TLDR
North Korea-linked Lazarus Group is reportedly behind about $635 million of DeFi protocol hacks in April 2026, making it cryptos most hacked month on record.
- Lazarus is blamed for record monthly DeFi losses, mainly the Drift Protocol and KelpDAO exploits that together account for over 90% of roughly $630 million stolen.
- The attacks hit Solana and Ethereum DeFi, triggering multibillion TVL outflows, an Aave bad debt shock, and weaker short term sentiment around Ethereum security.
- North Korean crypto hacking is getting more targeted and social engineering heavy, so users and protocols need stronger key management, access controls, and monitoring.
Deep Dive
1. Scale Of April Hacks
Analysts estimate that in April 2026, Lazarus Group was responsible for about $635 million of protocol losses, largely from a $285 million exploit of Solana based Drift Protocol and a ~$292293 million KelpDAO bridge hack on Ethereum.Cryptobriefing
DefiLlama data cited by other reports confirms April as the most hacked month in crypto history, with 2830 incidents and more than $625 million stolen, with Drift and KelpDAO making up roughly 93% of losses.Bitcoin.com summary of DefiLlama
TRM Labs adds that North Korean state backed groups including Lazarus account for about 76% of all global crypto hack losses in 2026 so far, nearly $600 million and more than $6 billion since 2017.Coindesk summary of TRM Labs
2. Impact On DeFi And Major Coins
The KelpDAO exploit, which drained around $292 million of rsETH via a LayerZero bridge, triggered over $13 billion in value exiting lending protocols, with Aave alone losing about $8.54 billion in deposits and facing nearly $200 million in bad debt before backstop plans emerged.Tokenpost on TRM Labs
Reports note that Ethereums DeFi infrastructure was hit directly, and prediction markets priced in a lower probability of ETH reaching higher targets in April, reflecting softer short term sentiment around its security.CryptoBriefing on hacks and sentiment
Solana DeFi was also affected through the Drift exploit, and overall DeFi TVL fell by more than $13 billion across bridges and lending platforms in the wake of these events.Bitcoin.com summary of DefiLlama
Yield and bridge opportunities now carry a more explicit geopolitical and protocol risk premium, so security assumptions around blue chip DeFi are being re priced, not just small caps.
3. Evolving Lazarus Tactics
TRM Labs describes Lazarus and related DPRK teams shifting from simple remote exploits to months long, in person social engineering, as seen in Drift, where operatives reportedly met staff to gain access.Coindesk summary of TRM Labs
Patterns include abusing admin or deployer keys (Wasabi style incidents), spoofing bridge messages (KelpDAO), and then laundering through paths like USDC to Ethereum, swaps into ETH, and mixers or cross chain routers such as THORChain and Umbra.Tokenpost on TRM Labs
For users and protocols, the weak points are operational: key management, upgrade permissions, validator access, and bridge message verification rather than only smart contract code.
The edge shifts to protocols that prove strict multisig or timelock controls, limited admin powers, and real time anomaly detection, while users benefit from preferring those designs over unchecked yield.
Conclusion
Lazarus Group turning DeFi into a primary target created a concentrated cluster of mega exploits in April that set new records for losses and incident count. The damage fell hardest on Solana and Ethereum DeFi, shaking confidence in bridges and lending protocols even as core chains remained functional. Going forward, security architecture and governance will matter as much as APR, with protocols that transparently harden keys and access likely to earn a premium in user trust.
CoinsKid.Com