#DeFiLossesTop600MInApril

April 2026 is now the worst month on record for DeFi security breaches. CertiK tracked 29 incidents totaling $651 million in losses — and two mega-exploits alone accounted for 93% of the damage.

The two catastrophic hits:

Drift Protocol (Solana) — $285M (April 1): Lazarus Group spent 6 months building trust with the Drift team — in-person meetings across multiple countries, over $1M in real deposits — then tricked multisig signers into pre-approving hidden authorizations and drained $285M in 12 minutes. Funds were bridged to Ethereum within hours. Second-largest exploit in Solana's history.

Kelp DAO (Ethereum/LayerZero) — $293M (April 18): An attacker sent a spoofed cross-chain message to Kelp DAO's LayerZero bridge at 17:35 UTC, tricking it into releasing 116,500 rsETH (~18% of the token's entire circulating supply). The stolen rsETH was then deposited as collateral on Aave v3, borrowing massive amounts of wETH — leaving Aave with $195M in bad debt, an 18% AAVE token crash, and ~$8B in TVL outflows.

Breakdown by attack vector (CertiK data):

Vector Losses

Wallet compromises $611M

Price manipulation $18.8M

Code vulnerabilities $16.9M

Phishing $3.5M

Unverified contracts $8.5M

Front-end attacks $544K

Systemic fallout:

~$14B in DeFi TVL outflows across protocols

Aave TVL dropped ~$8B in 24 hours; AAVE token fell from $112 to $89.5

Aave froze rsETH markets on v3 and v4

Arbitrum Security Council froze ~$71M in ETH linked to the Kelp DAO hack

North Korean operators (Lazarus Group) now account for 76% of all crypto theft in 2026 (TRM Labs)

Silver lining — "DeFi United" recovery fund: An Aave-orchestrated crowdsourced recovery campaign has raised over $302M — enough to fully cover the Kelp DAO exploit. Contributions include Aave DAO (25,000 ETH), Lido DAO (2,500 ETH), and commitments from Kelp DAO and LayerZero themselves.

But a new twist: On-chain investigator ZachXBT has accused U.S. law firm Gerstein Harrow LLP of filing fraudulent claims to seize the $71M in frozen KelpDAO funds, leveraging a 2015 court judgment against North Korea to prioritize their clients ahead of the actual 2026 hack victims. ZachXBT has proposed a community DAO to counter the firm legally.

Security takeaways for DeFi users:

Verify multisig governance — zero-timelock migrations are a fatal vulnerability

Audit cross-chain bridge implementations rigorously (LayerZero message verification is critical)

Diversify collateral — don't concentrate holdings in single restaking tokens

Monitor protocol freeze/pause capabilities — rapid response saved ~$80M in follow-up Kelp DAO attempts

Use hardware wallets and separate hot/cold wallet strategies for large positions

This post is freshly shared — no likes or comments yet. Be the first to engage and help spread awareness. DeFi security is everyone's responsibility.

@Gate_Square