April crypto hacks leap 1,140% to $647M

TLDR

Losses from crypto hacks in April surged to around 647 million dollars, up roughly 1,140 percent month over month, driven mainly by two huge DeFi incidents.

1. Blockchain security firm PeckShield counted 40 exploits in April totaling about 647 million dollars, versus roughly 52 million dollars in March, with other trackers showing a similar 600 to 650 million range.
2. Two DeFi incidents, the KelpDAO bridge exploit and the Drift Protocol attack, accounted for well over 80 percent of the losses and were linked to sophisticated, long running campaigns.
3. The spike concentrates risk in bridges and DeFi infrastructure rather than base chains, and it increases scrutiny on security practices, audits, and operational controls across major protocols.

Deep Dive

1. Scale Of Aprils Losses

PeckShields April report cited 40 major exploits with losses of about 647 million dollars, a 1,140 percent jump from Marchs 52.25 million dollars, and larger than January to March combined. U.Today summarized these figures as crypto hacks skyrocketing 1,140 percent to 647 million dollars.

Other aggregators that track on chain exploits, such as DeFiLlama, put April losses in a similar band, typically between 625 million and 651 million dollars, and confirm that it was the worst hacking month since early 2025 on a dollar basis.

2. Key Incidents Driving The Damage

Most of the damage came from two DeFi incidents. PeckShield ranks the KelpDAO exploit at roughly 292 to 293 million dollars and the Drift Protocol exploit at around 285 million dollars, together making up the bulk of Aprils 647 million dollar total. The U.Today report notes that these two hacks now sit among the largest on record since 2021.

DeFiLlama based reporting similarly finds that two large attacks accounted for around 90 percent of the more than 625 million dollars stolen in April, with the remaining 20 to 30 incidents mostly under 5 million dollars each. A TRM Labs summary cited in other coverage suggests North Korean linked Lazarus Group actors were behind both KelpDAO and Drift, continuing a pattern where relatively few nation state campaigns produce outsized losses.

3. Why This Matters For Users And Protocols

The concentration of losses in DeFi protocols and cross chain bridges shows that the main risk is increasingly at the application and infrastructure layer, not at base chains like Bitcoin (BTC) or Ethereum (ETH), which were not compromised. Reports from DeFiLlama and TRM Labs highlight attack patterns such as social engineering of team members, compromised admin keys, and single point of failure bridge designs rather than simple smart contract bugs.

For users, this translates into higher protocol selection risk: the same month saw nearly one incident per day across lending platforms, bridges, and smaller DeFi apps, even though most were small in dollar terms. For protocols, Aprils numbers strengthen calls for multi signer governance, multi verifier bridges, stricter key management, and deeper audits of operational security, not just code.

Conclusion

Aprils jump to about 647 million dollars in hack losses reflects a few very large, sophisticated DeFi and bridge attacks on top of a steady drumbeat of smaller exploits. The episode underscores that security bottlenecks have moved to human and infrastructure layers, so both users and builders need to focus less on headline yields and more on how protocols design key management, cross chain messaging, and access control.