Loading article…
Crypto hacks hit a record $651 million in April 2026, driven by Drift and KelpDAO exploits. North Korean-linked attacks raise institutional security concerns.
Crypto hacks reached a record $651 million in losses in April 2026, marking the worst month for security breaches since March 2022. The surge, driven by two major exploits on Drift Protocol and KelpDAO, has intensified scrutiny on whether decentralized finance (DeFi) infrastructure can secure institutional capital.
| At a glance | |
|---|---|
| Total Losses | ~$651 million [1] |
| Incidents | 29 tracked [1] |
| Top Drivers | Drift & Kelp DAO [1] |
| Attribution | North Korea linked [1] |
April 2026 recorded approximately $651 million in stolen assets across 29 incidents, the highest monthly total since March 2022, excluding the February 2025 Bybit hack [1]. DeFiLlama data places the figure slightly lower at $629.7 million, but confirms it as the worst month in more than a year [2]. The losses were heavily concentrated, with exploits targeting Drift Protocol and Kelp DAO accounting for roughly $579 million, or about 82% to 93% of the monthly total [1][2][3].
Security analysts attribute the breaches to sophisticated off-chain compromises rather than simple smart contract bugs. The Drift hack involved a six-month social engineering operation attributed to North Korean agents, while TRM Labs links 76% of all crypto value extracted this year to North Korea [1][2]. Chainalysis notes attackers are exploiting seams between on-chain protocols and off-chain systems, such as compromised remote procedure call (RPC) nodes and cloud key management systems [2].
The security failures are raising doubts about DeFi's readiness for traditional finance. JPMorgan analysts stated that "persistent security vulnerabilities" continue to limit DeFi's institutional appeal, particularly following past incidents like the $120 million Balancer exploit [1]. While Standard Chartered argues the sector shows resilience, the reliance on centralized interventions—such as Tether seizing assets or exchanges freezing funds—has highlighted a gap between the industry's decentralized marketing and its operational reality [1][2].
The record-breaking quarter, defined by a shift from mega-heists to a high volume of smaller, precise attacks, suggests that securing the 'seams' between on-chain code and off-chain operations remains the industry's primary unresolved vulnerability.
Coverage is mostly measured — 74 of 89 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 3 outlets · Jun 17, 2026 · How we report
A DAO is a decentralized autonomous organization that uses blockchain tokens and online forums to let members collectively fund and vote on projects, similar to a digital cooperative.
The DAO raised roughly $150 million in Ethereum but was hacked in June 2016, resulting in the loss of about one‑third of its funds and subsequent regulatory attention.
Owning a physical item, such as Spice DAO’s "director’s bible," does not confer rights to the underlying intellectual property, limiting a DAO’s ability to produce related works.
DAO tokens are intended to grant voting power and may provide symbolic rewards, but they are generally not considered legal securities or shares, and many remain non‑transferable outside the DAO.
These platforms issue tokens that reflect user activity and allow holders to vote on protocol changes, aiming to align participation with decision‑making authority.