RESEARCH: Smart contract exploits and DeFi hacks in the last 48 hours

https://owasp.org/projects/smart-contract-top-10

OWASP Smart Contract Top 10 (2025)

SC01 - Access Control Vulnerabilities
Description: Access control flaws allow unauthorized users to access or modify a contract’s data or functions. These vulnerabilities arise when the code fails to enforce proper permission checks, potentially leading to severe security breaches.
SC02 - Price Oracle Manipulation
Description: Price Oracle Manipulation exploits vulnerabilities in how smart contracts fetch external data. By tampering with or controlling oracle feeds, attackers can affect contract logic, leading to financial losses or system instability.
SC03 - Logic Errors
Description: Logic errors, or business logic vulnerabilities, occur when a contract’s behavior deviates from its intended functionality. Examples include incorrect reward distribution, token minting issues, or flawed lending/borrowing logic.
SC04 - Lack of Input Validation
Description: Insufficient input validation can lead to vulnerabilities where an attacker may manipulate the contract by providing harmful or unexpected inputs, potentially breaking logic or causing unexpected behaviors.
SC05 - Reentrancy Attacks
Description: Reentrancy attacks exploit the ability to reenter a vulnerable function before its execution is complete. This can lead to repeated state changes, often resulting in drained contract funds or broken logic.
SC06 - Unchecked External Calls
Description: Failing to verify the success of external function calls can result in unintended consequences. When a called contract fails, the calling contract may incorrectly proceed, risking integrity and functionality.
SC07 - Flash Loan Attacks
Description: Flash loans, while useful, can be exploited to manipulate protocols by executing multiple actions in a single transaction. These attacks often result in drained liquidity, altered prices, or exploited business logic.
SC08 - Integer Overflow and Underflow
Description: Arithmetic errors due to exceeding the limits of fixed-size integers can lead to serious vulnerabilities, such as incorrect calculations or token theft. Unsigned integers wrap around on underflow, while signed integers flip between extremes.
SC09 - Insecure Randomness
Description: Due to the deterministic nature of blockchain networks, generating secure randomness is challenging. Predictable or manipulable randomness can lead to exploitation in lotteries, token distributions, or other randomness-dependent functionalities.
SC10 - Denial of Service (DoS) Attacks
Description: DoS attacks exploit vulnerabilities to exhaust contract resources, rendering it non-functional. Examples include excessive gas consumption in loops or function calls designed to disrupt normal contract operation.

https://altfins.com/blog/defi-hacks-2026/

DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything

Summary:
Over a five‑month period from January to May 2026, decentralized finance (DeFi) protocols collectively lost over $840 million, marking a 70% year‑over‑year increase compared to the same period in 2025. Notably, 72% of these losses stemmed from stolen keys and credential theft rather than smart contract vulnerabilities. The Lazarus Group, linked to North Korea, was attributed to approximately 76% of global crypto hack losses in 2026. Bridges holding $21.94 billion in total value locked (TVL) emerged as the single highest‑risk surface in DeFi infrastructure.

Key Developments:

April 1, 2026: Drift Protocol lost ~$285 million due to a social engineering/key theft attack attributed to the Lazarus Group.
April 19, 2026: KelpDAO suffered a loss of ~$292 million from a bridge/infrastructure exploit also linked to the Lazarus Group.
June 9, 2026 (today): Humanity Protocol was exploited for $30–32 million via a stolen private key, highlighting ongoing risks in private‑key management.

Sources:
DeFi Hacks 2026: $840M+ Lost and the Attack That Changed Everything

Summary

The research reveals a significant shift in DeFi attack vectors from traditional smart contract vulnerabilities to operational and human‑layer failures, such as stolen keys and credential theft. The Lazarus Group's involvement underscores the rising threat of state‑linked cyberattacks targeting DeFi infrastructure. Bridges remain critical risk points due to their high TVL and susceptibility to exploits.

Key Developments

April 1, 2026 — Drift Protocol: ~$285M lost via social engineering/key theft DeFi Hacks 2026
April 19, 2026 — KelpDAO: ~$292M lost through bridge/infrastructure exploit DeFi Hacks 2026
June 9, 2026 — Humanity Protocol: $30–32M drained via stolen private key DeFi Hacks 2026