Over $840 million drained in five months. 50+ incidents. A 70% year-over-year increase. But the most important shift in 2026 DeFi security isn’t the dollar amount — it’s where the attacks are coming from.

A day without a crypto hack has become a rarity in 2026. By the end of April — just four months in — DeFi protocols had collectively lost more than $750 million to exploits. Add May and partial June figures and the running total exceeds $840 million.

But the dollar total isn’t the most important story. The more significant shift is where the attacks are coming from. Three of the four largest incidents in 2026 did not involve a single line of flawed Solidity. The smart contracts did exactly what they were programmed to do — they were given fraudulent instructions by attackers who had obtained access they shouldn’t have had.

This article documents every major DeFi exploit of 2026 to date, explains the attack vectors behind each, and examines what the data collectively signals about the direction of DeFi security risk.

Q1 2026: The familiar attack playbook

The year opened with a more recognisable set of attack vectors. Three protocols — Step Finance, Resolv, and Truebit — each lost more than $25 million in Q1 to oracle manipulation, logic flaws, and unchecked permission errors. These are the vulnerabilities that DeFi security researchers have been writing about for years. Well-audited protocols generally survive them; newer or faster-moving projects often don’t.

Q1 total losses reached approximately $137 million. At the time, that looked like a serious but not unprecedented quarter. Then April arrived.

April 2026: $630M in 30 days

April set a grim record. Fourteen major incidents. Over $630 million in confirmed losses. Two attacks alone — Drift Protocol and KelpDAO — accounted for $577 million of that total. What made April different wasn’t just the scale. It was that neither of the two biggest exploits involved a smart contract vulnerability.

Drift Protocol — $285 million (April 1)

The mechanism was creative. The root cause was human. Six months of relationship-building, trust-gaining, and operational patience — then a single window of access was all it took.

KelpDAO — $292 million (April 19)

May 2026: $68M and twelve incidents

May brought a sharp drop in headline losses — $68.3 million total, down from $630M in April. But twelve incidents exceeding $1M each is not a quiet month by historical standards. Both old and new attack vectors appeared side by side.

June 9, 2026 (today): Humanity Protocol

As this article is being written, the Humanity Protocol exploit is unfolding. It fits the 2026 pattern precisely — and it’s worth examining in detail.

All major DeFi incidents of 2026

Ranked by confirmed loss  ·  Data as of June 9, 2026  ·  Sources: Halborn, CCN, CoinDesk, Chainalysis

The shift in attack vectors: what the data shows

Koinly reports that compromised accounts now account for more than 50% of all DeFi attacks by incident count — overtaking traditional smart contract exploits as the primary source of losses for the first time. By dollar value, the skew is even more pronounced in 2026.

The North Korea factor

Chainalysis attributes approximately 76% of crypto-related hack losses globally in 2026 to state-backed actors linked to the Lazarus Group. North Korea’s cumulative crypto theft now exceeds $6 billion in attributed incidents since 2017.

These are not opportunistic attackers. They are well-resourced, patient, and increasingly focused on the human layer — precisely because the code layer has become harder to crack. A six-month social engineering campaign is a professional operation, not an opportunistic exploit.

What this means for DeFi security

The industry’s security infrastructure is still largely oriented toward the previous problem. Code audits address code vulnerabilities. They do not address:

• Insider threats and social engineering at the team level
• Private key management and hardware security module policies
• Single-point-of-failure bridge configurations (single DVN vs multi-verifier)
• DNS and domain infrastructure security
• RPC node compromise and off-chain data integrity

These are not exotic new attack surfaces. They are basic operational security failures. The question the industry needs to address is why they keep occurring at scale, and whether security due diligence frameworks — for protocols, investors, and users alike — need to be reoriented accordingly.