Record $647M crypto hacks rattle DeFi

TLDR

In April 2026, crypto hacks hit a record month for DeFi, with multiple reports putting losses around the mid 600 million dollar range.

1. Security firms report roughly 635 to 651 million dollars stolen across 28 to 40 exploits, making April the most hacked month on record by incident count.
2. Two DeFi giants, Drift Protocol and KelpDAO, account for over 90 percent of losses, and are widely linked to North Koreas Lazarus Group.
3. The wave is shifting focus from code bugs to human and infrastructure weaknesses, so users should watch bridge designs, admin key practices, and DeFi-wide TVL and risk responses.

Deep Dive

1. What Happened And How Big It Was

Blockchain security firm PeckShield reports 40 major April exploits totaling about 647 million dollars in stolen funds, an 1,140 percent jump from March and a new incident record for the industry. One summary highlights that this single month exceeded losses from the entire first quarter of 2026.

DefiLlama data cited in several reports shows similar totals in the 635 to 651 million dollar range, with the exact number varying by methodology and cut-off date. The Defiant counts 28 exploits and 635.2 million dollars stolen from DeFi and crypto infrastructure in April, calling it the most hacked month ever by number of incidents.

2. Why Drift And KelpDAO Matter So Much

The damage is extremely concentrated. KelpDAOs rsETH restaking bridge lost about 292 to 293 million dollars, while Solana-based Drift Protocol lost roughly 285 million dollars, together making up around 90 percent of Aprils DeFi losses. The Defiant details how these two attacks dominated the aggregate figure and triggered a DeFi "bank run" as capital fled interconnected protocols.

Investigations from TRM Labs and others, cited by outlets like Crypto Briefing, attribute roughly three quarters or more of Aprils total stolen value to North Korea linked Lazarus Group operations focused on DeFi protocols on Ethereum and Solana. These campaigns relied on long social engineering efforts, compromised infrastructure, and bridge verifier design weaknesses rather than simple smart contract bugs.

3. What To Watch Next In DeFi

Several patterns matter for users and builders:

1. Attack vectors are moving up the stack to admin keys, off-chain infrastructure, and single-verifier bridges, as described in this DeFiLlama based analysis.
2. Sentiment toward DeFi-heavy chains, especially Ethereums DeFi stack, has weakened, with prediction markets assigning lower odds to bullish ETH scenarios after the hacks, according to Crypto Briefings coverage.
3. Industry responses, such as multi-verifier bridges, stricter signer workflows, timelocks, and DeFi security coalitions, will be key signals of whether this is a turning point or a prolonged risk regime.

Conclusion

Record April losses show that DeFi risk has shifted from isolated contract bugs to complex, sometimes nation state level campaigns that target people and infrastructure.

If protocols upgrade bridge designs, distribute control over admin keys, and adopt stricter operational security, this spike can become a catalyst for a safer DeFi ecosystem rather than a lasting confidence break.