TLDR
North Korea-linked Lazarus Group is blamed for a record DeFi hack wave in April, stealing roughly $635 million and badly damaging confidence in key Ethereum and Solana protocols.
- Around $630650 million was stolen across nearly 30 April hacks, with Lazarus-linked exploits on Drift Protocol and KelpDAO making up the vast majority.
- The attacks hit core DeFi infrastructure, triggered over $1014 billion in TVL outflows, and weighed on Ethereum sentiment and ETF flows.
- The main lesson is that social engineering and bridge design flaws are now top attack vectors, so users and teams must focus on operational security, not just smart contract audits.
Deep Dive
1. What Actually Happened
Analytics platforms report April 2026 as the most hacked month in crypto history, with 2830 incidents and over $625 million stolen, with several reports clustering around about $635 million in losses. DefiLlama data shows that two exploits on Solanas Drift Protocol and Ethereum restaking project KelpDAO accounted for roughly 93 to 95 percent of that total, at about $285 million and $292293 million respectively.Drift and Kelp losses
Investigators and firms like TRM Labs attribute these two mega-hacks to North Koreas Lazarus Group or its TraderTraitor unit, putting North Korean actors at roughly 76 percent of all crypto hack losses in 2026 through April.North Korea 76 percent share
Confidence: high because multiple independent security and news sources agree on the loss range and attribution.
2. How DeFi Was Hit
Drift, a major Solana perpetuals DEX, was breached after a six month social engineering campaign that compromised contributor accounts and admin keys, draining over half its $550 million TVL in minutes.Drift social engineering hack
KelpDAOs rsETH bridge was attacked through its 1-of-1 verifier setup. By compromising RPC nodes and spoofing a cross chain message, attackers unlocked 116,500 rsETH from Ethereum escrow, triggering a DeFi bank run and more than $10 billion of TVL outflows from connected protocols.KelpDAO bridge exploit
the weak points were people, keys, and bridge architecture, not just buggy Solidity.
3. Market, Regulatory, And Security Fallout
The wave of Lazarus-linked DeFi hacks has pressured sentiment around Ethereum, whose DeFi stack was directly targeted. Prediction markets and ETF flow data show reduced confidence in near term upside and some outflows from ETH products after the hacks.Ethereum sentiment hit
Security firms stress that traditional code audits are no longer enough. Best practice now emphasizes multi signature admin controls, timelocks on upgrades, multi verifier bridge designs, hardware keys, and stronger internal opsec. Regulators are watching nation state crypto theft numbers climb, which could drive tighter rules around key management and disclosures for major DeFi venues.
for users, protocols that advertise audits but run single signer keys or single verifier bridges carry elevated tail risk, especially while Lazarus continues to focus on large, slow moving targets.
Conclusion
Lazarus turning its attention to DeFi produced a record hacking month where a small number of highly targeted exploits drove the majority of losses. The pattern is clear: sophisticated social engineering plus fragile bridge and admin setups create outsized systemic risk. Over the next months, the key question for DeFi will be whether teams harden operations and bridge designs fast enough to restore confidence before the next Lazarus scale campaign.
CoinsKid.Com