Lazarus attacks drive record April DeFi losses

TLDR

April 2026 saw a record month for crypto hacks, with DeFi protocols losing over 600 million dollars, mostly to attacks linked to North Koreas Lazarus Group.

1. Lazarus is credited with roughly 95% of Aprils losses, driven by two mega DeFi exploits on Drift Protocol and KelpDAO that together stole about 580 million dollars.
2. These attacks relied on months of social engineering and infrastructure compromises, especially a single point of failure in KelpDAOs cross chain bridge, rather than simple smart contract bugs.
3. The hacks triggered more than 10 billion dollars of DeFi outflows and renewed institutional doubts about DeFi security, putting a visible risk premium on DeFi yields and tokens.

Deep Dive

1. Scale Of April DeFi Losses

Security trackers and media reports estimate that crypto hacks in April 2026 totaled around 630 to 651 million dollars, the highest monthly loss since early 2025 and 2022 combined, with most damage in DeFi protocols such as Drift and KelpDAO. Reports attribute about 635 million dollars of April protocol losses to Lazarus linked operations, with a 285 million dollar exploit on Solana based Drift Protocol and approximately 292 to 293 million dollars stolen from KelpDAOs LayerZero bridge on Ethereum accounting for nearly 95% of the total across a dozen incidents.

Over a longer span, analysts estimate Lazarus has stolen between 6 and 7 billion dollars in crypto since 2017, showing that April was an extreme spike in a long running state backed campaign rather than an isolated month.

2. How Lazarus Pulled Off The Attacks

On Drift Protocol, investigators describe a six month social engineering campaign where attackers posed as a quantitative trading firm, embedded themselves in contributor workflows, deployed malware through tools used by developers, and ultimately obtained administrative keys and cloud access before draining more than half of the protocols total value locked in minutes.

KelpDAOs exploit hit its cross chain bridge design. LayerZero and independent researchers report that Lazarus compromised specific RPC nodes feeding a one of one verifier, used a denial of service attack to push traffic onto those compromised nodes, then forged cross chain messages so the bridge released 116,500 rsETH, roughly 292 to 293 million dollars, from Ethereum escrow that did not correspond to real deposits. The stolen rsETH was then used as collateral across lending markets like Aave, spreading risk to multiple protocols.

These incidents point to a shift from pure smart contract bugs to human and infrastructure targets: infiltrated teams, compromised developer machines, poisoned RPC infrastructure, and misconfigured bridge verification models are now as critical as on chain code audits.

3. Impact On DeFi Markets And Users

The KelpDAO and Drift hacks triggered a fast DeFi bank run. Estimates show over 10 billion dollars of outflows from protocols connected to rsETH and more than 13 billion dollars in wider DeFi withdrawals within days, including roughly 8 to 10 billion dollars pulled from Aave alone as users de risked exposure to complex collateral chains. Analysts note that DeFi total value locked in early April was more than three times first quarter hack losses, which made the shock more visible and led to an explicit security risk premium on DeFi assets. Banks such as JPMorgan and brokerages like Jefferies have publicly warned that high profile DeFi hacks, including the KelpDAO exploit, may slow institutional adoption of DeFi based yield and tokenized real world assets.

Importantly, Ethereum and Solana themselves were not compromised at the base chain level; the failures occurred in third party protocols and bridges that sit on top of them, which means the execution layers remain intact but trust in DeFi composability has been dented.

Conclusion

April 2026 shows that a small number of sophisticated, state backed operations can generate record DeFi losses by exploiting social engineering and infrastructure weak points rather than simple code bugs. The immediate effect has been large TVL outflows and a higher risk premium on DeFi yields, along with hesitation from institutions considering DeFi rails. The medium term question is whether protocols adopt multi verifier bridges, stricter operational security, and insider threat defenses quickly enough to restore confidence before the next Lazarus scale exploit hits.