The first quarter of 2026 saw crypto hackers siphon more than $168.6 million from 34 DeFi protocols, according to DefiLlama’s quarterly tally. The figure marks a sharp decline from the same window in 2025, which recorded roughly $1.58 billion in losses, largely driven by a $1.4 billion breach at Bybit.

Notable incidents in Q1 2026 included a $40 million private-key compromise at Step Finance in January, a $26.4 million ether drain from Truebit caused by a smart contract manipulation on January 8, and a March 21 private-key attack targeting stablecoin issuer Resolv Labs. DefiLlama notes that even a handful of high-value hacks can shape quarterly totals, underscoring the ongoing risk landscape in DeFi security.

Key takeaways

• DefiLlama records $168.6 million stolen across 34 DeFi protocols in Q1 2026, signaling a quieter quarter for hacks compared with 2025.
• The largest single incident was Step Finance’s $40 million private-key compromise in January.
• Bybit’s $1.4 billion breach in Q1 2025 dwarfed this quarter’s tally, illustrating how a few mega-hacks can skew year-over-year comparisons.
• Security experts caution that cyber threats in crypto correlate with market cycles and liquidity concentration, not with calendar quarters, emphasizing the need for continuous defense.

DefiLlama tally and incident snapshots

DefiLlama’s dataset highlights 34 security breaches across DeFi protocols in the first three months of 2026, totaling about $168.6 million in stolen funds. The quarter’s largest incident was Step Finance’s $40 million private-key compromise in January, followed by a $26.4 million Ethereum loss from a Truebit vulnerability on January 8. A third notable case involved a private-key breach targeting Resolv Labs, a stablecoin issuer, on March 21. The concentration of losses around a few high-value breaches demonstrates how theDeFi security landscape can be shaped by a small number of outsized events even as total losses remain lower than a year earlier. For context on the data source, see DefiLlama’s hack tracker at DefiLlama hacks.

Attacker incentives rise with liquidity and market activity

Analysts point to market dynamics as a core driver of cybercrime activity in crypto. Nick Percoco, chief security officer at Kraken, told Cointelegraph that threat actors tend to intensify during market cycles and around major product launches, when more liquidity and value are at stake.

“Bull markets, major product launches and fast-moving growth phases all create more attractive conditions for attackers because more value is at stake and new infrastructure can introduce risk.”

“That said, attacks are not confined to just these periods. Vulnerabilities can be exploited in any market environment, particularly in complex or rapidly evolving systems, underlining that security in crypto must be continuous.”

The takeaway is clear: as long as liquidity concentrates and new tech enters the ecosystem, attackers will adapt. The industry’s challenge is sustaining rigorous security practices across evolving platforms and infrastructures.

Threat actors and the evolving risk landscape

North Korea-linked actors have long been a persistent threat to crypto investors and Web3-native companies. Attacks attributed to these groups have grown in visibility, including a high-profile Drift Protocol incident described as involving a private-key leak that led to an estimated $285 million in losses. Security experts describe the current threat landscape as a broad and evolving mix—ranging from highly coordinated groups targeting core infrastructure to opportunistic hackers scanning for weaknesses in smart contracts and client-facing systems.

As one industry voice summarized, “the most attractive targets tend to be those combining large concentrations of value, technical complexity and gaps in operational security.” The transparency of crypto networks can also aid opportunistic attackers in spotting emerging weaknesses, underscoring the need for vigilant, ongoing security measures. In tandem with these dynamics, researchers have warned that 2026 could see more credential theft, social engineering, and AI-powered attacks, elevating the overall risk profile for users, builders, and investors alike. A related Immunefi security report notes that hacked tokens often suffer substantial price declines and rarely recover, highlighting the lasting impact of breaches. See the related piece here: Hacked crypto tokens drop 61% on average and rarely recover, Immunefi report says.

As Q1 2026 closes, the industry faces a critical test: can security teams keep pace with rapid innovation and increasing attack surface, or will the trend towards bigger, more sophisticated exploits outpace defenders?

Readers should watch for ongoing upgrades in key management, more robust credential protection, and collaborative threat intelligence efforts across exchanges and projects as the market moves forward. The evolving threat landscape will continue to shape risk assessments, investment decisions, and security priorities in the months ahead.

Naoris Protocol debuted its quantum-resistant blockchain Thursday, which it says is designed to stay secure even against future powerful quantum computers that could break modern day cryptography.

“Mainnet represents the transition from proof-of-concept to production infrastructure. The network has already validated over 100 million transactions using post-quantum cryptography. That is not a roadmap promise; it is measured, operational capacity,” Nathaniel Szerezla, chief growth officer of Naoris Protocol, said.

The debut comes as legacy chains Bitcoin and Ethereum confront the threat of a “quantum apocalypse.” Known as Q-Day, this is the point when future quantum computers could crack the encryption securing most blockchains.

Concerns escalated this week after Google reported that a sufficiently powerful quantum computer could break Bitcoin’s blockchain with fewer than 500,000 qubits — far lower than previous estimates. At the same time, another report flagged potential vulnerabilities in Ethereum that could put $100 billion on the blockchain at risk.

Because blockchain transactions such as those on Bitcoin and Ethereum are permanent, any weakness today could be exploited by future quantum computers with the necessary power.

Naoris is built different

This is where Naoris stands out. It is built from the start using post-quantum cryptography and algorithms approved by the U.S. National Institute of Standards and Technology to protect accounts, transactions, and digital assets, according to the press release shared with CoinDesk.

The system incorporates an “irreversible security transition.” This means that once a user adopts post-quantum keys, it has to use quantum-resistant signatures for transactions. The protocol automatically blocks transaction attempts using traditional, vulnerable cryptographic methods, helping protect assets even if classical cryptography becomes vulnerable.

More importantly, while its quantum-resistant security is right now available only on its own mainnet, the system is build with a broad scope in mind for potential support to wallets, exchanges, Layer 2 networks, and DeFi platforms in the future.

The mainnet launched with an invite-only group of strategic participants who operate the first validator nodes and form the network’s initial trust layer, laying a strong foundation before broader expansion. The protocol was tested at scale in an extensive testnet phase, during which it detected and mitigated over 603 million threats, processed more than 106 million post-quantum transactions, created over 3.3 million wallets, and activated more than one million security nodes globally.

The protocol’s native token NAORIS drives how the network works, helping secure transactions, enforce rules, and build trust among users. At press time, the token’s market cap was $36 million.

Algorand price shot up 21% on Friday, April 3, becoming the top gainer of the day, bucking the relative stillness of the broader crypto market that has gone cold amid the escalating war situation in the Middle East.

According to data from crypto.news, Algorand (ALGO) price rallied to a 9-week high of $0.122 on Friday before settling at $0.121 at press time. Its gains pushed it to become the leading gainer among the top cryptocurrencies by market cap in both the daily and weekly timeframes.

There are three main reasons why Algorand price rallied today.

First, Algorand was recently cited by Google Quantum AI in a research paper focused on threats faced by major blockchains from quantum computing. The paper made several mentions of Algorand for its post-quantum security and advanced Falcon signature technology, placing it ahead of other major players and trailing only behind Bitcoin and Ethereum.

This citation from one of the most prominent tech labs gave the project a big push to new investors while increasing hype for existing ones.

Second, Revolut has officially enabled staking for Algorand on its platform. This enables its customer base of over 70 million investors to stake ALGO directly from the app.

The move has increased investor demand for the token as it triggered a jump in the total amount being staked on the platform, effectively removing those tokens from circulation and hence lowering potential selling pressure.

Third, Algorand’s rebound follows the token hitting an all-time low just five days ago. The token dropping to its floor likely made it very attractive for buyers who bought the dip following its high-profile citation.

On the daily chart, Algorand price has formed a multi-month falling wedge pattern. Following its recent rebound, it has broken out from the upper trendline of the pattern, thereby confirming a bullish reversal. When such patterns are confirmed, the asset often enters a period of sustained growth.

At press time, a similar bullish outlook for ALGO was supported by technical indicators. Notably, the Supertrend has turned green, a notable sign of a trend shift. The Chaikin Money Flow index read 0.19, a strong positive reading hinting that buyers are in control.

For now, $0.139, which sits at the 23.6% Fibonacci retracement level, is the most immediate resistance level to keep an eye on for identifying more upside. A decisive break above that could potentially trigger a rally to $0.225, a target calculated by adding the height of the wedge to the point at which the breakout occurred.

On the contrary, a drop below the $0.085 support level can invalidate this bullish setup.

Key Insights

• Crypto market reversed fast as Trump’s Iran war stance crushed hopes of de-escalation and triggered risk-off selling.
• Bitcoin trades like a macro asset, while altcoins lead losses as oil spikes, yields rise, and the dollar strengthens.
• Market outlook remains fragile, with traders watching war signals and dollar strength for the next crypto move

What happens when markets price in peace but receive a tougher war stance instead? They sell first and reassess later. That is exactly what unfolded after Donald Trump addressed the Iran conflict from the White House on April 1.

Ahead of the speech, expectations had been building around a possible de-escalation. Analysts, including Kobeissi Letter, pointed to signals suggesting a potential wind-down. Instead, Trump reinforced a hardline position, stating that the United States would continue its aggressive posture toward Iran.

The next big question tonight:

Tons of major news outlets reported the same information ahead of President Trump’s address to the nation, sending markets sharply higher.

Almost all “insider sources” signaled Trump would be “winding down” the war tonight.

What just happened?

Advertisement

— The Kobeissi Letter (@KobeissiLetter) April 2, 2026

The reaction was immediate and broad-based—crypto, equities, oil, and the U.S. dollar all reversed sharply.

Crypto Market Reverses After Trump’s Iran Remarks

The crypto market quickly erased its short-lived relief rally following the speech. Investors hoping for clarity on de-escalation or a reopening timeline for the Strait of Hormuz were left disappointed.

Source: Coinmarketcap

As a result, selling pressure returned across digital assets:

• Bitcoin hovered around $66,600
• Ethereum dropped near $2,050
• XRP traded around $1.31
• BNB held near $590
• Solana led losses among major altcoins

This price action reinforces a key trend: Bitcoin is not behaving as a traditional safe-haven asset during this conflict. Instead, it is trading more like a macro-sensitive risk asset.

The speech effectively dismantled the emerging peace narrative, pushing markets back into a defensive stance. Altcoins, particularly high-beta assets like Solana, absorbed the heaviest losses as traders reduced risk exposure.

Oil Surge and Macro Pressure Weigh on Crypto

Beyond crypto, the broader macro environment shifted rapidly. Following Trump’s remarks, Brent crude surged over 6% to $107.69, reflecting heightened geopolitical risk and concerns over supply disruptions.

Global markets reacted sharply:

• U.S. stock futures fell 1.3%
• Japan’s Nikkei dropped 2.4%
• South Korea’s Kospi declined 4.7%

For crypto markets, this macro shift is critical.

Rising oil prices can fuel inflation expectations, which in turn strengthens the U.S. dollar and keeps bond yields elevated. These conditions typically pressure risk assets, including cryptocurrencies.

At the same time:

• The 10-year Treasury yield climbed to 4.376%
• The U.S. Dollar Index (DXY) held firm above 100

This environment explains why altcoins sold off more aggressively than Bitcoin, as traders moved to reduce volatility exposure rather than chase uncertain upside.

Traders Shift to Risk-Off Mode

The immediate takeaway from the market reaction is clear: traders are prioritizing capital preservation.

Going forward, markets will focus on two key signals:

1. Any softening in geopolitical rhetoric
2. Reduced risk to global shipping routes, particularly the Strait of Hormuz

Without improvement on either front, the crypto market is likely to remain highly sensitive to headlines and prone to sharp swings.

The pre-speech rally demonstrated that bullish sentiment still exists—but it is fragile and easily disrupted by macro developments.

Macro Now Drives Crypto

The latest selloff highlights a broader shift in how digital assets are behaving.

Geopolitics is influencing crypto through macroeconomic channels rather than crypto-native factors. Oil prices, bond yields, the U.S. dollar, and equity markets are now leading indicators, with crypto reacting afterward.

While blockchain-specific developments still matter, traders increasingly need to interpret global macro conditions before making crypto decisions.

Outlook: Defensive Trend Likely to Continue

Looking ahead, digital assets are expected to remain in a defensive posture as long as geopolitical tensions persist in the Middle East.

Although April seasonality has historically favored bullish momentum, the current environment is dominated by a hope → headline → reversal cycle. The Trump Iran speech is a clear example of how quickly sentiment can shift.

A sustained recovery in crypto will likely depend on:

• A formal ceasefire or de-escalation
• Stabilization in oil prices
• Weakness in the U.S. dollar

Until then, the U.S. Dollar Index (DXY) remains a critical indicator. A strengthening dollar continues to act as a major headwind for Bitcoin and the broader altcoin market.

Researchers at Google DeepMind have warned that the open internet can be used to manipulate autonomous AI agents and hijack their actions.

The study titled “AI Agent Traps” comes as companies deploy AI agents for real-world tasks and attackers begin using AI for cyber operations.

Instead of focusing on how models are built, the research looks at the environments agents operate in. It identifies six types of traps that take advantage of how AI systems read and act on information from the web.

The six attack categories outlined in the paper include content injection traps, semantic manipulation traps, cognitive state traps, behavioural control traps, systemic traps, and human in the loop traps.

Content injection stands out as one of the most direct risks. Hidden instructions can be placed inside HTML comments, metadata, or cloaked page elements, allowing agents to read commands that remain invisible to human users. Tests showed these techniques can take control of agent behaviour with high success rates.

Semantic manipulation works differently, relying on language and framing rather than hidden code. Pages loaded with authoritative phrasing or disguised as research scenarios can influence how agents interpret tasks, sometimes slipping harmful instructions past built-in safeguards.

Another layer targets memory systems. By planting fabricated information into sources that agents rely on for retrieval, attackers can influence outputs over time, with the agent treating false data as verified knowledge.

Behavioural control attacks take a more direct route by targeting what an agent actually does. In these cases, jailbreak instructions can be embedded into normal web content and read by the system during routine browsing. Separate tests showed that agents with broad access permissions could be pushed into locating and transmitting sensitive data, including passwords and local files, to external destinations.

System-level risks extend beyond individual agents, with the paper warning that coordinated manipulation across many automated systems could trigger cascading effects, similar to past market flash crashes driven by algorithmic trading loops.

Human reviewers are also part of the attack surface, as carefully crafted outputs can appear credible enough to gain approval, allowing harmful actions to pass through oversight without raising suspicion.

How to defend against these risks?

To counter these risks, researchers suggest a mix of adversarial training, input filtering, behavioural monitoring, and reputation systems for web content. They also point to the need for clearer legal frameworks around liability when AI agents execute harmful actions.

The paper stops short of offering a complete fix and argues that the industry still lacks a shared understanding of the problem, leaving current defenses scattered and often focused on the wrong areas.

Key Highlights

• • Sakura Internet’s stock price climbed 20.27% following Microsoft’s revelation of a $10 billion AI commitment in Japan
  • The tech giant will deploy 1.6 trillion yen from 2026 through 2029 focusing on AI systems and cybersecurity initiatives
  • Partnership includes Sakura Internet and SoftBank delivering Japan-based AI computational power, featuring GPU resources
  • Training initiative targets 1 million Japanese engineers and developers by the end of the decade
  • SoftBank Group shares increased 0.22% while SoftBank Corp. climbed 1.02% following the announcement

Shares of Sakura Internet experienced a significant 20.27% surge on Friday following Microsoft’s revelation of a substantial AI investment strategy in Japan, with the cloud services provider designated as a primary collaborator along with SoftBank.

Microsoft announced a four-year, $10 billion investment package in Japan, part of the US company’s Asia-wide push to expand in a region hungry for artificial intelligence services- Bloomberg

•$10B for data centers and AI infrastructure through 2029
•Builds on $2.9B announced… pic.twitter.com/laIAvfd383

— Yeboah Walee (@YeboahWalee) April 3, 2026

The Redmond-based technology giant confirmed plans to deploy 1.6 trillion yen — approximately $10 billion — across Japan from 2026 to 2029. This capital allocation encompasses AI infrastructure development, cybersecurity collaboration efforts, and an ambitious commitment to educate 1 million engineers and developers over the next six years.

Microsoft Corporation, MSFT

Brad Smith, Microsoft Vice Chair and President, disclosed these plans during his Tokyo visit, which included meetings with Prime Minister Sanae Takaichi.

Sakura Internet, operating a network of data centers throughout Japan, will collaborate with SoftBank to deliver AI computational capabilities through this alliance. The partnership specifically includes graphics processing units situated physically inside Japanese borders.

This infrastructure arrangement enables corporations and governmental bodies to handle confidential information domestically while maintaining access to Microsoft Azure cloud services.

Additional discussions between SoftBank and Microsoft Japan involve creating a combined solution allowing Azure users to access SoftBank’s AI computing infrastructure seamlessly.

Friday’s trading saw SoftBank Group finish 0.22% higher, with SoftBank Corp. posting gains of 1.02%.

Japan’s Strategic Importance

Microsoft highlighted Japan’s robust AI adoption rates as a key motivation behind this investment decision. Data from Microsoft’s AI Diffusion Report indicates that approximately 20% of Japan’s working-age population currently utilizes generative AI technologies, surpassing the global average of roughly 16%.

Smith emphasized the expanding demand for cloud computing and AI capabilities in Japan, noting that this investment supports Prime Minister Takaichi’s strategic vision of leveraging cutting-edge technology for economic expansion and national security objectives.

Extended Collaboration Framework

In addition to Sakura Internet and SoftBank, Microsoft revealed partnerships with five additional prominent Japanese technology firms to achieve its goal of training 1 million AI professionals by 2030. This roster includes industry leaders such as NTT Data Corp., NEC, Fujitsu, and Hitachi.

The collaborative framework will also facilitate advancement of indigenous large language models within Japan’s technology ecosystem.

Microsoft’s cybersecurity collaboration with Japanese authorities encompasses intelligence exchange regarding cyber threats and coordinated crime prevention measures.

Sakura Internet concluded Friday’s session at 2,967.00 JPY, representing a 500.00 JPY increase for the trading day.