De.Fi's Q2 report puts $764 million of crypto losses outside smart contracts
The quarterly review says compromised keys, bridge verification and access controls accounted for most of the damage, shifting the security question toward the systems around the code.
Crypto losses reached almost $764 million across 67 incidents in the second quarter of 2026, according to De.Fi's REKT report. The report's central finding is about where the failures happened: compromised keys, exposed signers, broken deployment controls and other operational or infrastructure failures accounted for 88.3% of the quarter's losses in the dataset, while smart-contract bugs accounted for 11%.
Two incidents dominated the total. De.Fi attributes about $292 million to KelpDAO's April bridge failure and about $285 million to Drift Protocol's April governance compromise. Together they account for roughly three quarters of the quarter's stolen value, which makes the headline total highly concentrated even as the report records dozens of smaller attacks.
The bridge can fail above the contract
The Kelp case shows how an onchain transaction can be valid while the system behind it is wrong. LayerZero's incident report describes an attacker compromising infrastructure around a single-verifier setup, then causing a cross-chain message to attest to a burn that had not happened. The Ethereum contract released rsETH according to the message it received. The failure was in the verification path and its operational assumptions.
That distinction changes what an audit can prove. A contract review can inspect the rules for minting and redemption, but it cannot by itself validate every signer device, RPC endpoint, deployment pipeline or cross-chain verifier. Security teams need controls that compare states across systems and can stop a valid-looking message when the economic invariant has broken.
Access control became the attack surface
Drift's own recovery update describes work with forensics teams, a user-recovery framework and a more secure relaunch after the April exploit. De.Fi's account places the incident in the same operational category as Kelp: administrative authority, signer workflows and the people around them carried more risk than a defect in a line of contract code.
The report also records a smaller but telling event: $174,000 lost through a malicious AI prompt injection, described as the first incident of its kind in the dataset. The amount barely moves the quarterly total. The control lesson is larger. As agents enter transaction construction and treasury workflows, teams will need review rules that treat prompts, tool permissions and signing authority as part of the security boundary.
