DeFi hackers stole $600 million in April; Kelp DAO and Drift accounted for 95% of the monthly losses

In April 2026, within just 20 days, crypto protocols lost more than $606 million due to hacker attacks, setting the harshest single-month loss record since the February 2025 $1.4 billion data breach at exchanges. KelpDAO and Drift Protocol accounted for 95% of the April losses combined, and for 75% of the $771.8 million total losses through 2026 to date.

Monthly data: April losses far exceed the combined total of the first three months

(Source: DefiLlama)

Based on DefiLlama’s tracked data, hacker-attack losses in 2026 by month are as follows:

January: 12 incidents, losses of $100.1 million

February: 8 incidents, losses of $24.2 million

March: 15 incidents, losses of $41.3 million

April (through April 18): 12 incidents, losses of $606.2 million

Since February 2025, the loss scale in each month has remained below $240 million. April’s loss pattern clearly points to attackers systematically shifting their targets to DeFi infrastructure—unlike the single, major CEX attack in 2025, this time both major attacks targeted DeFi’s cross-chain bridges and lending protocols.

Attack pattern shifts: from CEX to full-scale penetration of DeFi infrastructure

KelpDAO’s LayerZero cross-chain bridge was attacked, resulting in losses of more than $290 million, making it the largest DeFi incident so far in 2026; Drift Protocol suffered losses of $285 million, following closely behind. In addition, in recent April there were a series of incidents, including Vercel, Hyperbridge, Grinex Exchange, and Rhea Finance, indicating that the attack surface is being systematically expanded to multiple infrastructure layers across the DeFi ecosystem.

In terms of frequency, in the first 4.5 months of 2026 there were 47 hacker attacks in the crypto space, compared with 28 attacks in the same period in 2025—an approximately 68% year-over-year increase.

DeFi TVL under pressure, market confidence worsens

After the Kelp incident, DeFi’s total value locked (TVL) fell by more than 7% within 24 hours. Aave’s TVL dropped from $26.4 billion to nearly $17.9 billion. One analyst issued a warning: “Until risk can be priced in reasonably, DeFi is still a niche market; and right now, we’re still far from that goal.”

Frequently Asked Questions

Why are the crypto hacker losses in April 2026 so unusual?

The main reason for the severity of the April losses is that the two attacks—KelpDAO ($290 million) and Drift Protocol ($285 million)—combined to about $575 million, accounting for 95% of April’s total losses. Both attacks targeted DeFi’s core infrastructure—cross-chain bridges and lending protocols—exploiting vulnerabilities in smart contracts and cross-chain message verification, making them highly technical, targeted attacks.

How exactly did the attacks on KelpDAO and Drift Protocol occur?

KelpDAO’s LayerZero cross-chain bridge was attacked, and the attacker forged cross-chain messages to extract rsETH tokens. Drift Protocol also suffered a security vulnerability; in both cases, multiple DeFi protocols have already triggered emergency security response measures, including freezing related assets and temporarily pausing LayerZero bridge functions, among others.

What impact does a 68% year-over-year increase in DeFi attack frequency have on the broader crypto market?

Analysts view the systematic rise in attack frequency as an important signal that DeFi’s risk pricing has not yet kept pace with the rate at which vulnerabilities in underlying infrastructure are being exposed. The continuously accumulating security incidents not only directly erode TVL, but also create an ongoing barrier to institutional adoption of DeFi, which may have far-reaching effects on the long-term development trajectory of the entire DeFi ecosystem.