SecondFi, the Wallet Emurgo Built, Just Lost $2.4 Million of Its Users’ ADA and and Up to $20 Million Remains at Risk

On June 23, 2026, SecondFi confirmed three separate external attacks had drained approximately 16 million ADA, worth around $2.4 million, from 374 user wallets. The vulnerability was traced to a flaw in the platform’s proprietary web wallet generation software: the…

Raydium Drained $1.34M Through Code It Retired in 2021, Days After the Yuga Rescue: Blue-Chip Security Is Still Broken

On June 10, an attacker drained roughly $1.34 million from Raydium, the largest decentralized exchange on Solana, without touching a single active user position. The exploit hit five liquidity pools tied to Raydium’s legacy AMM V3 program, code deprecated in…

Taiko: Ethereum L2 Loses $1.7M After GitHub Key Leak

Taiko lost $1.7 million on June 22, 2026, after an attacker found a private signing key sitting in a public GitHub repository and used it to forge withdrawal proofs on the Ethereum Layer 2 network’s bridge. The protocol halted block…

Polymarket Hacked: $3M Stolen in Supply Chain Attack

Polymarket lost $3.1 million on June 25, 2026, after attackers compromised a third-party vendor and injected malicious code into the prediction market’s website, tricking 11 users into signing fraudulent transactions. The company disclosed the breach the same day and has…

Humanity Protocol $32M Hack: ZachXBT Says It May Be Staged

Humanity Protocol, the palm-scan biometric identity project positioned as a rival to Sam Altman’s Worldcoin, lost more than $32 million on June 9, 2026, after attackers drained 17 foundation wallets, swapped the stolen H tokens for ETH, and then minted…

The Zcash Bug That Could Have Printed Infinite Coins, Saved by AI

On May 29, 2026, a security researcher named Taylor Hornby found a critical vulnerability in Zcash’s Orchard shielded pool. The bug had been sitting undiscovered since Orchard launched in May 2022, four years of cryptographers reviewing the same circuit without…

North Korea Killed Radiant Capital: How the Lazarus Group Turned a $386M DeFi Protocol Into a $2M Husk

Radiant Capital is shutting down. On June 1, 2026, the protocol’s DAO announced an orderly wind-down of operations after 18 months of failed recovery efforts following its devastating October 2024 exploit. The reason is simple and brutal: no funds were…

DeFi’s $292M KelpDAO Stress Test: Standard Chartered Says ‘Bent Not Broken,’ JPMorgan Disagrees

At 17:35 UTC on April 18, 2026, an attacker tied to North Korea’s Lazarus Group sent a single forged cross-chain message through KelpDAO’s LayerZero bridge. The bridge accepted it, releasing 116,500 rsETH tokens, roughly 18% of the entire restaked-Ethereum supply,…

$285 Million Gone in 12 Minutes: How the Solana DeFi Hack on Drift Protocol Actually Happened

On April 1, 2026, Solana’s largest DeFi perpetuals exchange, Drift Protocol, lost $285 million in 12 minutes. The team posted on X to confirm it was real, not an April Fool’s joke. By the time most users saw the warning,…

North Korea Stole $1.5 Billion From Bybit. One Year Later, Only 3% Is Recovered. Here Is Where the Money Went.

On February 21, 2025, 401,347 Ethereum tokens worth approximately $1.5 billion disappeared from Bybit in under two minutes. It remains the largest theft in the history of cryptocurrency, surpassing every bank heist ever recorded including the $1 billion Saddam Hussein…