$764 million stolen in Web3 security incidents in Q2 2026, with 88.3% stemming from key and infrastructure compromises

Odaily reported that Hacken’s quarterly security and compliance report shows that in Q2 2026, the Web3 sector suffered 67 security incidents, with stolen funds reaching 763.9 million US dollars—the most severe quarter since Q2 2025. Compromised keys and infrastructure accounted for 88.3% of the stolen funds, approximately 674.5 million US dollars.

Smart contract vulnerabilities remain the most common attack type, with 44 out of 67 incidents related to them. However, losses from these accounted for only about 11% of the total. Approximately 75.5% of the losses stemmed from two incidents attributed to North Korean threat actors, and 14 audited protocols were breached this quarter.

Leo Fan, founder of Cysic, stated that an audit is a scope assessment of a specific codebase at a particular time and does not automatically cover signing devices, cloud infrastructure, operational permissions, subsequent upgrades, third-party dependencies, or legacy contracts that can still be invoked. Genius CTO Samuel Videau pointed out that nearly 90% of losses come from keys, signers, and infrastructure.

Several security leaders noted that Web3 security requires layered defenses including real-time monitoring, key management, multi-party authorization, and bug bounty programs. Leo Fan anticipates that the second half of 2026 will continue to see operational access control attacks dominating losses, including social engineering, credential theft, signer compromise, cloud or CI/CD breaches, and attacks on off-chain validator infrastructure.