99 exploits. The most hacked quarter in DeFi history.

Welcome to the DefiLlama Newsletter. Each week we bring you the most valuable onchain insights from the the deepest DeFi dataset in the world.

Q2 2026 saw more hacks than any quarter on record with 99 hacks in the DefiLlama database.

Q1 2025 holds the “value stolen” record, but 2026 has seen over 140 exploits so far, combining for over $1b in value stolen.

April, May and June all saw 30+ exploits, and after BonkDAO’s malicious governance proposal resulting in a $20m token drain, July isn’t off to a great start either.

Protocol logic exploits were by far the most common attack, but they were smaller on average than infrastructure failures. Drift’s admin key attack and Kelp’s LayerZero bridge exploit represent over 80% of value stolen this quarter.

39 of these hacks happened on Ethereum. The large value stolen totals on Arbitrum and Solana are mostly the result of fewer, larger hacks.

Zooming out across all hacks in DefiLlama’s database going back to 2016, private key compromises are responsible for 44% of total value stolen. 16 of Q2’s 99 incidents and 45% of dollar losses trace back to some form of key or access-control compromise.

Key management is still one of the biggest preventable risks for protocols. While DeFi users need to remember that “Audited” does not mean “Guaranteed Safe”, enabling multi-party computation, hardware-backed signing and eliminating single-attestor verification are legitimate and available risk mitigators for teams.

Across hacks with usable TVL data, the correlation between the dollar amount stolen and 30d TVL drawdown this quarter is essentially zero. A protocol that loses $250k sees roughly the same percentage TVL exodus as one that loses $25m.

Across 59 historical hacks with meaningful pre-hack TVL, the vast majority retain less than 10% of their pre-hack TVL.

The following factors are more impactful to a protocol’s reputation than the pure dollar amount:

The problem with a hack is not the dollar amount lost, it’s the reputational hit from being hacked at all.

For DeFi users, knowledge is power. Be aware of the risks of protocols you’re depositing into.

DefiLlama Risk data help you understand what risks you’re taking on through a variety of scenarios and dependencies. For example, let’s analyze Morpho’s GTUSDCP vault on Base.

Right away we know what our exits are, what backs the vault and the vault’s track record.

We know the detailed exposure of each asset in the pool, and what our risk is if oracle fees are mispriced.

Aside from a total loss due to a smart-contract bug, the Risk Scenario list shows us a -30% drop in the price of collateral results in a possible loss of up to 16% of the vault’s value. At 50%, the possible loss rises to 37%.

We can use incident history, multisig setup, voter concentration and dependencies this pool relies on that can affect your deposit. This coverage is expanding and should be standard practice for users. For now, you can find it on select vaults - just look for “View risk data” on our Yields page.

Schedule a call with our (human) analyst team at DefiLlama Research for more market insights and to explore our market intelligence tools.

A purpose-built LLM, allowing users to instantly analyze DefiLlama’s comprehensive, up-to-the-minute crypto data with plain language queries.

This Pendle Revenue Overview dashboard includes metrics, revenue streams, the Boros expansion and token valuation data.

The DefiLlama team put together a MiCA compliance dashboard to help EU users find the right exchange from all the compliant options:

Tag @llama on X to quickly verify onchain data, see trends and tell your friends they’re wrong.

What do you want to see in the DefiLlama Newsletter?

Reply and let us know. See you next week.