security

Roughly $840 million to $1.3 billion has been lost to DeFi exploits in the first half of 2026 alone -- and the attack surface that's actually failing has quietly changed.
This week alone gave two fresh, dated examples: BounceBit permanently shut down its own Layer-1 after a protocol-level authorization flaw let an attacker drain 286.5M BB (~$3M) on Aug 19, and The Sandbox halted bridging on Base and BNB Chain after a LayerZero delegate-permission exploit inflated to a scary "$49B" headline number (the real loss was ~$675K) on Aug 22. Neither was a smart-contract logic bug in the traditional sense -- both were access-control and permission failures in cross-chain infrastructure.
That's not a coincidence, and it's not just two incidents making a trend out of nothing. It's the visible tip of a half-year pattern the aggregate data backs up.
The numbers behind the pattern
Trackers converge on roughly $840M-$1.3B in DeFi exploit losses across 200+ recorded incidents in H1 2026 -- with one tracker's Q2-alone count at 99 hacks and $746M. Two of the three largest single hacks of the year -- Kelp DAO (~$291.3M) and Drift (~$285M) -- individually exceed the largest single DeFi hack of either 2023 or 2024. And per the same tracker set, compromised-account and access-control breaches have overtaken smart-contract exploits as the leading attack vector by incident count for the first time on record.
Chainalysis attributes roughly 76% of 2026's crypto hack losses globally to Lazarus Group-linked, state-backed actors -- a striking number, but one that deserves a caveat: it's Chainalysis's assessment based on wallet-clustering and mixer-pattern inference, not a forensic certainty. Treat it as "Chainalysis assesses," not "confirmed."
The honest complication: are losses actually getting worse?
Here's where an honest article has to hold two facts that pull in different directions. Absolute dollar losses in 2026 are near record highs. But some trackers argue that once you adjust for the sector's growing TVL, the loss-to-TVL ratio may be flat or even improving -- meaning DeFi could be getting proportionally safer even as the headline numbers look scarier than ever. Both things can be true at once: the dollar figures are real and rising, and the risk-adjusted picture is murkier than either the doom narrative or the "it's fine, it's just growth" narrative wants to admit.
There's also a survivorship and reporting bias worth naming directly: bridge hacks and L1 shutdowns get headlines. Smaller exploits, rug pulls, and access-control failures on less-covered protocols don't. "Bridges are the worst category" may partly reflect what journalists and trackers choose to cover, not what's most common across the full universe of DeFi incidents.
Why this week's incidents are illustrative, not proof
BounceBit, The Sandbox, and MANTRA (which halted its own chain after an Aug 20 exploit in an upstream Cosmos EVM dependency) happening in the same rough window is a striking coincidence, but three incidents in ten days is anecdote-adjacent, not a statistically rigorous trend on its own. The stronger, defensible claim is the H1 aggregate: access-control and permission failures are structurally overtaking pure code bugs as DeFi's dominant attack surface, and this week's incidents are timely illustrations of that shift, not independent proof of it.
What connects all three, though, is instructive regardless of sample size. Each involved a permission or delegation layer sitting on top of otherwise-audited code -- an owner key, a delegate role, an authorization check -- rather than a flaw in the core financial logic. That's a different kind of bug to catch: audits historically focus hardest on the money-movement logic, and access-control layers can be comparatively under-scrutinized even in protocols that pass multiple security reviews.
What this means for how you read the next exploit headline
A few practical takeaways emerge from putting this week's news inside the half-year data:
First, a scary face-value dollar figure (SAND's "$49B") is not the same as an actual loss -- always look for the number that describes what actually left reserves, not the theoretical mint value at market price.
Second, "we're shutting down and migrating" (BounceBit's response) is a legitimate fix for a genuinely compromised base layer, but it's also an admission that the core infrastructure -- not just one contract -- was the weak point. That's a heavier statement than a routine post-mortem.
Third, cross-chain bridges built on shared standards like LayerZero's OFT framework carry attack-surface risk that isn't unique to any one project using that standard -- a delegate-permission compromise on one implementation is a reason to ask the same question about every other project built on the same rails, not just the one that got hit.
Falsifiable watch-points worth tracking from here: does the access-control-over-code-bugs shift persist through H2 2026 data, does the loss-to-TVL ratio actually hold flat as more trackers publish adjusted figures, and do BounceBit's and Sandbox's remediation timelines (chain migration, bridge restoration) complete cleanly or produce a second incident during the transition window -- which is historically where the next loss tends to happen.
Is DeFi's exploit problem actually getting worse, or does it just look that way because the dollar figures keep hitting new highs on a much bigger base?
Not financial advice. DYOR.
$BB $SAND #CryptoNews #DeFi #Security

Popular hardware wallet manufacturer Coldcard has released new firmware versions to address a seed phrase exposure vulnerability. According to CryptoSlate, versions 5.6.1 and 1.5.1Q significantly harden the new wallet creation process. Users must now press keys 65 times when initializing a new wallet, a measure designed to strengthen entropy sources and narrow potential attack vectors.
The most critical aspect of the update is the warning that seed phrases created on affected firmware versions cannot be repaired. Users who initialized wallets using the vulnerable releases must move their funds to a secure wallet. This highlights that hardware wallet security requires both software patches and user action.
Security researchers note that such vulnerabilities typically require physical access but still pose serious risks. The Coldcard team maintained transparent communication throughout the detection and patching process. Users can download firmware updates through official channels to secure their devices.
This incident demonstrates that security auditing of crypto custody solutions is an ongoing process. For hardware wallet users, regular firmware monitoring and following official announcements remains essential.
#Coldcard #HardwareWallet #Security
Sources: CryptoSlate
This news digest was compiled with AI assistance; it is not financial advice. Always do your own research (DYOR).

Popular hardware wallet manufacturer Coldcard has released new firmware versions to address a seed disclosure security vulnerability. According to CryptoSlate, the 5.6.1 and 1.5.1Q releases significantly harden the new wallet creation process. Users now have to press the button 65 times when starting a new wallet; this is intended to strengthen randomness sources and narrow possible attack vectors.
The most critical point of the update is the warning that seed phrases created with the affected firmware versions cannot be repaired. It emphasizes that users who set up a wallet using one of the affected versions should move their funds to a secure wallet. This serves as a reminder that hardware wallet security must be ensured not only through software updates, but also through user actions.