For the First Time, Stolen Keys Cost DeFi More Than Broken Code

DeFi hacks 2026 losses now total at least $1.3 billion across more than thirty exploits, and for the first time on record compromised keys have caused more losses than smart contract bugs.

The year's largest incidents

Read the method column. Session keys, an admin key obtained by social engineering, a firmware bug in a hardware wallet, compromised validator signatures, an authorisation logic flaw. Exactly one of the top seven — Tectonic — is a contract-level exploit, and even that used the protocol exactly as written.

Why DeFi hacks in 2026 shifted from code to keys

Contract code got harder to break. Fifteen years of audits, formal verification, bug bounties and shared libraries have made the classic vulnerabilities — reentrancy, integer overflow, unchecked external calls — genuinely rare in production code from established teams.

Attackers responded by attacking somewhere else. Compromising an individual through social engineering, session hijacking or phishing is cheaper than finding a novel contract flaw, and the payoff is identical.

The sentence that summarises the year: a protocol can pass a flawless code audit and still lose millions because of a compromised admin key.

An audit examines the contract. It does not examine key management, operational security, off-chain infrastructure, the developer's laptop, the RPC endpoint the team uses, or the firmware in the hardware wallet holding the multisig. That is where the attack surface moved.

The KelpDAO case is the instructive one

The April KelpDAO attack, at $290 million, did not target KelpDAO's contracts at all.

The attacker compromised LayerZero developer session keys and poisoned RPC infrastructure — the connection layer between an application and the blockchain. Nothing in KelpDAO's own code was flawed, and no audit of it would have found anything.

That is a supply-chain attack, and it is the pattern most likely to define the next two years. Modern DeFi protocols depend on dozens of external components: bridges, oracles, RPC providers, front-end hosting, node infrastructure, developer tooling. Each is a potential entry point, and almost none is covered by the security review the protocol commissions for itself.

Who is doing it

North Korea's Lazarus Group, operating as TraderTraitor, accounts for approximately 44% of 2026 losses. The Drift and KelpDAO attacks alone brought in $575 million.

Combined with the $1.5 billion Bybit theft in February 2025, the group's eighteen-month total exceeds $2 billion.

That attribution changes the nature of the problem. A financially motivated attacker can be negotiated with — white-hat bounties of 5% to 10% have recovered funds in dozens of cases. A state-sponsored actor pursuing sanctions evasion has no interest in a bounty, and recovery prospects collapse accordingly.

It also means the adversary is patient, well-resourced, and conducting long-horizon social engineering campaigns against named individuals. Drift's attacker obtained an admin key by social engineering. That is not opportunism; it is targeted intelligence work.

What recovery looks like now

Poor, with occasional exceptions that prove the rule.

Arbitrum's Security Council seized 30,766 ETH from one attacker's wallet using emergency powers. That worked because the funds sat on a chain with a governance body capable of acting and willing to use that capability.

Which raises the same trade-off that has run through every major incident this year. Cronos halted to contain Tectonic. Injective stopped producing blocks for three hours and forty-two minutes during a $4.9 million exploit. Arbitrum's council seized funds directly. Each intervention protected users, and each demonstrated that the chain in question has an off switch.

Bitcoin and Ethereum do not have one. Neither has ever been halted, and the cost of that guarantee is that losses run to completion.

What would actually reduce the numbers

Three changes, none of which is a better audit.

Treat key management as the primary control. Hardware-backed signing, quorum requirements for administrative actions, time delays on privileged operations, and mandatory rotation. Most protocols still have a single admin key or a small multisig held by people who use the same laptops for everything else.

Extend security review to the supply chain. The RPC provider, the bridge, the oracle and the front-end host are all in scope. KelpDAO's $290 million loss came through infrastructure the protocol did not own.

Assume the adversary is a state. Financially motivated attackers are deterred by cost. A national intelligence programme is not, and defences calibrated against opportunists will keep failing.

What to watch

The Liquid post-mortem. Whether the peg-out authorisation flaw is specific to Blockstream's implementation or generic to federated bridge designs.

Whether the 44% attribution rises. If a single state actor accounts for half the sector's losses, this is a national security problem being handled as a software problem.

Insurance pricing. On-chain cover protocols reprice against realised losses. Their premiums are the closest thing to an honest market estimate of protocol risk.

Audit scope language. If audit firms begin explicitly covering operational security and infrastructure, the industry has accepted where the attack surface actually is.

The defence that would have worked

Look at the top incidents and ask, for each, what control would have prevented it.

KelpDAO: pinned RPC endpoints and session key expiry. Drift: a time delay on privileged administrative actions, so a socially engineered key cannot execute instantly. AFX Trade: geographic and organisational separation of validator signers. Coldcard: independent entropy verification at manufacture.

None of those is a contract change. All of them are operational controls, and all are standard practice in traditional financial infrastructure, where the assumption that an insider or a supplier may be compromised is built into the design rather than treated as an edge case.

DeFi inherited its security culture from open-source software, where the code is the artefact and review of the code is the assurance. That worked while contracts were the attack surface. The attack surface moved, and the culture has not caught up.

About this report. Loss totals, incident details, attribution and the Arbitrum seizure are from crypto.news reporting of rekt.news leaderboard data through August 2026. The Liquid Network figures are from Shattered.io and Bloomberg for 6-7 September. Tectonic and Injective details are from CertiK's August report and CryptoSlate. Figures cover disclosed incidents above $3 million.

Not investment or security advice. Consult a qualified security professional for protocol design decisions.

Frequently asked questions

How much has DeFi lost to hacks in 2026?

At least $1.3 billion in the first eight months across more than thirty exploits above $3 million. The $320 million Liquid Network incident on 6 September pushes that toward $1.6 billion.

What is the most common attack now?

Compromised private keys and admin credentials. Attackers find social engineering, session hijacking and phishing cheaper than discovering contract flaws, and audits do not cover key management, operational security or off-chain infrastructure.

Related reading

• Liquid Hack: 85% of Bitcoin Returned, $47M Kept as Bounty
• Elements Range Proof Bug: How 4,000 Fake L-BTC Was Minted
• White Hat Bounty Norms: Who Decides What a Hacker Keeps?
• DeFi Market Cap $78bn Against $1.6bn in 2026 Hack Losses

Sources

• DeFi has lost $1.3 billion to hacks in 2026 and the same attack keeps working — crypto.news
• Liquid Network Hack: $320M Bitcoin Sidechain Exploit — Shattered.io
• The Largest Hardware Wallet Exploit of 2026: the $116 Million Coldcard Hack — TRM Labs
• DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything — altFINS