Dragonfly's Qureshi says crypto hacks surge at smaller DeFi protocols

In short

• Haseeb Qureshi says crypto hacking attempts are surging while annualised stolen funds stay roughly flat versus 2025.
• Attackers are concentrating on small, poorly maintained DeFi protocols, according to Qureshi and aggregator reports.
• InvestIn.News found small protocols often lack the money to spend on security that big protocols afford.
• Qureshi expects a similar attack wave to spread to traditional internet security.

Hacks surge but stolen funds stay flat

Haseeb Qureshi , managing partner at Dragonfly, said on 22 October 2026 that crypto hacking attempts are surging even though the annualised value of stolen funds is roughly flat compared with 2025, according to BlockBeats and TechFlow. The attackers are now concentrating on small, poorly maintained DeFi protocols, and an InvestIn.News check found a key reason: those projects often cannot afford the security budgets that large protocols maintain. DeFi, short for decentralised finance, lets people lend, borrow and trade through software rather than banks.

How Qureshi reads the numbers

The rise in attacks with flat losses means the average payout per hack has fallen. Qureshi said onchain attacks are the easiest to monetise directly, so security incidents in crypto protocols act as an early warning for the rest of the internet. He added that crypto already saw this pattern first. Large protocols have begun using AI tools to strengthen their defences, while smaller ones have not, according to TechFlow and KuCoin.

Why small protocols are the target

InvestIn.News found that small protocols often do not have enough money to survive in the current market, so they cut back on security spending compared with larger protocols. That makes them an easier target, especially now that AI has made both hacking and defending protocols faster. The result is a market where attackers repeatedly hit the weakest, least maintained projects.

What it means for DeFi users

For ordinary DeFi users, the shift changes where the risk sits. Deposits in a small lending or yield protocol may now sit behind weaker code and fewer audits than those in a top-tier platform. Attackers are not necessarily taking more money in total; they are taking smaller amounts from more places, which can still wipe out a saver's balance in one incident.

Reactions and the wider warning

Haseeb Qureshi (@hosseeb) wrote on X that onchain attacks act as an early warning for the wider web, and called the present period a pandemic-style surge sweeping the internet. Other posters placed the alert in a wider security context. Satoshi Drops (@SatoshiDropsHQ) said on X the remedy was dull: fewer lasting permissions, fewer overlooked admin keys and audits for small, older protocols. Alex Volkov (@altryne) posted on X that the defenders' window was 'coming to a close'; Haze (@0xHxxe) wrote on X that onchain 'gets hacked in public first'; and Jack (@JackN1x) said on X that attackers were 'lurking, testing waters'. Qureshi expects a comparable broad attack pattern to reach the traditional internet sector, according to TechFlow.

Questions readers ask

Why does Haseeb Qureshi say crypto hacks are surging at smaller protocols?

Haseeb Qureshi of Dragonfly said attackers are concentrating on small DeFi protocols with weak security and poor maintenance. InvestIn.News found these projects often lack money to spend on security, making them easier targets than larger protocols.

What does Haseeb Qureshi mean by crypto hacks as a canary?

He said onchain attacks are the easiest to monetise, so crypto security incidents act as an early warning for the rest of the internet. He expects a similar wave to spread to traditional web security.

Are total crypto thefts higher in 2026 than in 2025?

No, according to BlockBeats the annualised value of stolen funds is roughly flat compared with 2025, even though the number of hacks has surged. The average loss per attack has fallen.

Our view

At InvestIn.News, we think the shift toward smaller protocols is not random. AI has made both attacking and defending easier, as our check found. Large protocols are spending more on security, while small protocols often cannot, and attackers know it. The wave Qureshi describes is therefore a rational move by attackers toward the weakest, least maintained targets.

The flat annualised losses alongside a surge in incidents supports this reading. Attackers are not necessarily getting better at stealing more; they are hitting more soft targets for smaller amounts. For ordinary DeFi users, that changes the practical risk: a small yield pool may now be more dangerous than a large exchange.

The view would change if small protocols start adopting the same AI defences as large ones, or if losses per attack begin to climb again despite the rising number of incidents.

Follow the latest updates as they happen on NewsFeeds.

— Jayshree Majumdar