Crypto Hacks Reach Record $630+ Million in April, Highest Monthly Total Since February 2025

April 2026 became the most-hacked month in cryptocurrency history with 28-30 separate exploits stealing over $625 million, nearly quadrupling the $165 million lost across all of Q1 2026. Two massive incidents dominated the losses: Drift Protocol on Solana lost $285 million to a North Korea Lazarus Group social engineering attack on April 1, while KelpDAO lost $293 million around April 18 through a Layerzero bridge message spoofing exploit, together accounting for 93% of monthly losses. The attacks marked a shift from traditional smart contract bugs to social engineering and access-control failures targeting lending pools, vaults, staking contracts, oracles, and cross-chain bridges simultaneously. The KelpDAO hack triggered a crisis of confidence, with over $14 billion in total value locked fleeing DeFi protocols within days, concentrated in bridge and lending platforms.

April 2026 sets record for crypto hack frequency and scale

• ▪More than $625 million was stolen across the crypto industry in April 2026.
• ▪More than $14 billion in total value locked left DeFi protocols within days following the KelpDAO hack.
• ▪The crypto industry recorded roughly 68 incidents and more than $1 billion stolen year-to-date through April 2026.
• ▪The February 2025 Bybit breach totaled approximately $1.4 billion.
• ▪Q1 2026 saw approximately $165 million lost across 35 crypto incidents.

Drift Protocol and KelpDAO attacks dominate monthly losses

• ▪The Drift Protocol attack on April 1, 2026 was a social-engineering attack linked to North Korea's Lazarus Group.
• ▪Rhea Finance lost $18.4 million in an April 2026 crypto exploit.
• ▪The Drift Protocol and KelpDAO incidents together accounted for nearly 93% of April 2026 total crypto losses.
• ▪KelpDAO lost roughly $293 million around April 18, 2026.
• ▪Drift Protocol on Solana lost approximately $285 million on April 1, 2026.
• ▪The remaining 26 or more April 2026 crypto incidents were mostly below $5 million each.
• ▪Volo Vault lost $3.5 million in an April 2026 crypto exploit.

Evolving attack vectors and industry security response

• ▪Bridge exploits tracked by Defillama account for approximately $2.9 billion.
• ▪Defillama's lifetime totals show crypto hacks exceeding $16.5 billion.
• ▪DeFi-specific losses tracked by Defillama are near $7.7 billion.

Perspective of Cryptocurrency regulators

• ▪Regulatory authorities view the $630 million April 2026 crypto losses as evidence that self-regulation in DeFi has failed to protect consumers.

4 sources