Stolen Keys Outpace Smart Contract Bugs in 2026 DeFi Attacks
2026 saw a significant shift in the types of attacks on DeFi protocols, with compromised private keys surpassing smart contract bugs as the primary cause of losses. According to two independent surveys, at least $1.3 billion was lost due to stolen keys, accounting for more than half of all DeFi attacks by incident count.
The shift is attributed to the ease with which attackers can steal a private key, often through phishing or malware, without leaving any obvious signs of a breach. In contrast, smart contract bugs are typically identified and patched before an attack occurs.
Crypto.news analyzed three documented incidents where compromised keys were used to drain funds from accounts: Drift Protocol, KelpDAO, and AFX Trade on Arbitrum. The attackers in these cases used various methods to obtain the necessary keys, including posing as support staff and requesting recovery phrases.
The article also highlights the importance of auditing not just the contract code but also who holds the administrative rights and how many authorized signers are required for transactions. A single-verifier configuration in bridges and cross-chain applications can also pose a risk if the verifier is compromised.