TLDR
North Korea-linked Lazarus Group is blamed for roughly 600 to 635 million dollars stolen from DeFi protocols in April 2026, mainly via two huge exploits on Drift and KelpDAO.
- Investigators link Lazarus to a 285 million dollar social-engineering attack on Drift Protocol and a roughly 292 million dollar bridge exploit on KelpDAO, together making up nearly all April losses.
- The hacks triggered a sharp drop in DeFi total value locked, severe stress on lending platforms like Aave, and added to negative sentiment around Ethereum and Solana DeFi.
- The incidents highlight growing risks from bridges and operational security, and make security practices, governance powers, and regulatory responses key things to watch for DeFi users.
Deep Dive
1. How The Hacks Happened
Reports say April 2026 became the worst month on record for crypto hacks, with over 28 incidents and more than 625 to 635 million dollars stolen, overwhelmingly traced to Lazarus-linked operations. A major analysis credits Lazarus with about 285 million dollars stolen from Solana-based Drift Protocol via a months-long, in-person social?engineering campaign targeting team members, and about 292 million dollars from KelpDAOs rsETH bridge on Ethereum using a LayerZero cross-chain message spoofing weakness. Together, these two attacks accounted for roughly 93 to 95 percent of Aprils losses across DeFi protocols.
These numbers are consistent across multiple breakdowns from DeFiLlama and independent researchers, which describe almost one successful exploit per day in April, mostly aimed at DeFi infrastructure rather than centralized exchanges.
2. Impact On DeFi And Markets
DefiLlama data cited in coverage shows more than 14 billion dollars in DeFi total value locked exiting bridges and lending platforms after the KelpDAO exploit alone, with Aave suffering a multi?billion deposit outflow and a bad?debt hole. A TRM Labs report notes that North Korea-linked groups now account for about 76 percent of global crypto hack losses in 2026 to date, nearly 600 million dollars, reinforcing the perception that DeFi is a primary target.
Market commentary ties this to weaker short-term confidence in Ethereum DeFi, with prediction markets pricing a lower probability of Ethereum hitting optimistic price levels in the near term, while Bitcoin sentiment is affected but more resilient.
Large, protocol-level incidents can rapidly drain TVL, stress lending markets, and spill over into broader price sentiment, even if the immediate exploit targets only a few platforms.
3. Risks And What To Watch
The Drift and KelpDAO cases show that DeFis weakest points are often bridges, privileged keys, and human processes, not just smart contract code. TRM Labs highlights Lazarus increasing sophistication, including long-running social engineering and tailored laundering routes through cross-chain tools and privacy services, which makes early detection harder.
On the response side, governance actions such as Arbitrums Security Council freezing attacker addresses and DAO votes to support recovery funds illustrate both the protective potential and centralization concerns of emergency powers. Going forward, key things to watch are stricter operational security around keys, more robust bridge designs, insurance and backstop mechanisms for lending markets, and any regulatory moves that target state-backed crypto hacking campaigns.
For DeFi users, the main risk lens is venue and infrastructure risk, especially bridges and complex cross-chain setups, and not only token price volatility.
Conclusion
Lazarus Groups suspected 600 to 635 million dollar DeFi haul in April 2026 underscores that state-backed actors are now among the most capable and persistent threats in crypto. The combination of bridge flaws, social engineering, and governance trade-offs means DeFi security is as much about processes and architecture as about code, making protocol choice, infrastructure exposure, and governance design critical variables to monitor.
CoinsKid.Com