Threat actors stole $763.9 million across 67 incidents in the second quarter of 2026, making it the most severe period for Web3 security since Q2 2025. The losses came despite many of the targeted protocols having undergone code audits, underscoring a persistent gap between audit results and real-world safety.
Audited protocols among the victims
Breaches hit protocols that had passed point-in-time code reviews, according to the data. The incidents challenge the assumption that a clean audit report equals lasting protection. Audits check code at a single moment, but attackers exploit changes, misconfigurations, or new vulnerabilities that emerge after the review is complete.
Of the 67 incidents, several involved projects that had been audited by well-known firms. The exact number of audited protocols among the victims wasn't disclosed, but the pattern is clear: an audit stamp doesn't stop a determined threat actor.
The limits of point-in-time audits
The Q2 figures highlight a misconception that has dogged the Web3 space for years. Many projects treat audits as a final seal of approval, but security professionals have long warned that audits are snapshots, not guarantees. The $763.9 million total — the highest quarterly figure since Q2 2025 — suggests the industry hasn't fully absorbed that lesson.
Attackers are getting faster. They monitor protocol updates, governance changes, and liquidity shifts. A vulnerability that didn't exist during an audit can appear days later. The data from Q2 2026 shows that even projects with multiple audits weren't immune.
What the numbers mean for the industry
The 67 incidents represent a broad range of attack vectors: smart contract exploits, private key compromises, oracle manipulation, and more. No single type dominated. The diversity of methods suggests that threat actors are probing every weak point, not just un-audited code.
For project teams, the takeaway is that security can't stop at the audit. Continuous monitoring, bug bounties, and formal verification are becoming table stakes. But the Q2 data shows that many projects still rely on a single audit as their main defense.
The $763.9 million figure doesn't include losses from scams or phishing that didn't involve a protocol breach. The real total is likely higher. And with Q3 already underway, the industry faces the same unresolved question: how to build security that keeps pace with attackers who don't wait for the next audit.
