$1.3 Billion Lost: Compromised Keys Now Dominate DeFi Hacks

DeFi hacks have reached unprecedented levels in 2026, with losses totaling over $1.3 billion in just eight months. This year's trend marks a significant shift from previous years, where smart contract bugs were the primary cause of losses. Now, compromised private keys are driving most of these losses.

Two notable incidents in April, Drift Protocol and KelpDAO, account for nearly half of this year's total losses. Drift lost $285 million on April 1 after attackers spent months social engineering an admin key, while KelpDAO lost $290 million just 17 days later due to a compromised single verifier on its LayerZero bridge.

The Lazarus Group has been linked to both incidents and is responsible for at least $575 million of this year's DeFi losses. This state-linked actor has become notorious for exploiting trust rather than code, making them a major player in 2026's DeFi hacks.