DeFi suffers $606M in April hacks

TLDR

In April 2026, DeFi protocols lost roughly $606 million to hacks, making it the worst month for exploits since early 2025.

1. Around $606 million was stolen across roughly a dozen incidents, with two mega-hacks on KelpDAO and Drift accounting for about 95% of losses.
2. The attacks targeted cross-chain infrastructure and off-chain tooling as much as smart contracts, triggering sharp drops in DeFi TVL and confidence.
3. Users should treat bridges, restaking products, and newer DeFi venues as higher risk, and watch for improved security standards before assuming this risk cycle is over.

Deep Dive

1. Scale And Concentration Of April Losses

Analytics cited by several reports put Aprils crypto hack tally at about $606.2 million across 1213 incidents, mostly in DeFi and bridge infrastructure, within the first ~20 days of the month.

The largest hits came from KelpDAO (an Ethereum liquid restaking protocol) losing roughly $292293 million and Drift Protocol (a Solana perpetuals DEX) losing about $285 million, which together made up around 95% of Aprils losses and roughly three quarters of 2026s year-to-date hacked value.

Smaller incidents affected projects like Hyperbridge, CoW Swap, Zerion, Silo Finance, and Aethir, but they were minor compared with the two flagship exploits.

2. How These Hacks Hit DeFi Itself

KelpDAOs loss was driven by forged cross-chain messages on LayerZero-based infrastructure, letting an attacker mint unbacked rsETH and post it on lending platforms like Aave as collateral, creating bad debt and a bank run style liquidity crunch.

Drifts exploit was tied to sophisticated social engineering and infrastructure compromise rather than a simple on-chain bug, consistent with broader patterns where attackers increasingly target front ends, DevOps providers, cloud platforms, and human operators instead of only contracts.

After the Kelp incident, DeFi total value locked fell sharply, with reports of over $10 billion in net outflows from top DeFi chains in a couple of days and Aaves TVL dropping from about $26 billion to the high teens.

3. What To Watch And How To Think About Risk

1. Infrastructure risk: Cross-chain bridges, liquid restaking, and modular messaging layers are now prime targets; many failures stem from configuration or key management, not Solidity bugs.
2. Adversary quality: State-linked groups (especially North Korea-associated clusters) and AI-enabled social engineering are prominent, raising the baseline sophistication of attacks.
3. Market regime: DeFi may carry a security tax, with higher risk premia, lower leverage appetite, and investors favoring protocols that demonstrate strong operational security and transparent incident response.

Conclusion

The $606 million April hack tally shows that DeFis main fragility now lies in bridges, restaking infrastructure, and operational security rather than only contract logic.

Until security practices catch up with this new attack surface, capital in DeFi is likely to remain more cautious, with users favoring better-audited, simpler architectures and limiting exposure to complex cross-chain setups.