DeFi protocols have lost at least $1.3 billion to exploits through the first half of 2026, with compromised private keys overtaking smart contract bugs as the leading attack vector for the first time on record. North Korea's Lazarus Group alone accounts for roughly 44% of the year's losses, and a separate Coldcard hardware wallet flaw shows the problem now reaches beyond DeFi protocols.
Two hacks, $575 million, 18 days
Attackers drained Drift Protocol of $285 million on April 1 without touching a single line of smart contract code. They spent months posing as a quantitative trading firm and building trust with Drift contributors, then used pre-signed authority from the Security Council to whitelist a worthless token backed by a fake oracle and withdraw the funds in 128 seconds.
Seventeen days later, on April 18, KelpDAO lost $290 million through its LayerZero bridge after attackers social-engineered a developer's session keys and poisoned the RPC infrastructure feeding the bridge's verifier network. The stolen tokens went into Aave as collateral, and Aave's total value locked dropped $6.28 billion in 48 hours as nine protocols froze markets.
Lazarus accounts for nearly half the year's losses
Investigators linked both hacks to TraderTraitor, a subgroup of North Korea's Lazarus Group. Mandiant, CrowdStrike, Elliptic, and LayerZero jointly confirmed the KelpDAO attribution, and Lazarus is attributed to at least $575 million of 2026 losses across the two hacks alone. Combined with the $1.5 billion Bybit hack from February 2025, the group's rolling 18-month tally exceeds $2 billion.
The Coldcard hack shows the problem runs deeper
On July 30, a firmware bug in Coldcard hardware wallets swapped the random number generator for a predictable fallback, shrinking wallet seed entropy to a brute-forceable range. Attackers who never touched a network extracted private keys directly, and Galaxy Research tracked roughly $130 million in losses across thousands of wallets by August 7.
None of the three exploits required a code bug. The keys, not the contracts, are where the money is going.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
