Operational failures drove 88% of $763M in Q2 crypto hacks. North Korea linked to 75% of stolen funds as MiCA deadline shuttered exchanges.
Alpha Score of 40 reflects weak overall profile with moderate momentum, poor value, moderate quality, moderate sentiment.
Crypto hacks stole $763,971,791 across 67 incidents in Q2 2026, a 58.3% jump from Q1, according to a report by blockchain security firm Hacken. The total marked the highest quarterly losses since Q2 2025.
Operational and infrastructural failures drove the damage. While smart contract bugs accounted for most individual incidents, their cumulative loss reached just 11% of all funds drained. The bigger piece – 88.3% – came from compromised keys and signers, the report said. Drift Protocol and KelpDAO suffered the two biggest capital extractions at about $290 million each.
North Korea-linked actors were responsible for 75.5% of the stolen funds, the report found. The tally included an unusual case: Consensys, the company behind MetaMask, acknowledged hiring a software developer linked to North Korea. The firm fired the individual a month later and revoked system access, reporting the matter to law enforcement. Consensys said no funds were lost, no data leaked, and no malicious code deployed. The report also flagged the first known case of AI malicious prompt injection causing a $174,000 exfiltration, attributing the failure to “inadequate review, missing variants and weak testing.”
On the regulatory side, the European Union’s grace period for crypto service providers expired July 1. Only about 215 Crypto-Asset Service Providers had secured Markets in Crypto-Assets Regulation authorization by that date, despite 1,200 expressed interest, the report said. The rule forced several major exchanges out of the region, including Binance and MEXC. HTX, formerly Huobi, also exited. Circle’s USDC is the only MiCA-compliant stablecoin among the top 10 by market cap. U.S. crypto regulations under the GENIUS Act are scheduled to take effect in early 2027.
Hacken said the most trusted counterparties in the future will be those that prove safety first, regardless of their age, audits, or total value locked.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.