DeFi has lost $1.3 billion to hacks in 2026 and the same attack keeps working

Compromised keys, not broken code, now drive the majority of crypto theft, and North Korea is cashing the checks. Summary DeFi protocols have lost at least $1.3 billion to exploits in the first eight months of 2026, according to Forbes and CertiK, with compromised private keys overtaking smart contract bugs as the leading attack vector for the first time on record. Drift Protocol lost $285 million on April 1 after attackers spent months social engineering their way to an admin key, then drained the protocol in 128 seconds. KelpDAO lost $290 million 17 days later through a single compromised verifier on its LayerZero bridge. North Korea’s Lazarus Group (operating as TraderTraitor) has been attributed to at least $575 million of 2026 losses across the Drift and KelpDAO hacks alone, meaning a single state actor accounts for roughly 44% of the year’s total. Bridge infrastructure remains the dominant failure point. AFX Trade ($24.15 million), VerusCoin ($19.14 million across two exploits), and the Cosmos EVM underflow chain ($20.8 million across MANTRA, TAC, and KiiChain) all involved cross-chain verification layers that broke in the same predictable way. The Coldcard hardware wallet ex...