$1.3 Billion Lost to DeFi Hacks: Private Keys Now Top Threat

The decentralized finance (DeFi) space has seen significant losses in 2026, with $1.3 billion stolen from various protocols in just eight months.

This is a record-breaking amount and marks a shift in the way DeFi hacks occur. Compromised private keys have become the leading cause of losses, surpassing smart contract bugs for the first time on record.

Two notable incidents occurred in April: Drift Protocol lost $285 million after attackers spent months on a social engineering campaign to secure an admin key, while KelpDAO lost $290 million after a single verifier on its LayerZero bridge was compromised. Both hacks have been attributed to North Korea's Lazarus Group.

The Coldcard firmware bug in July resulted in an estimated $130 million loss when attackers brute-forced their way into wallet seeds. This incident highlights the vulnerability of private keys, which are often seen as a secure option for self-custody advocates.