April crypto hacks surge 1,140% to $647M

TLDR

Crypto hacks in April surged to around $647 million, making it one of the worst months on record and highlighting growing risks in DeFi and cross chain infrastructure.

1. Losses jumped about 1,140% month over month to roughly $647 million, driven mainly by two giant DeFi exploits on Drift and KelpDAO.
2. Attackers increasingly targeted bridges, admin keys, and operations, with North Korea linked Lazarus Group suspected behind most of the biggest hacks.
3. DeFi protocols saw large outflows and reputational damage, so users should pay close attention to bridge design, risk controls, and where they park capital.

Confidence: high because several independent security firms and data aggregators report similar April figures.

Deep Dive

1. Scale Of April Losses

Blockchain security firm PeckShield reports that April saw 40 major exploits, with total hacked funds jumping 1,140 percent from March to about $647 million in losses across the sector. This dwarfs Marchs roughly $52 million and even exceeds the combined losses of January to March 2026, making April one of the worst months on record for theft by value and incident count, according to the same PeckShield analysis.

DefiLlama and others put Aprils losses between about $630 million and $650 million, but all agree that it is the highest monthly tally since mid 2022 and the most hacked month by number of incidents, with nearly one exploit per day in some estimates.

2. How Attack Vectors Evolved

The spike was driven by two huge DeFi incidents: Solana based Drift Protocol, hit for roughly $285 million, and KelpDAO, exploited for about $292 to $293 million via a LayerZero bridge configuration, together accounting for over 90 percent of Aprils losses in some tallies. Detailed postmortems point to multi month social engineering campaigns that compromised contributor accounts and infrastructure, plus single point of failure bridge verifiers, rather than simple smart contract bugs, as described in this breakdown of the Drift and KelpDAO hacks.

TRM Labs and other investigators estimate that North Korea linked Lazarus Group is responsible for roughly three quarters of 2026 crypto hack losses so far, with the April Drift and KelpDAO exploits making up most of that total, according to TRMs data on North Korea related hacks.

3. Impact And What To Watch

The immediate fallout was a wave of DeFi deleveraging. After the KelpDAO exploit, analytics firms tracked over $10 billion in value leaving bridges and lending protocols, and Aave alone saw billions in deposits exit in under two days, as noted in DefiLlamas incident summary. Core layer 1 chains like Ethereum and Solana were not compromised at the protocol level, but repeated nine figure failures have increased perceived tail risk for DeFi, restaking, and bridge products.

Conclusion

Aprils hack surge shows that crypto security risk is increasingly concentrated in sophisticated attacks on DeFi infrastructure, bridges, and human operators rather than raw code bugs. For crypto users, the key is not to avoid the entire ecosystem but to distinguish between base assets and higher risk protocol layers, monitor how projects harden their operations, and treat nine figure exploit headlines as a signal to reassess where and how much capital is parked in DeFi.