April 2026 was the worst month ever for DeFi exploits. ~$635M lost in total. 28 incidents in 30 days.

Apr 1 → Drift → $285M
Apr 3 → Silo V2 → $392K
Apr 4 → TMM → $1.67M
Apr 5 → Denaria Finance → $165K
Apr 9 → Aethir → $423K
Apr 12 → Hyperbridge → $2.5M
Apr 12 → SubQuery → $60K
Apr 13 → Dango → $410K
Apr 13 → Mona → $61K
Apr 14 → Zerion → $100K
Apr 16 → Rhea Finance → $18.4M
Apr 16 → Grinex → $15M
Apr 18 → Kelp DAO → $293M
Apr 20 → Juicebox V3 → $52K
Apr 20 → Thetanuts Finance → $50K
Apr 21 → Volo Protocol → $3.5M
Apr 22 → Kipseli → $80K
Apr 23 → Giddy Finance → $1.3M
Apr 25 → PurrLend → $1.5M
Apr 26 → Scallop → $150K
Apr 27 → Singularity Finance → $413K
Apr 27 → ZetaChain → $300K
Apr 28 → JuDAO → $228K
Apr 28 → Quant → $138K
Apr 29 → Aftermath Perps → $1.14M
Apr 29 → Sweat Foundation → $3.5M
Apr 29 → Syndicate → $330K
Apr 30 → Wasabi Protocol → $5M+
Two attacks (Drift + Kelp DAO) account for ~95% of the total. Both linked to admin-key compromises with no timelock or multisig.
DeFi security is broken at the infrastructure layer. Bridges, deployer keys, and cross-chain messaging keep producing the largest single-incident losses.
Stay safe. Revoke approvals. DYOR.