Bridge Exploits Bleed $840M+ as ETF Outflows Drain $4.33B
Q2 2026 sets an all-time high for DeFi hack incidents, with bridges accounting for the majority of losses, while spot Bitcoin ETFs see record outflows amid a market downturn.
The first half of 2026 has been a bloodbath for DeFi security—a systemic failure that reads like a Stephenson novel about a civilization that forgot to lock its doors. By the end of May, hackers had siphoned over $840 million across more than 50 attacks [^claim_598], a 70% surge from 2025 [^claim_598]. Bridges, those fragile chokepoints holding about $21.94 billion, are the most dangerous part of the architecture [^claim_598]. The second quarter set a record for number of exploits: DefiLlama logged roughly 70 attacks and $746 million stolen [^claim_593], doubling the previous quarterly record [^claim_593]. April alone saw over $635 million vanish in 28 separate hits [^claim_599], about four times the $167 million stolen in the entire first quarter [^claim_599].
Two attacks account for over $577 million of that total. The $292 million Kelp DAO LayerZero bridge exploit [^claim_594] and the $285 million Drift Protocol hack on Solana [^claim_594] are the headline acts, but the details are where the grit lives. The Syscoin bridge lost about $10 million in June 2026 [^claim_595]—a proof-checking bug let an attacker mint roughly 5 billion SYS tokens without burning them on the other side [^claim_595]. Gravity Bridge, a Cosmos-based cross-chain tool, had to halt its validators and operators after a stolen signing key let an attacker walk away with about $5.4 million [^claim_596], including $4.3 million USDC and about 2,100 ETH still held [^claim_596]. The attacker laundered some of it through ChangeNOW and Binance [^claim_596]. The Verus–Ethereum bridge lost about $11.58 million [^claim_597]; the attack wallet was funded through Tornado Cash hours earlier [^claim_597]. The latency on those scripts was zero; they hit their targets.
Meanwhile, spot Bitcoin ETFs have been bleeding out like a bruised arm. Over 13 straight trading days from May 15 to June 3, 2026, they lost $4.33 billion and 59,000 BTC [^claim_592], setting record outflow streaks on 7-day, 10-day, and 20-day windows [^claim_592]. That pulled year-to-date ETF flows into negative territory [^claim_592]. On June 23, 2026, U.S. spot Bitcoin ETFs saw net outflows of about $113.8 million [^claim_591], extending a four-day withdrawal streak [^claim_591]. BlackRock’s IBIT suffered a $182 million single-day exit [^claim_591]; Fidelity’s FBTC and ARK 21Shares’ ARKB lost $23 million and $31 million [^claim_591]. The market cap dropped to about $2.13 trillion [^claim_605], and over $1 billion in leveraged positions were liquidated within 48 hours [^claim_605]. BTC fell from about $72,000 to the $61,000 range [^claim_605]; Ethereum dropped 18% in seven days [^claim_605]. The yield on compliance just went ex-dividend.
On the regulatory front, the GENIUS Act is taking shape like a slow-moving glacier. OCC Bulletin 2026-24 proposes weekly and quarterly reporting forms for payment stablecoin issuers under the GENIUS Act [^claim_600], tied to a March 2, 2026 proposed rule [^claim_600] that treats these issuers as financial institutions under the Bank Secrecy Act [^claim_600]. A joint FinCEN and OFAC proposed rule would classify payment stablecoin issuers as financial institutions under the BSA [^claim_601], requiring anti-money-laundering programs and sanctions compliance systems for payment stablecoins [^claim_601]. The interface is cold, bureaucratic, but it’s a weapon system designed to control the flow.
On the upgrade front, Pi Network finished a mandatory Protocol 24 mainnet upgrade in early June 2026 [^claim_602]; all nodes had to update by June 2 or be disconnected [^claim_602]. The upgrade changed subsystems, moved from Ubuntu 20 to 24, and fixed internal data to improve node sync and reliability [^claim_602]. Its follow-on Protocol 25 upgrade has a hard deadline of June 18, 2026 [^claim_603]; nodes that fail to upgrade are dropped from the network [^claim_603], unable to validate transactions or earn rewards because they are not compatible with the new consensus system [^claim_603]. Berachain plans to launch its Fusaka mainnet upgrade on June 24, 2026 [^claim_604]; Canton Network plans a v3.5 mainnet upgrade [^claim_604]; NEAR Protocol will roll out its v2.13 network upgrade in June [^claim_604]. Other events include IoTeX’s v2.4.0 upgrade and Starknet’s STRK20 privacy standard mainnet launch [^claim_604].
The mix of record bridge attacks, steady ETF outflows, and tighter stablecoin rules forces a new look at risk in DeFi. Designers must now price bridge risk into lending and restaking fees [^claim_604], using slashing and insurance pools tied to cross-chain proof checks and signer behavior [^claim_604]. They must also add ETF-flow and macro signals into on-chain risk tools for dynamic leverage limits [^claim_604]. The time of assuming bridges are safe is over. They are now the main vector of attack. Protocols that do not harden their proof systems, add multi-party signing, and use real-time risk-off switches will not survive the next wave. The market is bleeding red like a bruised arm, and the only question is who gets shorted next.
Provenance ledger
15 claims web-citedEvery claim below cites a source URL, and each URL was checked for validity before publish. The excerpt shown is the researcher's own summary of the page — it is not re-derived from the source, so it is not a verified verbatim quote. Follow the link to confirm any claim against the original. Citation markers in the text jump here.
[1] U.S. spot Bitcoin ETFs recorded net outflows of about $113.8 million on June 23, 2026, marking the fourth consecutive day of withdrawals, with BlackRock’s IBIT alone seeing a $182 million single‑day outflow while Fidelity’s FBTC and ARK 21Shares’ ARKB posted inflows of $23 million and $31 million respectively. web-cited
On June 23 U.S. spot Bitcoin ETFs recorded net outflows of about $113.8 million, extending a four-day withdrawal streak with BlackRock’s IBIT accounting for a $182 million single-day exit while Fidelity’s FBTC and ARK 21Shares’ ARKB drew $23 million and $31 million respectively.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[2] Across 13 consecutive trading days from May 15 to June 3, 2026, spot Bitcoin ETFs shed $4.33 billion and 59,000 BTC, setting record outflow streaks on 7‑day, 10‑day and 20‑day trailing windows and pulling year‑to‑date ETF flows negative. web-cited
Bitcoin exchange-traded funds (ETFs) have experienced 13 consecutive days of net outflows from May 15 to June 3, marking the longest such trend since their inception… During this period, these funds have lost $4.33 billion and 59,000 BTC… the 7-day and 10-day periods established new records for Bitcoin outflows, registering 39,000 BTC and 42,000 BTC, respectively… approximately $4.4 billion that left the funds in the past month has pulled year-to-date flows into negative territory.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[3] DeFi hacks reached an all‑time quarterly high by incident count in Q2 2026, with DefiLlama data showing roughly 70 exploits and $746 million stolen, double the previous quarterly record for the number of exploits. web-cited
Q2 2026 saw ~70 DeFi exploits—double the previous quarterly record—with $746M stolen… DefiLlama confirmed Q2 2026 as the most-hacked quarter in DeFi history by incident count, with approximately 70 exploits and $746 million stolen — double the previous quarterly record.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[4] As of mid‑April 2026, DeFi protocols had already lost more than $750 million to hacks and exploits, with two attacks—the $292 million Kelp DAO LayerZero bridge exploit and the $285 million Drift Protocol hack on Solana—accounting for over $577 million of the total. web-cited
DeFi protocols have lost more than $750 million to hacks and exploits in 2026, and the year is not even four months old. Two attacks alone account for more than $577 million of that total. Kelp DAO's LayerZero bridge was drained of $292 million in rsETH on April 19, and Drift Protocol lost $285 million on April 1… Kelp DAO's $292 million exploit on April 19 is the largest so far, narrowly surpassing Drift Protocol's $285 million loss from April 1.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[5] The Syscoin bridge suffered an estimated $10 million exploit in June 2026 due to a parsing error in its proof‑validation logic that allowed an invalid proof to be interpreted as a valid burn, enabling an attacker to mint roughly 5 billion SYS on the UTXO side without an equivalent NEVM burn. web-cited
The Syscoin bridge links the two and was the victim of an estimated $10 million hack in June 2026… The bridge relay process accepted an invalid proof, allowing the attacker to withdraw approximately 5 billion SYS on the UTXO side without performing an equivalent burn transaction on the NEVM side… Instead of creating a fake but valid proof… the attacker created a fake proof that was structured to take advantage of a flaw in the parsing code… resulting in the relay path authorizing a mint transact
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[6] Gravity Bridge, a Cosmos‑native cross‑chain protocol, halted validator and orchestrator operations after a compromised signing key enabled an attacker to steal roughly $5.4 million, including $4.3 million USDC and ~2,100 ETH still held, while laundering part of the funds through ChangeNOW and Binance. web-cited
Gravity Bridge, a Cosmos-native cross-chain protocol, was the target of a compromised-key attack, which led to the theft of roughly $5.4 million… the loot included crypto assets worth about $5.4 million, including $4.3 million in USDC, 274 wrapped Ether valued at roughly $553,000, $434,000 in USDT, and 14.16 PAXG tokens… PeckShield… said the bad actor has laundered a portion of the stolen funds through the ChangeNOW and Binance exchanges, but still holds over 2,100 Ether (worth approximately $4.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[7] Attackers drained approximately $11.58 million from the Verus–Ethereum bridge after funding the exploit wallet through Tornado Cash hours earlier, highlighting persistent privacy‑tool‑enabled bridge attacks in the current DeFi environment. web-cited
Attackers reportedly drained $11.58 million from the Verus-Ethereum Bridge after funding the wallet through Tornado Cash hours earlier.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[8] By the end of May 2026, cumulative DeFi hack losses had exceeded $840 million across more than 50 incidents in five months, representing around a 70% year‑over‑year increase versus 2025 and with bridges holding roughly $21.94 billion in TVL identified as the single highest‑risk surface. web-cited
$840M+ lost in January–May 2026 — a 70% YoY increase over the same period in 2025… Bridges hold $21.94B TVL and remain the single highest-risk surface in DeFi infrastructure… Over $840 million drained in five months. 50+ incidents. A 70% year-over-year increase.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[9] In April 2026 alone, hackers stole over $635 million across 28 separate DeFi exploits, roughly quadrupling the $167 million stolen during the entire first quarter and pushing total 2026 DeFi losses above $840 million by mid‑year. web-cited
In April 2026 alone, hackers stole over $635 million across 28 separate exploits, setting a new monthly record and roughly quadrupling the $167 million stolen during the entire first quarter. The total damage for 2026 now exceeds $840 million, and the year is barely half over.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[10] OCC Bulletin 2026‑24 proposes weekly confidential and quarterly reporting forms for permitted payment stablecoin issuers and foreign payment stablecoin issuers under the GENIUS Act, with the forms tied to a March 2, 2026 proposed rule that treats these issuers as financial institutions subject to Bank Secrecy Act obligations. web-cited
The OCC is proposing a new information collection that would include weekly and quarterly reporting forms that must be completed by permitted payment stablecoin issuers and foreign payment stablecoin issuers registered with the OCC under the Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act… On March 2, 2026, the OCC issued a proposed rule that would implement requirements of the GENIUS Act with respect to the issuance of payment stablecoins… The proposed rule would
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[11] A joint FinCEN and OFAC proposed rule to implement the GENIUS Act would classify permitted payment stablecoin issuers as financial institutions under the Bank Secrecy Act, mandating anti‑money‑laundering programs and effective sanctions compliance systems tailored to payment stablecoins. web-cited
The proposed rule… encourages innovation in payment stablecoins while providing an appropriately tailored regime to mitigate potential illicit finance risks… The law directs Treasury to issue regulations that would treat permitted payment stablecoin issuers (PPSIs) as financial institutions for purposes of the Bank Secrecy Act (BSA) and impose anti-money laundering obligations on PPSIs… The GENIUS Act also mandates that PPSIs maintain an effective sanctions compliance program and directs Treasur
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[12] Pi Network completed a mandatory Protocol 24 mainnet upgrade in early June 2026, requiring all nodes to update by June 2 or be disconnected, with the upgrade involving subsystem changes, Ubuntu 20→24 migration, and internal data reconfiguration to improve node synchronization and system reliability. web-cited
On June 3, Pi Network commenced the deployment of its Protocol 24 upgrade, aimed at enhancing the fundamental performance of the network, refining node synchronization, and bolstering overall system reliability… The upgrade… incorporates numerous subsystem enhancements, internal data reconfiguration, and substantial infrastructure improvements. This transition also includes upgrades from Ubuntu 20 to 24… All main nodes were mandated to complete this upgrade by June 2, or they would face disconne
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[13] Pi Network’s follow‑on Protocol 25 upgrade has a hard deadline of June 18, 2026, with nodes that fail to upgrade dropped from the network and rendered unable to validate transactions or earn rewards due to incompatibility with the post‑upgrade consensus mechanism. web-cited
Pi Network’s Protocol 25 upgrade has a hard deadline of June 18, 2026, and node operators who miss it risk being cut off from the mainnet entirely… Every node operator on the Pi Network must update their software to Protocol 25 before June 18, 2026… Nodes that fail to upgrade will be incompatible with the post-upgrade consensus mechanism. In practical terms, non-compliant nodes get dropped from the network. They won’t validate transactions, won’t earn rewards, and could theoretically create a fo
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[14] Berachain is scheduled to launch its Fusaka mainnet upgrade on June 24, 2026, while Canton Network plans a v3.5 mainnet upgrade and NEAR Protocol will roll out its v2.13 network upgrade in June, coordinating with other events such as IoTeX’s v2.4.0 upgrade and Starknet’s STRK20 privacy standard mainnet launch. web-cited
On the 24th of June, Berachain will launch its Fusaka mainnet upgrade, while Canton Network ($CC) will also unveil the v3.5 mainnet upgrade. Moreover, GRVT ($GRVT), Cambria ($RSGP), and Arcium ($ARX) have scheduled TGEs for June 2026. Furthermore, NEAR Protocol ($NEAR) will launch its v2.13 network upgrade in the same month… June 7 will witness the launch of a critical upgrade for IoTeX ($IOTX)… Starknet ($STRK) is going to launch its new STRK20 Privacy Standard on mainnet.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
[15] Over a 13‑day stretch in early June 2026, Bitcoin ETFs saw approximately $4.33 billion in net outflows coinciding with a market cap drop to about $2.13 trillion and more than $1 billion in leveraged positions liquidated within 48 hours, as BTC fell from around $72,000 to the $61,000 range and Ethereum dropped 18% in seven days. web-cited
Bitcoin fell from around $72,000 to the $61,000 range over the week, Ethereum dropped 18% over seven days… total cryptocurrency market capitalization fell to approximately $2.13 trillion… Within 48 hours, the total value of leveraged positions liquidated in the market at one point exceeded $1 billion… there have been 13 consecutive trading days of net outflows, totaling approximately $4.33 billion.
This excerpt was not re-derived from the source page, and may paraphrase or condense it. Check the source before relying on it.
Sources
- https://cryptorank.io/news/feed/b25a9-bitcoin-etf-outflows-june-2025
- https://beincrypto.com/bitcoin-etf-outflows-record-streak-june-2026/
- https://x.com/DefiantNews/status/2065461725353415057
- https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained
- https://www.halborn.com/blog/post/explained-the-syscoin-bridge-hack-june-2026
- https://www.tradingview.com/news/newsbtc:c86ddf2f6094b:0-cross-chain-protocol-gravity-bridge-suffers-5-4-million-attack-details/
- https://finance.yahoo.com/markets/crypto/articles/may-defi-hack-tally-grows-032424900.html
- https://altfins.com/blog/defi-hacks-2026/
- https://blog.thirdweb.com/defi-lost-840-million-in-2026-so-far-heres-what-builders-need-to-know-about-the-security-crisis/
- https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-24.html
- https://home.treasury.gov/news/press-releases/sb0435
- https://beincrypto.com/pi-network-protocol-24-upgrade-pi-price-all-time-low/
- https://coinfomania.com/pi-network-protocol-25-upgrade-june-deadline/
- https://www.binance.com/en/square/post/329550167404018
- https://www.kucoin.com/news/flash/crypto-market-sees-sharp-june-drop-amid-etf-outflows-and-regulatory-focus