Cross-chain bridges have lost at least $329 million across eight major exploits in the first seven months of 2026, according to PeckShield. Bridges now account for roughly 25% of all crypto hack value year-to-date, despite representing a fraction of total DeFi TVL. The pattern is consistent: atta...
"We believe developers should choose their own security configurations, but we made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions." — LayerZero Labs, public statement following the $292M KelpDAO exploit (May 2026)
Cross-chain bridges have lost at least $329 million across eight major exploits in the first seven months of 2026, according to PeckShield. Bridges now account for roughly 25% of all crypto hack value year-to-date, despite representing a fraction of total DeFi TVL. The pattern is consistent: attackers do not break cryptography — they compromise off-chain infrastructure, exploit key management failures, and abuse single-point-of-failure verification setups.
Total crypto hack losses through August 28, 2026 stand at approximately $1.26 billion across 219+ incidents, per publicly tracked data. The two largest single events — the Drift Protocol exploit ($295 million, April 1) and the KelpDAO bridge exploit ($292 million, April 18) — are both attributed to North Korea's Lazarus Group, which accounted for 76% of all crypto hack value through April 2026 according to Chainalysis. The bridge attack surface remains structurally exposed, even as the industry shifts toward zero-knowledge proof verification and multi-verifier architectures.
PeckShield tracked eight major cross-chain bridge attacks through May 2026, with cumulative losses of $328.6 million. The KelpDAO exploit alone — $292 million drained from a LayerZero-powered rsETH bridge on April 18 — comprised 89% of that figure.
The remaining seven incidents, while smaller individually, exposed a range of architectural failures across different bridge designs and chains:
| Date | Protocol | Chain(s) | Loss | Attack Vector | |------|----------|----------|------|---------------| | Apr 18 | KelpDAO / LayerZero | Ethereum | $292M | Compromised RPC nodes; 1-of-1 DVN bypass | | Jun 7 | Syscoin Bridge | UTXO-NEVM | ~$10M | Proof parsing error; 5B unauthorized tokens minted | | Jul 21 | Wanchain | Cardano-BNB | $13M | Signature reuse; 65,000x amplification | | Jul 23 | AFX Trade | Arbitrum-Ethereum | $24M | Compromised 5 of 7 validator keys | | Jul 23 | Verus Protocol | Ethereum | $7.5M | Fake cross-chain transfer message |
The July 23 incidents are notable: two separate bridges were drained on the same day for a combined $31.5 million. AFX Trade offered its attacker a 30% bounty ($7.2 million) to return the remaining funds. Total bridge-related losses in July alone reached approximately $47 million across three incidents.
The 2026 bridge exploits share a common thread: none involved breaking on-chain cryptography. Instead, attackers targeted the trust assumptions that connect on-chain contracts to off-chain infrastructure.
Key compromise was the dominant vector. AFX Trade's attacker gained access to five of seven validator private keys, exceeding the 6,667-vote threshold needed to authorize transactions. The $24.15 million in USDC was bridged from Arbitrum to Ethereum and converted to ETH within minutes.
Proof validation failures enabled the Syscoin exploit. The bridge relay accepted an invalid proof structured to exploit a parsing flaw, allowing the attacker to withdraw 5 billion SYS tokens on the UTXO side without a corresponding burn on the NEVM side. Syscoin subsequently recovered the funds, which were burned to restore the expected coin supply.
Signature reuse amplified the Wanchain attack by a factor of 65,000. The bridge's TreasuryCheck validator constructed signed messages by joining 14 variable-length fields without separators or length markers. A legitimate signature authorizing ~3,110 NIGHT tokens on BNB Chain was reused for a Cardano withdrawal of 203 million NIGHT, triggering a 30% token price collapse.
Off-chain infrastructure compromise defined the KelpDAO attack. Attackers — later attributed to the Lazarus Group's TraderTraitor subunit — compromised internal RPC nodes and DDoS'd external nodes to feed false data to KelpDAO's single verifier.
The $292 million KelpDAO exploit produced not only the year's largest bridge loss but also a public dispute between KelpDAO and LayerZero Labs that reshaped cross-chain infrastructure procurement.
LayerZero's post-mortem on April 20 attributed the attack to North Korea's Lazarus Group and stated that KelpDAO had deployed with a single Decentralized Verifier Network (DVN) — a 1-of-1 configuration — despite repeated recommendations to use multiple verifiers. LayerZero co-founder Bryan Pellegrino said on May 5 that KelpDAO's account of events was "completely untrue," asserting that Kelp originally deployed with a multi-DVN setup and later manually downgraded.
KelpDAO disputed this claim, arguing that LayerZero had approved the configuration that was exploited.
By May 9, LayerZero reversed course. The company issued a public apology, stating it "made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions." The admission came after major clients defected. KelpDAO migrated its rsETH bridge to Chainlink's CCIP. Solv Protocol moved more than $700 million in tokenized bitcoin infrastructure away from LayerZero. Kraken adopted Chainlink CCIP as its cross-chain standard, replacing LayerZero, according to a May 14 CoinDesk report.
The incident exposed a structural tension in modular bridge design: when protocols allow developers to choose their own security configurations, misconfiguration risk concentrates at the application layer, but infrastructure providers still bear reputational liability when those configurations fail.
The Lazarus Group's TraderTraitor subunit is now attributed with two of 2026's three largest crypto exploits. In April alone, Lazarus-linked actors extracted an estimated $577 million between the KelpDAO bridge hack and the Drift Protocol breach, according to KuCoin research.
Drift Protocol, a Solana-based perpetuals exchange, lost $295 million on April 1 after attackers combined fake token creation, oracle manipulation, and a compromised admin key. Drift's TVL fell from $550 million to under $300 million in under an hour. The protocol subsequently announced a recovery plan centered on issuing recovery tokens pegged to verified user losses, funded by a pool starting at $3.8 million with a target of $151 million from revenue and partner contributions.
DPRK-linked actors stole $2.02 billion in 2025, a 51% year-on-year increase, pushing their cumulative total to $6.75 billion according to Chainalysis. Through April 2026, North Korean hackers accounted for 76% of all crypto hack value. The operational pattern has shifted from smart contract exploitation to social engineering, privileged access compromise, and off-chain infrastructure attacks — vectors that audit firms do not typically cover.
August 2026 set a record for incident count: 50 major hacks resulting in $136.3 million in losses, a 67% increase from July's 30 incidents.
The Sandbox bridge exploit on August 21 illustrated the persistence of bridge vulnerabilities even in well-known projects. An attacker exploited the approveAndCall function on The Sandbox's SAND omnichain fungible token contract on Base, hijacking LayerZero delegate permissions. Over approximately five hours, the attacker minted 329.24 trillion unbacked SAND tokens across 703 separate events. PeckShield initially flagged 14.9 billion SAND created across two wallet addresses; Blockaid estimated the face value near $49 billion.
Actual extraction was far smaller: 14.75 million SAND drained from the Ethereum OFT Adapter, converted into roughly 80 ETH worth approximately $675,000. The Sandbox disabled bridging on Base and BNB Smart Chain, removed LayerZero peer settings via multisig governance, and announced a 1:1 reimbursement plan from its treasury.
The Tectonic exploit on Cronos — covered separately in a prior webthreepedia report — resulted in approximately $75 million in losses and a controversial chain rollback.
The bridge exploit wave has accelerated three structural shifts in cross-chain infrastructure:
1. Migration to Chainlink CCIP. Cross-chain transfers via CCIP surged 1,972% to $7.77 billion in 2025. The protocol now connects 60+ blockchains and secures $33.6 billion in cross-chain tokens. CCIP uses 16 independent, security-reviewed node operators to validate all cross-chain activity, compared to the single-verifier setup that failed at KelpDAO. Post-KelpDAO, Kraken, KelpDAO itself, and Solv Protocol all migrated to CCIP.
2. Zero-knowledge proof verification. Across Protocol's V4 architecture, launched in mid-2025, introduced ZK proof verification using Succinct's SP1 zkVM, enabling any contract on any destination chain to verify a proof without a custom trusted adapter. The protocol now supports 25+ networks including Solana. If the 45x cost reduction in ZK proof generation observed in 2025 continues, proof costs could fall below $0.001, making trust-minimized bridges economically viable at scale.
3. LayerZero's post-KelpDAO changes. Following the exploit and client defections, LayerZero committed to mandating multi-DVN configurations for high-value deployments. The protocol is deployed on 90+ chains with 60+ independent verifiers available, but the KelpDAO incident demonstrated that availability of security options does not guarantee their adoption.
These shifts represent a broader trend: bridge security is moving from configuration-dependent models (where developers choose their own security parameters) toward opinionated defaults that enforce minimum security thresholds. The economic logic is straightforward — the cost of a single misconfigured bridge ($292 million in the KelpDAO case) exceeds the cumulative cost of enforcing stricter defaults across the entire protocol.
The 2026 bridge exploit data presents a clear pattern: the attack surface has migrated from on-chain smart contracts to off-chain infrastructure. Auditing a bridge's Solidity code does not secure its RPC nodes, key management procedures, or verifier configuration. The KelpDAO incident — where a $292 million loss originated from a configurable security parameter left at its weakest setting — represents a failure mode that technical audits are not designed to catch.
The industry's response has been measurable. Chainlink CCIP's growth, the emergence of ZK-proof verification, and LayerZero's policy changes all address specific failure modes exposed by 2026's exploits. Whether these measures reduce aggregate losses in H2 2026 remains to be seen. August's record 50-incident count suggests the attack frequency is not declining, even as the average loss per incident has fallen.
Cross-chain bridges remain structurally necessary — multi-chain DeFi, tokenized assets, and institutional settlement all depend on them. The economic question is whether the security cost of trust-minimized verification (ZK proofs, multi-verifier mandates, decentralized oracle networks) will converge with the cost of losses from trust-dependent designs. At $329 million in bridge losses and counting, the market is pricing that answer in real time.