The April increase in the number of exploits reflects a systemic shift in attacker tactics: they are increasingly targeting not smart contracts, but off-chain infrastructure. Well-equipped groups find vulnerabilities at the intersection between protocols and the external systems dependent on them. Entry points include compromised RPC nodes, breaches of cloud key management systems, and multi-stage social engineering attacks. At the same time, blockchain transactions appear completely legitimate—even when infrastructural or human access levels have already been compromised. Real-time response becomes critically important. Anomalous mining patterns and cross-chain discrepancies can be detected instantly. In particular, prompt detection of violations helped prevent a repeat theft of approximately $95 million during the KelpDAO incident. April statistics record qualitative changes in the threat landscape: traditional smart contract bugs are giving way to attacks on bridges, privileged access systems, and operational processes. This indicates the need to revise approaches to auditing and monitoring in DeFi projects.