#DeFiLossesTop600MInApril

The recent wave of DeFi exploits in April 2026 has reignited a fierce debate over "composability." While the ability for protocols to plug into one another like Lego bricks is DeFi's greatest strength, it has effectively created a global attack surface where a single breach can trigger a multi-chain domino effect.

The numbers for April are indeed staggering, primarily driven by two sophisticated operations attributed to North Korean threat actors.

The April "Big Two

"The combined losses from these two incidents alone accounted for over $570 million, or roughly 76% of all crypto hack value in 2026 through April.

Kelp DAO ~$292M April 18 Infrastructure Compromise: Attackers took over RPC nodes to feed false data to a bridge verifier, triggering a release of rsETH without an actual burn.

Drift Protocol ~$285M April 1 Social Engineering: Attackers spent 6 months posing as a quant firm to gain trust and compromise admin keys, then manipulated collateral values.

Remediation: The Arbitrum Intervention

The Arbitrum DAO has taken an unprecedented step in the aftermath of the Kelp DAO breach.

The DAO is voting (with near-unanimous support) to release 30,765 ETH (approx. $71 million) that was successfully "frozen" by the Arbitrum Security Council as the attacker tried to bridge it.

The funds are being moved to a multi-sig wallet managed by Kelp DAO, Aave Labs, and etherfi.

This ETH will be used to buy back and burn under-collateralized rsETH to restore its peg, which at one point dropped 20% below ETH value.

Is Composability becoming "Attackability"?

We are seeing a shift from "Code is Law" to "Plumbing is Law." Modern exploits are moving away from simple smart contract bugs and toward the connective tissue of the ecosystem:

The Drift attack on Solana saw stolen assets bridged to Ethereum within 12 minutes, showing how speed-to-exit is the attacker's best friend.

As protocols like Kelp DAO rely on external messaging a failure in a third-party "service provider" can bankrupt an otherwise secure protocol.

The Drift exploit wasn't a code flaw; it was a 6-month "long con" against the people managing the code.

While "DeFi United" (a relief fund involving Aave and Mantle) and DAO interventions show the industry is maturing its defense-in-depth, the "composability" that makes DeFi efficient is also providing a friction-less highway for stolen funds to move across chains faster than human governance can react.
‍$ETH $SOL $ARB