April DeFi hacks surge 1140% to $647M

TLDR

April was one of DeFis worst security months on record, with hack losses jumping over tenfold to roughly $630$650 million depending on the data source.

1. Security firms report around $647 million stolen in April, a roughly 1,140 percent month over month jump from March, across more than two dozen DeFi exploits.
2. Two mega attacks on KelpDAO and Drift Protocol contributed close to 90 percent of losses and exposed deep weaknesses in bridges, admin keys and operational security.
3. The hack wave has already triggered large DeFi outflows and confidence shocks, so users are increasingly focusing on protocol security design, governance and recovery plans.

Deep Dive

1. Scale Of April Losses

PeckShield estimates that crypto hacks in April totaled about $647 million, a 1,140 percent jump from roughly $52 million in March, across 40 major incidents, making it an exceptional spike in losses as reported in a PeckShield-based summary.

DeFiLlama and CertiK show a similar picture, with various reports putting April losses between about $630 million and $651 million, the highest monthly total since early 2025, and the largest incident count ever recorded by DeFiLlama according to DeFi-focused analysis.

Different methodologies explain the small range in totals, but all agree April stands out both for the dollar amount and for the sheer number of distinct exploits.

2. How The Biggest Hacks Worked

Two DeFi exploits dominate Aprils losses. KelpDAOs cross chain bridge setup was abused for roughly $292293 million of rsETH, and Drift Protocol on Solana was drained for about $280285 million, according to multiple breakdowns including a DeFiLlama based report and a macro-focused summary.

KelpDAOs loss stemmed from a fragile LayerZero verifier configuration that let attackers forge a cross chain message and release unbacked assets from Ethereum escrow, which were then used as collateral across lending platforms like Aave. Drifts exploit was not a simple contract bug, but the end result of a months long social engineering campaign that compromised contributor accounts, admin keys and cloud infrastructure, giving attackers full protocol control.

TRM Labs and others link both attacks to North Korean state affiliated actors, and note that these incidents fit a broader pattern of targeting operational weaknesses, bridges and privileged access, rather than only smart contract code.

3. Impact And What To Watch

The immediate impact was a sharp loss of confidence in DeFi. Analysts cite over $1014 billion in total value locked exiting protocols in the days after KelpDAO and Drift, with Aave alone seeing multi billion dollar withdrawals, as highlighted in market outflow reporting.

Importantly, base chains like Ethereum and Solana were not compromised at the consensus level. The damage came from application layer designs, especially cross chain bridges, admin key control, and insufficient timelocks or multisig protections.

Conclusion

Aprils 1,140 percent jump in hack losses is largely explained by a small number of very large, sophisticated DeFi exploits layered on top of many smaller incidents.

The episode shows that even audited, established protocols can suffer massive losses if bridge design, key management and operational security lag behind attacker capabilities, and it reinforces that protocol level security choices are now central to how investors treat DeFi risk.