April 2026 worst month for crypto hacks – $651 million lost

April 2026 recorded 30 separate crypto exploits, the most incidents in any month on record, and the attacks together cost roughly $651 million, a loss larger than the entire 2022 hack total [2][3].

Hack concentration and the two headline attacks

DefiLlama’s data confirm that April’s 30 exploits eclipsed the previous monthly high, and the $651 million loss is the largest monthly total since March 2022 [3]. Two incidents alone accounted for 89 % of the loss: the Drift Protocol breach on April 1 drained $285 million through a six‑month social‑engineering campaign attributed to North Korea’s UNC4736 group, while the KelpDAO exploit on April 18 siphoned $293 million by abusing a single‑node verifier in its LayerZero bridge [2]. The remaining 28 incidents together produced about $73 million in losses, still enough to rank among the worst months in recent memory [2].

Attribution, attack vectors, and broader trends

Both headline attacks were linked to DPRK‑affiliated actors, with TRM Labs estimating that North‑Korean operations accounted for 76 % of all hack losses through April 2026 [2]. The Drift hack leveraged governance manipulation rather than a smart‑contract bug, while KelpDAO’s breach exploited a cross‑chain bridge configuration flaw—highlighting persistent weaknesses in governance security and bridge infrastructure [2][3]. The month’s density—roughly one exploit per day—suggests a shift from earlier patterns of fewer, larger breaches toward more frequent, smaller‑scale attacks, even as total dollar loss remains below the 2022 peak of $1.2 billion [1].

Market impact and industry response

The cascade of exploits triggered immediate market reactions: over $8.4 billion fled Aave deposits within 48 hours of the KelpDAO hack, and total DeFi TVL fell by more than $13 billion [2]. Observers note that the high‑yield environment of 2025‑2026 attracted larger TVL, increasing the payoff for attackers and potentially encouraging more sophisticated, state‑backed campaigns [2]. Security firms such as CertiK and PeckShield are monitoring the trend, while regulators are being pressed to consider coordinated responses to the growing state‑level threat [1].

What to watch

• Governance hardening – protocols with multi‑sig or timelock controls may see heightened scrutiny after the Drift incident.
• Cross‑chain bridge configurations – any change in verifier quorum or node diversity could affect exposure to attacks like KelpDAO’s.
• North‑Korean activity spikes – TRM Labs and Elliptic’s attribution reports may flag future operations; watch for sudden upticks in illicit fund flows on major mixers.

April’s record‑breaking hack count underscores a structural vulnerability in DeFi’s governance and bridge layers, and raises the question whether industry‑wide security upgrades can keep pace with increasingly state‑sponsored adversaries.