United States court has ordered the reversal of a freeze on approximately $12.5 million of USD Coin (USDC) held within a smart contract operated by the privacy protocol Zama.
The United States Treasury Department has seized approximately $1 billion in cryptocurrency assets linked to the Iranian state. The action, confirmed by Treasury Secretary Scott Bessent, is a component of Operation Economic Fury, a broad financial pressure campaign targeting Tehran.
The NEAR Foundation has announced the activation of a confidential payments feature built upon its new Intents protocol. The initial implementation enables users to execute private cross-chain swaps, sending NEAR tokens from the NEAR network and receiving ETH on the Ethereum mainnet. The system is d
On 17 May 2026, an attacker exploited a vulnerability in the Verus-Ethereum bridge, extracting digital assets valued at approximately $11.6 million. The stolen assets, which included various tokens native to the Verus ecosystem, were immediately swapped for Ether (ETH) on decentralized exchanges. Th
THORchain is offline. The entire network was halted by its operators after an attacker drained roughly $10.8 million from its liquidity pools on May 15th. All swaps, deposits, and withdrawals are frozen. The theft hit native assets from Bitcoin, Ethereum, BNB Chain, and Base, and the protocol's RUNE
A contract declared dead two years ago just drained $1.88 million from user wallets. On May 13, the cross-chain aggregator Transit Finance announced the loss, which occurred on the TRON network. The attacker used what the team called “historical vulnerabilities” in a legacy smart contract, one the p