DeFi protocols lost over $600 million (estimates range $606M–$635M+) to hacks and exploits in April 2026, making it the worst month for crypto security on record by incident count and one of the costliest.3

#DeFiLossesTop600MInApril, highlighting a brutal wave of attacks amid broader market pressures.1
Key Details
• Total Losses: Roughly $600M–$635M across ~28–30 separate incidents (nearly one per day). DeFi accounted for the vast majority.27
• Biggest Hits (accounting for ~90–95% of the total):
◦ Drift Protocol (Solana, April 1): ~$285M. Attributed to social engineering by North Korea-linked Lazarus Group after months of preparation.7
◦ Kelp DAO (Ethereum/Arbitrum bridge, mid-April): ~$292–$293M via LayerZero cross-chain message spoofing/verifier node exploit (attackers minted unbacked rsETH).2
• Smaller incidents (e.g., Rhea Finance, Aftermath Protocol, others) added tens of millions more.
Broader Impact
• TVL Exodus: DeFi total value locked dropped sharply (e.g., $13B+ outflows reported in some analyses), with protocols like Aave seeing major deposit flight. Ethereum and Solana ecosystems were hit hard.1
• Attack Vectors: Shift toward social engineering, private key compromises, and bridge/cross-chain vulnerabilities rather than pure code bugs. Lazarus Group linked to a large share of 2026 hacks.28
• Context: This comes alongside rising Treasury yields, post-Fed caution, and crypto market pressure — amplifying risk-off sentiment.
Outlook and Response
April’s events mark the highest monthly hack tally in crypto history, pushing year-to-date losses significantly higher. The industry is seeing calls for better audits, multi-sig governance, insurance funds, and timelocks. Some protocols paused operations or added safeguards post-incident.33
DeFi has historically shown resilience and recovered from prior shock months, but repeated large-scale losses raise questions about trust, especially as institutional interest grows. Trackers like DefiLlama and CertiK provide ongoing data.
This underscores persistent security challenges in DeFi even as the space matures. For live hack trackers, check DefiLlama/hacks or security firms’ dashboards.