Why Did Crypto Hack Losses Decline in June?
Crypto hacks and exploits totaled about $75.9 million across 40 major incidents in June, down 7.1% from $81.7 million in May, according to blockchain security firm PeckShield.
The monthly decline offers only limited relief. Losses remained spread across bridges, private-key compromises, bots, deprecated infrastructure, and user-facing platforms. That range shows that the crypto security problem is not concentrated in one category of protocol or one type of attacker.
The largest June incident involved Humanity Protocol. PeckShield put the exploit at $31 million, while the project’s own investigation later placed losses closer to $36 million. Founder Terence Kwok attributed the breach to a compromised private key, making it another reminder that private-key security remains one of the industry’s most damaging failure points.
The Humanity Protocol exploit accounted for the largest share of the month’s losses. Onchain analyst Specter first reported that wallets connected to the project had drained more than $31 million on June 9. The incident quickly became the central case in June’s security tally because of its size and the later disclosure that losses may have been higher than initial third-party estimates.
Which Incidents Drove June’s Hack Total?
Syscoin Bridge recorded the second-largest June loss, with $10 million stolen through a validation flaw. PeckShield said the weakness allowed an attacker to mint billions of unbacked SYS tokens without a corresponding burn, exposing the type of accounting failure that can hit bridge systems when verification logic breaks down.
A bot tied to the address JaredFromSubway.eth was also exploited for $7.5 million. The address is known for running MEV sandwich attacks, making the incident notable because an automated trading operator associated with predatory onchain activity became a target itself.
Other larger June incidents included Secret Network, Polymarket users, SecondFi, and TESSERA, with losses ranging from $2.4 million to $4.67 million. Rounding out the top 10 were Taiko Bridge at $1.7 million, Token of Power at $1.58 million, Raydium at $1.34 million, and LABUBU/OLPC at $1.1 million.
The distribution of losses matters for investors because it shows how different parts of the market remain exposed at the same time. Bridges continue to face verification and validation risk. Protocol operators remain vulnerable to key compromise. Users remain exposed to platform-level and wallet-level attacks. Even trading infrastructure can become a target when it accumulates enough value.
Investor Takeaway
The 7.1% monthly decline does not mark a clean improvement in crypto security. June still produced 40 major incidents, led by a private-key breach and bridge-related failures, showing that operational controls remain as important as smart contract audits.
Why Did Aztec’s Deprecated Infrastructure Matter?
Aztec’s deprecated infrastructure was hit twice in June, adding another layer to the month’s security picture. PeckShield tracked $2.16 million in losses from what it labeled the Aztec Bridge and another $2.1 million from Aztec Connect.
Both were immutable contracts that the Aztec Foundation says it no longer controls or can pause. Combined, the 2 attacks cost roughly $4 million and highlighted a recurring challenge in decentralized infrastructure: old contracts can remain live, funded, and exploitable even after they are no longer part of a project’s active stack.
For users, deprecated does not always mean harmless. If contracts remain accessible and contain value, attackers can still search for weaknesses. For projects, the problem is harder because immutable infrastructure cannot always be upgraded, frozen, or fully decommissioned without prior design choices that allow emergency controls.
That issue is likely to become more important as DeFi matures. Many protocols have legacy contracts, old bridges, discontinued front ends, or abandoned integrations that still interact with user funds. June’s Aztec-related losses show that attackers can treat those older systems as part of the live attack surface.
Are Hackers Reusing Laundering Routes?
PeckShield said the Humanity Protocol exploiter laundered stolen funds across Bitcoin, Solana, Hyperliquid, and BNB Chain. Some proceeds were also commingled with funds tied to the separate Kelp DAO exploiter, a pattern the firm said raises the possibility that the same threat actor may be behind both attacks.
That laundering pattern is important because attackers increasingly move stolen assets across multiple chains to complicate tracing and recovery. Cross-chain movement can fragment evidence, create jurisdictional challenges, and force investigators to coordinate across several networks and exchanges.
The broader 2026 backdrop remains severe. Crypto hacks and exploits have cost the industry well over $750 million so far this year, driven largely by 2 major North Korea-linked attacks in April, according to blockchain intelligence firm TRM Labs.
Drift Protocol lost $285 million on April 1 after attackers spent months socially engineering their way into the Solana protocol’s governance signers. Kelp DAO’s LayerZero bridge was drained of $292 million on April 18 through a compromised verifier network.
June’s losses were lower than May’s, but the industry remains in a high-risk cycle. The largest incidents of 2026 show that attackers are combining technical exploits, compromised keys, social engineering, and cross-chain laundering. For investors and protocols, the main lesson is that crypto security risk is no longer limited to code. It now spans governance, infrastructure design, operational access, and post-hack asset movement.
