April hacks drain $606M from DeFi

TLDR

In April 2026, DeFi protocols have already lost over $606 million to hacks, making it the worst month for crypto exploits since early 2025.

1. Two giant attacks on KelpDAO and Drift Protocol account for roughly 95 percent of the more than $606 million in April DeFi losses.
2. The hacks triggered sharp outflows from DeFi, with around $13 billion in TVL leaving and Aaves deposits dropping by billions in days.
3. Attackers are targeting cross-chain infrastructure and humans, not just smart contracts, so users and protocols need to focus on operational and bridge security, not audits alone.

Deep Dive

1. Where The $606M Went

Analytics cited by multiple outlets report that DeFi protocols lost over $606 million to exploits in the first 18 to 20 days of April, already making it the worst month for hacks since the Bybit incident in February 2025. This figure comes from incident tracking by DefiLlama and CertiK, reported as over $606 million in April 2026.

Two incidents dominate the total. KelpDAO, an Ethereum liquid restaking protocol, was drained for about $292293 million when attackers forged cross-chain messages through LayerZeros EndpointV2, minting 116,500 unbacked rsETH before swapping it out, as detailed in this KelpDAO exploit recap. Drift Protocol, a major Solana perpetuals DEX, lost roughly $285286 million in a separate breach, likely involving compromised privileged access.

Across roughly a dozen incidents in April, these two alone make up about 95 percent of the months losses and roughly three quarters of all crypto theft in 2026 to date, according to incident tallies.

2. Impact On DeFi TVL And Tokens

The immediate response was a rush to exit DeFi. After the KelpDAO hack, total DeFi value locked fell by about $13 billion within 48 hours, with TVL dropping from roughly $99.5 billion to about $85.4 billion, based on DeFiLlama data. Ethereums DeFi TVL alone shrank by more than $10 billion over two days.

Aave, a key money market heavily entangled with rsETH, froze affected markets and saw TVL drop from around $26.4 billion to the high teens, while its governance token fell more than 20 percent in the aftermath, as described in this Aave-focused hack analysis. Mid-cap DeFi tokens experienced 58 percent single-session drawdowns during peak fear, and analysts say markets are now pricing a security risk premium on DeFi assets.

Importantly, reports emphasize that base chains like Ethereum and Solana were not compromised at the protocol level. The failures occurred in third-party applications and cross-chain infrastructure, not in the core consensus layers.

3. How Attack Patterns Are Evolving

Aprils losses are not just about size but about how attackers strike. CertiK notes that April exploit losses exceeded $633 million, with most of the dollar damage coming from a few catastrophic infrastructure-level failures rather than many small bugs, marking a shift toward systemic targets as covered in this April exploit overview.

The KelpDAO incident exploited a single-point-of-failure verifier configuration in a cross-chain setup, not a novel contract bug. Meanwhile, security groups link several April attacks, including wallet-related incidents, to North Koreas Lazarus Group and its TraderTraitor unit, which use long-running, AI-assisted social engineering to compromise keyholders and infrastructure, as discussed in broader April hack coverage.

For users, the risk now lies heavily in bridges, restaking and cross-chain messaging layers, and in human operations such as key management and domain or front-end security. Technical audits alone do not cover these exposures.

Conclusion

Aprils more than $606 million in DeFi hacks show that crypto security risks are concentrating in a few deeply interconnected infrastructure points rather than many isolated bugs. The market response, including double-digit TVL outflows and a visible risk premium on DeFi tokens, suggests investors are repricing protocol and bridge risk. Whether confidence recovers will depend on how quickly projects like KelpDAO, Drift, LayerZero, and major lenders such as Aave harden their designs and how soon DeFi TVL stabilizes after this shock.