Record April attacks drain $635M from DeFi

TLDR

April 2026 saw a record wave of DeFi hacks, with around 635 million dollars drained from protocols and related infrastructure.

1. DeFi and crypto infrastructure suffered 28 to 30 exploits in April, with about 635 million dollars stolen and two giant hacks on Drift and KelpDAO accounting for over 90 percent of losses.
2. The main attack vectors shifted from simple smart contract bugs to social engineering, admin key compromise and cross chain bridge spoofing, with North Korea linked to most of the stolen funds.
3. The hacks triggered major outflows from DeFi, stress in Ethereum restaking and lending, and a growing security premium for protocols that can prove strong operational and infrastructure defenses.

Deep Dive

1. Record April Losses

Analytics firms tracking DeFi exploits report that April 2026 logged 28 to 30 incidents with around 635 million dollars stolen, making it the most hacked month on record by incident count. DefiLlama data cited by The Defiant shows 28 exploits and 635.2 million dollars taken from DeFi protocols and crypto infrastructure in April, about four times the entire first quarter total.

Two mega incidents dominated. A bridge exploit on KelpDAOs rsETH system cost roughly 292 to 293 million dollars, while a social engineering driven attack on Solana based Drift Protocol drained about 285 million dollars, together making up over 90 percent of April losses.

Smaller attacks, often under 5 million dollars each, hit lending pools, vaults, bridges and exchanges, but the headline number came from these few catastrophic failures rather than a constant drip of moderate hacks.

2. New Attack Patterns

Reports on the KelpDAO and Drift exploits describe a shift toward human and infrastructure focused attacks. In Drifts case, attackers ran a months long social engineering campaign to compromise contributor accounts and admin keys, then drained funds once high level access was obtained.

For KelpDAO, attackers forged cross chain messages on its LayerZero based bridge, exploiting a single verifier setup and compromised RPC infrastructure to release unbacked rsETH, as detailed in a bridge exploit analysis.

Multiple investigations, including coverage of Lazarus linked hacks, attribute roughly three quarters of 2026 hack losses to North Korean state backed actors, who increasingly use AI assisted reconnaissance and targeted social engineering rather than just scanning for obvious code bugs.

3. Market Impact And Next Risks

The April exploit wave triggered a sharp fall in DeFi total value locked, with several sources noting over 13 to 14 billion dollars exiting protocols and lending markets cutting risk to liquid restaking tokens and bridged assets.

Ethereums staking ecosystem also reacted. One report notes that the validator exit queue surged to over 433,000 ETH with a seven day wait after the KelpDAO breach, as restaking users withdrew in response to the bridge hack and related exploits.

At the same time, capital rotated rather than fully exiting crypto. Some staking inflows continued and traders shifted toward protocols perceived as safer, centralized venues and assets with fewer complex bridge dependencies. Future risk hinges on whether more infrastructure level exploits appear and how quickly protocols adopt multi party controls, timelocks, diversified infrastructure and real time monitoring.

Conclusion

Aprils 635 million dollars in DeFi losses were driven less by broad sector weakness and more by a handful of catastrophic, infrastructure level failures tied to sophisticated attackers.

The main lesson is that DeFis risk profile is shifting toward operational and cross chain complexity, so both investors and protocols need to treat security architecture as a core part of value, not an afterthought.