Lazarus Group hacks record $635M from DeFi

TLDR

North Korea-linked Lazarus Group has been blamed for roughly 635 million dollars stolen from DeFi protocols in April 2026, making it the worst hack month on record.

1. Two giant exploits on Drift Protocol and KelpDAO, plus smaller hits, drove around 635 million dollars in Lazarus-linked losses and nearly all April DeFi thefts.
2. The hacks triggered over 13 billion dollars in DeFi outflows, big bad debt on lending platforms, and renewed questions about bridge security and institutional DeFi adoption.
3. The main risks now center on social engineering and cross-chain bridges, so security practices and regulatory responses will be key signals for DeFi risk going forward.

Deep Dive

1. How Lazarus Reached About $635M

Security and media reports say Lazarus was responsible for about 635 million dollars in crypto protocol losses in April, led by a 285 million dollar exploit of Drift Protocol and a 292 to 293 million dollar KelpDAO bridge hack, both on major ecosystems like Solana and Ethereum. One analysis notes that these two incidents alone accounted for nearly 95 percent of Aprils protocol losses across roughly a dozen hacks, bringing the Lazarus total to around 635 million dollars for the month. DefiLlama data separately confirms April 2026 as cryptos most hacked month on record, with 28 to 30 incidents and more than 625 million dollars stolen overall, again dominated by Drift and KelpDAO. A TRM Labs report cited by CoinDesk adds that North Korean state-backed hackers now account for about 76 percent of 2026 crypto hack losses, underscoring how concentrated the threat has become.

2. Damage To DeFi And Market Sentiment

The KelpDAO exploit alone erased roughly 13 to 15 billion dollars in DeFi total value locked, with Aave seeing about 8.4 to 8.5 billion dollars in deposits exit within 48 hours as lenders and borrowers pulled funds. Across April, one review tallies about 606 million dollars stolen in 12 major incidents, three to four times all of Q1 losses, and links the spike to sharp DeFi outflows and weaker confidence in protocol safety. Prediction markets and commentary suggest Ethereums short term upside odds declined more than Bitcoins, reflecting that DeFi on Ethereum and Solana was hit while the base chains themselves remained technically intact. JPMorgan and others have flagged these state-sponsored DeFi exploits as a direct headwind for institutional use of open DeFi.

3. What To Watch For Next

TRM Labs and others describe a shift away from pure smart contract bugs toward long, in person social engineering, key compromise, and bridge design weaknesses, as seen in Drift, KelpDAO, and a smaller Wasabi Protocol breach. That puts protocols with large TVL, powerful admin keys, and cross-chain bridges in the highest risk bucket unless they adopt stricter multi-signature controls, independent audits, and more conservative bridge configurations. On the policy side, growing concentration of hacks in a sanctioned state actor makes further sanctions, tighter AML enforcement, and possibly stricter rules on DeFi access control more likely.

Conclusion

Lazarus turning April 2026 into a roughly 635 million dollar DeFi theft month shows how a few sophisticated, state-backed exploits can dominate crypto security risk. The direct damage is not just the stolen funds but also the double digit billions in DeFi withdrawals, bad debt on lending markets, and a pause in institutional enthusiasm. DeFis next phase will likely be shaped less by new yield strategies and more by whether protocols can close these human and bridge level gaps fast enough to restore trust.