Cryptocurrency hackers stole more than $168.6 million from 34 decentralized finance (DeFi) protocols during the first quarter of 2026, according to data from DefiLlama. The figure represents a significant decline compared to the first quarter of 2025, when $1.58 billion was taken — the majority of which came from a single $1.4 billion exploit targeting exchange Bybit. Despite the drop, security professionals caution that crypto hacking activity does not follow predictable seasonal patterns.
The largest single incident of the quarter was a $40 million private key compromise targeting Step Finance in January. The second-biggest attack was a smart contract manipulation on January 8 that drained $26.4 million in Ether (ETH) from Truebit. A third major incident involved a private key compromise against stablecoin issuer Resolv Labs on March 21, rounding out the quarter’s most damaging exploits.
Nick Percoco, chief security officer at crypto exchange Kraken, told Cointelegraph that cybercriminal activity in the crypto space tends to rise around market and event-driven cycles rather than fixed calendar periods. He noted that threat actors gravitate toward areas where liquidity is most concentrated, meaning attack spikes often follow wherever value is accumulating fastest. Bull markets, major product launches, and rapid growth phases all create more attractive conditions for attackers, he said.
“More value is at stake and new infrastructure can introduce risk,” Percoco explained. He described the threat landscape as a broad mix of actors operating at varying levels of sophistication, from highly coordinated groups targeting core infrastructure to opportunistic hackers scanning for weaknesses in smart contracts and client-facing systems. Organized cybercriminal networks also form part of this ecosystem, according to Percoco.
Percoco emphasized that targeting is rarely random, with attackers often conducting deliberate assessments of infrastructure, code, access controls, and even human behavior. The common thread across these groups, he said, is their focus on global, liquid, and accessible value. North Korea-linked actors have remained a persistent threat to both crypto investors and Web3-native companies throughout this period.
Hackers affiliated with North Korean organizations have been suspected in numerous attacks, including a recent incident involving Drift Protocol, a decentralized cryptocurrency exchange that lost an estimated $285 million to a private key leak. The attack on Drift Protocol occurred on a Wednesday and is among the more significant incidents attributed to state-linked threat actors. Security experts have previously flagged such groups as among the most capable and persistent in the space.
Looking ahead, security professionals have warned that 2026 is likely to see a rise in sophisticated credential theft, social engineering, and AI-powered attacks. The evolving nature of these threats means that both established platforms and newer projects remain at risk. As value continues to accumulate across DeFi ecosystems, experts suggest that robust security practices and infrastructure audits remain critical for the industry.
Originally reported by CoinTelegraph.
