Crypto hacks hit record $450M stretch

TLDR

Crypto has just seen its worst two week stretch for hacks on record, with around $450 million stolen across dozens of protocols, led by massive DeFi exploits.

1. Around $450 million was drained across roughly 45 protocols in two weeks, including nearly $300 million from KelpDAO and a separate nine figure whale compromise.
2. The wave clusters around high risk areas such as cross chain bridges, liquid restaking, and large DeFi wallets, where composability and key security are weak points.
3. Bitcoin and broader markets are mostly unfazed so far, but DeFi users in restaking and lending protocols face direct loss risk and ongoing freeze or bad debt issues.

Deep Dive

1. What Happened In This Stretch

Reporting shows crypto hacks have hit a record pace, with about $450 million lost across 45 protocols in two weeks, while major markets barely reacted so far. This includes exploits and scams grouped over that period rather than a single event, according to one summary of the recent record pace of hacks.

The biggest single incident was the KelpDAO liquid restaking protocol, where attackers drained about $293.7 million via its rsETH bridge and propagated losses across Ethereum and Arbitrum lending markets, making it the largest exploit of 2026 so far. That figure comes from detailed breakdowns of the KelpDAO exploit.

Separately, a whale lost over $280 million when attackers took over DeFi positions across Ethereum and Arbitrum, in what on chain analysts describe as one of the largest individual wallet compromises on record, as covered in the whale compromise report.

2. Why DeFi Is So Exposed Right Now

The common thread is complexity. KelpDAOs loss stemmed from its cross chain bridge for rsETH restaking tokens, where a bug and key compromise allowed attackers to mint or move unbacked assets and then borrow real ETH across multiple protocols, causing cross protocol contagion.

These liquid restaking and bridge designs rely heavily on composability (many protocols plugging into each other), which magnifies the blast radius when one component fails. Security firms and Aave itself described the KelpDAO incident as a composability driven contagion, and AAVEs price dropped around 18 percent after the hack, according to coverage of the Aave response and price move.

At the same time, large holders remain prime targets for phishing and private key theft, which bypasses smart contract audits entirely and can instantly drain multi chain DeFi portfolios.

3. Market Impact And What To Watch

Despite the scale of these losses, Bitcoin prediction markets pricing a level above 60,000 dollars in mid April barely moved, with the main market still at full YES odds and modest volume, as noted in the same record hacks overview. That suggests the broader market is treating this as a DeFi sector problem, not a systemic crypto shock, at least for now.

By contrast, tokens directly tied to the incidents, like AAVE and assets closely linked to rsETH, have seen sharp drawdowns and frozen markets as protocols pause activity to prevent further contagion.

Key things to watch are: post mortems and remediation from KelpDAO and LayerZero, whether rsETH can maintain its peg and redemptions, how much bad debt remains in lending protocols, and whether regulators use this cluster of incidents to justify tighter rules on bridges and restaking.

Conclusion

A roughly $450 million spike in hacks over two weeks highlights that DeFis most innovative areas remain its weakest points for security, especially cross chain bridges and restaking structures. While Bitcoin and the broader market have largely shrugged off this stretch so far, users and protocols directly integrated with these systems face real loss, freezes, and bad debt risk, making smart contract design, composability limits, and operational security central to navigating the current cycle.