June's Crypto Thefts Concentrate in Stolen Keys, Not Broken Contracts

The security ledger tracked by Rekt News and independent researchers points to the same conclusion for 2026: the costliest failures are increasingly about who holds the keys, not whether the code is correct. Reported losses across crypto platforms reached roughly $75.9 million in June, according to BeInCrypto's tally.

The largest June incident hit Humanity Protocol, an identity network. An attacker who compromised an employee's laptop obtained enough keys to control a hot wallet and two multi-signature accounts, then drained tokens that CoinDesk reported at about $32 million, wiping most of the token's value within a day. The root cause was access control, not a contract exploit. On-chain investigator ZachXBT publicly questioned the circumstances and called the episode "possibly staged," a claim the project has not confirmed and that remains contested.

A second incident struck SecondFi, a Cardano project, where a flaw in the wallet software exposed user funds. The security firm SlowMist estimated losses may exceed $20 million, with more than 129 million ADA moving through addresses tied to the attacker. Smaller drains through the month, spanning deprecated contracts and compromised operator accounts, make up the balance of the total.

Read against the full year, the pattern is consistent. Multiple industry trackers now attribute more than half of DeFi incidents by count to compromised accounts rather than smart-contract logic, with cross-chain bridges and privileged keys the recurring weak points. The through-line is custody discipline: many of these systems concentrate control in a few keys while marketing themselves as decentralized.