Lazarus Group drives record $635M DeFi losses

TLDR

North Korea's Lazarus Group was behind roughly $635 million of DeFi hacks in April 2026, making it one of the worst months for protocol security on record.

1. Two big exploits on Drift Protocol and KelpDAO drove most of the roughly $630635 million in losses attributed to Lazarus-linked actors.
2. The attacks hit Solana and Ethereum DeFi, triggered multi?billion dollar TVL outflows, and hurt sentiment, especially around Ethereums DeFi stack.
3. Lazarus is shifting to long, targeted social engineering and bridge exploits, so access control, key management, and cross-chain security are the key things to watch.

Deep Dive

1. How Lazarus Reached About $635M

Reports attribute around $635 million in April 2026 DeFi losses to North Koreas Lazarus Group and related DPRK units, mainly through two massive hacks on Drift Protocol and KelpDAO. A detailed breakdown shows a roughly $285 million exploit on Solana-based Drift and a roughly $292293 million theft from KelpDAOs rsETH bridge, together driving more than 90 percent of the months total DeFi losses, according to DeFiLlama and coverage by Crypto Briefing and Bitcoin.com. A TRM Labs analysis cited by CoinDesk concludes that DPRK-linked groups were responsible for about 76 percent of all global crypto hack losses in early 2026 and over $6 billion stolen since 2017.

2. Impact On DeFi And Major Ecosystems

The Drift and KelpDAO hacks hit core infrastructure on Solana and Ethereum. After the KelpDAO exploit, more than $13 billion reportedly exited DeFi lending and bridge protocols, with Aave alone seeing about $8.5 billion in deposit outflows and a large bad-debt overhang. Coverage notes that April 2026 set a record for incident count, with roughly 2830 hacks and over $625 million stolen across DeFi, even though most smaller incidents were under $5 million each. Prediction markets tracked in one analysis showed Ethereums odds of reaching higher price milestones in April falling, reflecting weaker near-term confidence in its DeFi stack.

3. Evolving Tactics And What To Watch

TRM Labs and multiple incident reports describe a shift in Lazarus tactics toward slower, targeted operations. The Drift exploit reportedly followed a six-month in-person social engineering campaign against team members, while the KelpDAO theft abused a known bridge vulnerability and then rapidly laundered funds through services like THORChain and privacy tools. Investigators also point to compromised admin or deployer keys and missing multisig/timelocks as recurring failures in both these and smaller April exploits. For users and protocols, key signals to monitor are: stronger key management and governance, real-time anomaly detection on bridges, insurance or backstop mechanisms, and any coordinated regulatory or law-enforcement actions that raise the cost of these operations.

Conclusion

Lazarus turning its focus to DeFi bridges and protocol access controls produced a concentrated wave of roughly $635 million in losses, driving record incident counts and sharp TVL outflows. The headline number matters less than the pattern: a small number of highly targeted, well-executed attacks against weak governance and bridge infrastructure can overwhelm incremental security gains elsewhere in DeFi. Watching how quickly protocols harden keys, bridges, and monitoring will be critical for judging whether this was a one-off spike or the start of a more persistent high-risk regime.