2026 Q2 Web3 Security Incidents: $764 Million Stolen, 88.3% from Compromised Keys and Infrastructure
2026-07-23 11:34
According to the quarterly Security and Compliance Report by Hacken, 67 security incidents in the Web3 space resulted in losses of $763.9 million in Q2 2026, making it the most severe quarter since Q2 2025. Compromised keys and infrastructure accounted for 88.3% of the stolen funds, approximately $674.5 million.
Smart contract vulnerabilities remained the most common type of attack, linked to 44 out of the 67 incidents, but corresponding losses represented only about 11% of the total. Approximately 75.5% of the losses stemmed from two incidents attributed to North Korean threat actors, and 14 audited protocols were breached during the quarter.
Leo Fan, founder of Cysic, stated that an audit is a point-in-time assessment of a specific codebase and does not automatically cover signature devices, cloud infrastructure, operational permissions, subsequent upgrades, third-party dependencies, or old contracts that remain callable. Samuel Videau, CTO of Genius, pointed out that nearly 90% of losses came from compromised keys, signers, and infrastructure.
Multiple security leaders noted that Web3 security requires layered defenses including real-time monitoring, key management, multi-party authorization, and bug bounty programs. Leo Fan expects that operational access control attacks will continue to dominate losses in the second half of 2026, including social engineering, credential theft, compromised signers, cloud or CI/CD intrusions, and attacks on off-chain validator infrastructure.
Smart contract vulnerabilities remained the most common type of attack, linked to 44 out of the 67 incidents, but corresponding losses represented only about 11% of the total. Approximately 75.5% of the losses stemmed from two incidents attributed to North Korean threat actors, and 14 audited protocols were breached during the quarter.
Leo Fan, founder of Cysic, stated that an audit is a point-in-time assessment of a specific codebase and does not automatically cover signature devices, cloud infrastructure, operational permissions, subsequent upgrades, third-party dependencies, or old contracts that remain callable. Samuel Videau, CTO of Genius, pointed out that nearly 90% of losses came from compromised keys, signers, and infrastructure.
Multiple security leaders noted that Web3 security requires layered defenses including real-time monitoring, key management, multi-party authorization, and bug bounty programs. Leo Fan expects that operational access control attacks will continue to dominate losses in the second half of 2026, including social engineering, credential theft, compromised signers, cloud or CI/CD intrusions, and attacks on off-chain validator infrastructure.
Recommended Articles
