Cross-chain bridges lost $340.7 million across 14 exploits in 2026 through July 23, according to data aggregated by PeckShield and CoinGabbar. Bridges now account for roughly 40% of all value hacked across Web3 since 2022, a cumulative toll exceeding $2.9 billion tracked by DefiLlama. The single ...
"We are witnessing a continued flight to safety across the industry." — Johann Eid, Chief Business Officer, Chainlink Labs
Cross-chain bridges lost $340.7 million across 14 exploits in 2026 through July 23, according to data aggregated by PeckShield and CoinGabbar. Bridges now account for roughly 40% of all value hacked across Web3 since 2022, a cumulative toll exceeding $2.9 billion tracked by DefiLlama. The single largest incident — a $292 million drain of Kelp DAO's rsETH bridge on April 18 — was attributed by LayerZero to North Korea's Lazarus Group and triggered a $7.2 billion asset migration away from LayerZero toward Chainlink's CCIP infrastructure.
Bridge total value locked dropped below $45 billion in late June, down from approximately $50 billion in May, as protocols and institutional users reassessed counterparty exposure to cross-chain infrastructure. The security failures are not primarily smart contract bugs. OpenZeppelin's post-mortem of the Kelp DAO incident found zero code vulnerabilities; the exploit targeted off-chain infrastructure — compromised RPC nodes and a single-point-of-failure verification configuration that 47% of active LayerZero applications were running at the time of the attack.
PeckShield documented eight major bridge exploits through mid-May 2026, totaling $328.6 million. Additional incidents in July brought the count to 14 and cumulative losses to $340.7 million, per CoinGabbar tracking.
| Date | Protocol | Loss | Attack Vector | |------|----------|------|---------------| | April 18 | Kelp DAO / LayerZero | $292M | Compromised RPC nodes, 1-of-1 DVN bypass | | February 2026 | CrossCurve | $3M | Weak access controls in expressExecute functions | | May 2026 | Verus-Ethereum Bridge | $11.6M | Fake cross-chain transfer message | | July 22 | AFX Trade | $24.15M | Compromised 5/N validator keys on Arbitrum | | July 23 | Verus-Ethereum Bridge | $7.54M | Same unpatched vulnerability from May | | Various | Other incidents (9) | ~$2.4M | Mixed vectors |
The Kelp DAO exploit alone accounted for 85.7% of all bridge losses in 2026. Excluding it, bridge exploits averaged $3.5 million per incident — still material, but an order of magnitude smaller.
The Verus bridge stands out for a different reason: the same vulnerability was exploited twice, in May ($11.6 million) and July ($7.54 million), indicating the flaw was not patched between incidents.
The April 18 exploit was not a smart contract bug. OpenZeppelin's analysis confirmed zero code-level vulnerabilities were present. The attack targeted the operational layer surrounding the bridge.
The setup: Kelp DAO's bridge used LayerZero's OFT (Omnichain Fungible Token) standard for cross-chain rsETH transfers. The bridge's message verification relied on a single Decentralized Verifier Network (DVN) node — a 1-of-1 configuration.
The attack sequence:
Secondary damage: Of the stolen rsETH, 89,567 tokens had been deposited on Aave as collateral. The attacker borrowed $190 million in WETH against the drained collateral, leaving Aave with estimated bad debt of $123 million to $230 million.
LayerZero attributed the Kelp DAO attack with "preliminary confidence" to North Korea's Lazarus Group, specifically its TraderTraitor subunit, according to a post-mortem published April 20.
The attribution fits a pattern. North Korean state-linked hackers stole $643 million in crypto during H1 2026, representing 66% of all crypto lost to theft and exploits in that period, according to CryptoBriefing. In April alone, the Lazarus Group executed 12 attacks siphoning $635 million, with the Kelp DAO ($292 million) and Drift Protocol ($285 million) breaches accounting for 95% of the month's total, per KuCoin research data.
Cumulatively, DPRK-linked actors have stolen $6.75 billion in cryptocurrency since 2017, per CryptoImpactHub tracking. The group stole $2.02 billion in 2025, a 51% year-on-year increase. Bridges remain a preferred target: they concentrate large pools of locked assets behind verification mechanisms that, in practice, are often simpler than the value they guard.
The Kelp DAO incident triggered the largest infrastructure migration in DeFi history. More than $7.2 billion in token value moved from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP) in Q2 2026, according to CryptoSlate and Chainlink's own disclosures.
Major migrations:
CoinDesk reported in May that crypto firms had collectively moved $4 billion in assets to Chainlink as bridge security came under scrutiny, a figure that grew to $7.2 billion by end of Q2.
The migration reflects a structural preference shift. CCIP uses multiple independent verification networks plus a separate Risk Management Network running on independent infrastructure, a design that eliminates the single-point-of-failure that enabled the Kelp DAO exploit. CCIP processed over $18 billion in cross-chain volume in Q1 2026 across 60+ chains, per Chainlink documentation.
Bridges concentrate economic value behind verification steps that are architecturally simpler than the assets they protect. This creates an asymmetric risk profile: the reward for exploiting a bridge vastly exceeds the difficulty of the exploit relative to the value at stake.
Verification architecture failures:
At the time of the Kelp DAO exploit, LayerZero disclosed that 47% of active OApp contracts used a 1-of-1 DVN setup — meaning nearly half of all applications on the network relied on a single node to validate cross-chain messages. Post-hack, LayerZero banned 1-of-1 configurations entirely, announcing its DVN will no longer sign messages for any application running a single-verifier setup.
Validator key compromise:
The AFX Trade exploit on July 22 demonstrated a different failure mode. Attackers obtained private keys from five validators, reaching the required quorum to authorize a $24.15 million withdrawal of USDC from the protocol's Arbitrum bridge. The bridge's smart contract included a 200-second challenge period, but no challenge was filed, and the contract automatically validated the transaction.
Unpatched vulnerabilities:
The Verus-Ethereum bridge was exploited twice using the same vulnerability. In May, an attacker used the bridge's submitImports function to trigger Ethereum-side payouts not backed by matching value on the Verus source chain, stealing $11.6 million. In July, a different attacker used the identical method for $7.54 million. The flaw remained unpatched for two months between incidents.
Bridge TVL dropped below $45 billion by late June, down from approximately $50 billion in May — a 10% contraction in under two months, according to TimesOfBlockchain. Certain platforms experienced more severe drawdowns: Hyperliquid's bridge TVL fell from $4 billion in May to $341 million in June, a 91.5% decline.
The broader DeFi ecosystem absorbed collateral damage. Immunefi's H1 2026 report documented $972 million in total crypto hack losses across 207 incidents — the highest incident count ever recorded, even as the per-incident loss declined relative to prior years. DeFi-specific exploit losses have fallen 74% from their 2022 peak of $2.62 billion to $680.3 million, but bridges remain the single most capital-efficient attack vector for sophisticated threat actors.
Blockaid's competing analysis put H1 2026 losses above $1.1 billion across 212 verified incidents. The discrepancy between trackers ($972 million vs. $1.1 billion) reflects methodological differences in categorizing exploits versus social engineering attacks, but both datasets agree that bridge exploits represent a disproportionate share of total losses relative to bridge TVL.
The Kelp DAO exploit exposed a fundamental limitation of the current security audit model. OpenZeppelin's analysis concluded that "$292 million was lost and zero bugs were found" — the smart contract code functioned exactly as written.
What failed was the operational configuration surrounding the code: RPC node security, DVN verifier count, challenge period parameters, and infrastructure redundancy. These elements sit outside the scope of traditional code audits.
SlowMist's analysis published in April characterized the incident as a "systemic risk" problem, noting that the industry's audit paradigm focuses on contract-level correctness while ignoring integration-level configuration. The firm recommended expanding audit scope to include cross-chain dependency configuration, governance permission structures, DVN and executor configurations, and critical infrastructure dependency mapping.
The economic implications are measurable. In H1 2026, the industry lost $972 million to exploits while Immunefi's bug bounty platform paid researchers $13.45 million to surface 837 valid bugs before attackers could exploit them. The ratio — $72 lost for every $1 spent on bug bounties — suggests systematic underinvestment in preventive security, particularly at the infrastructure and configuration layer where bridge exploits originate.
Cross-chain bridges remain the highest-value attack surface in Web3. The 2026 data reinforces a pattern visible since Ronin's $625 million loss in 2022: bridges concentrate liquidity behind verification systems that, when measured against the assets they protect, are underpowered. The Kelp DAO incident demonstrated that code correctness is necessary but insufficient; operational security at the configuration and infrastructure layer determines whether a bridge survives contact with a state-level threat actor.
The market response — $7.2 billion migrating to CCIP in a single quarter — suggests the industry is beginning to price bridge security as a first-order infrastructure concern rather than an afterthought. Whether this migration represents a durable shift toward multi-verifier architectures or merely a temporary reallocation toward the current market leader remains to be determined. The 72:1 ratio of losses to bug-bounty spending indicates that the economic incentives for bridge security remain misaligned. Until preventive investment approaches the scale of the losses it aims to prevent, bridges will continue to offer state-backed attackers an asymmetric return on effort.