Crypto hackers walked away with $763,971,791 across 67 incidents in Q2 2026, a 58.3% jump from the $482.7 million logged in Q1, according to a report by blockchain security firm Hacken. The quarter marks the heaviest single-period losses the sector has recorded in recent memory.

Accessibility weaknesses, broadly described as failures in how protocols manage privileged access and operational controls, accounted for the largest share of the damage. These are not exotic zero-day exploits. They are process breakdowns: multisig schemes misconfigured, key management left sloppy, admin functions exposed. The Unleash Protocol incident is a clean illustration. PeckShield confirmed that attackers drained $3.9M by exploiting a multisig vulnerability, a mechanism that is supposed to require multiple approvals before any funds move. It did not.

Operational Failure Is the Pattern, Not the Exception

What Hacken's data makes clear is that the threat landscape has shifted. Sophisticated smart contract bugs are still present, but the 67 incidents in Q2 skew heavily toward what security professionals call 'operational failures': the human and procedural layer sitting above the code. A protocol can pass a formal audit and still hemorrhage funds if the team running it has not secured its own access infrastructure.

For investors, this distinction matters. Audits have become a standard checkbox in DeFi due diligence, yet they demonstrably did not prevent the bulk of Q2 losses. The question to ask before allocating capital is no longer only 'has this been audited?' but 'who holds the keys, how many people need to sign, and what happens if one of them is compromised?' Projects that cannot answer that clearly carry a risk profile that no smart contract audit can neutralize. As the LitVM situation showed, even extensive testing history does not insulate a protocol from structural exposure.

At $763M lost in a single quarter, the annualized pace would approach $2.5 billion, which would exceed 2024's full-year totals by a wide margin. Whether Q3 sustains that trajectory depends largely on whether teams treat Hacken's findings as a call to restructure their operational security or simply wait for the next audit cycle.

This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.