Is DeFi Safe? $635M Drained in April’s Record-Breaking Attack Wave