April 2026 closed with a historic spike in decentralized finance security incidents, setting a new benchmark for the number of crypto exploits in a single month. Data from DeFi Llama shows that April became “the most-hacked month in crypto history, by number of incidents,” even though total stolen value did not reach a record high.
The shift matters because it changes how risk appears across the sector. Instead of one dominant failure, April produced a dense cluster of attacks across bridges, lending systems, governance structures, and multisig controls. In total, at least 20 incidents occurred, with some datasets reporting up to 24 separate hacks.
Blockchain intelligence firm TRM Labs confirmed that two incidents alone accounted for the majority of stolen funds, reinforcing a pattern of low-frequency but high-impact exploits.
April sets record for exploit frequency
DeFi Llama data confirms that April crossed a structural threshold in incident count. Previous months rarely exceeded double-digit exploits, but April moved beyond that pattern.
April ends as the most-hacked month in crypto history, by number of incidents. pic.twitter.com/Cx67K3z86O
— DefiLlama.com (@DefiLlama) April 30, 2026
The total stolen value exceeded $600 million based on aggregated reports from onchain trackers, including commentary from independent crypto researcher Stacy Muur. While the value did not surpass previous billion-dollar months, the frequency of attacks marked a new operational phase for DeFi security.
Several incidents also revealed a concentration of losses in a small number of high-impact breaches rather than evenly distributed smaller exploits.
KelpDAO exploit triggers systemic shock
The largest single incident of the month involved Kelp DAO, which lost approximately $292 million in an exploit affecting its rsETH cross-chain bridge. The attack quickly escalated beyond the protocol itself and created stress across lending markets.
The exploit forced emergency responses across DeFi infrastructure. Emergency lending and support measures emerged, including contributions toward a relief pool coordinated by Aave governance participants. The scale of the response reached more than $300 million in committed support, according to public tracking data from DeFi United initiatives linked to the ecosystem.
A technical breakdown shows that the attacker manipulated cross-chain messaging through compromised RPC nodes. The system relied on a single verifier setup, which created a structural weakness. Once poisoned data reached the verifier, the system approved fraudulent instructions that released large quantities of rsETH.
The incident also triggered temporary freezes across lending markets exposed to rsETH collateral, including major DeFi lending venues.
Drift Protocol exploit exposes governance weakness
The second-largest incident involved Drift Protocol, which suffered a $285 million exploit on April 1.
The protocol confirmed an active attack through emergency communications, stating:
“We are observing unusual activity on the protocol. We are currently investigating.” A follow-up statement confirmed: “Drift Protocol is experiencing an active attack. Deposits and withdrawals have been suspended.”
Independent blockchain analysis linked the incident to a prolonged intrusion campaign. Security researchers traced early staging activity weeks before the final exploit. Some assessments attributed the operation to North Korean-linked groups, though attribution remains under investigation.
The attack relied on manipulation of administrative permissions and synthetic collateral creation. Attackers introduced a fraudulent token that was accepted as valid collateral, then drained liquidity pools across multiple vaults.
The incident caused immediate price pressure across the Solana ecosystem and contributed to sharp volatility in associated tokens.
Cross-chain infrastructure becomes primary target
A recurring pattern across April incidents involved cross-chain infrastructure. Hyperbridge lost approximately $2.5 million after attackers exploited a Token Gateway vulnerability tied to Polkadot-based systems. The exploit involved forged cross-chain messages that bypassed verification mechanisms, leading to unauthorized token minting and liquidation.
Additional incidents across smaller protocols reinforced the same theme. Wasabi Protocol suffered a multi-chain exploit exceeding $5 million after an admin key compromise allowed contract upgrades across Ethereum, Base, Berachain, and Blast deployments.
Another case involving Volo Protocol resulted in a $3.5 million loss after attackers accessed vault-level permissions and drained assets across multiple pools.
These incidents shared a structural feature: central control points or weak verification layers created single-entry vulnerabilities across otherwise audited systems.
Infrastructure weakness drives cascading losses
Security researchers examining April incidents highlighted a shift away from traditional smart contract bugs. Instead, attackers focused on infrastructure components such as RPC nodes, admin keys, and cross-chain verification layers.
In the KelpDAO case, compromised RPC nodes provided false blockchain data while legitimate nodes were suppressed through denial-of-service pressure. The system then validated incorrect cross-chain messages.
This type of attack bypassed code-level safeguards entirely. Smart contracts executed as designed, but external dependencies delivered manipulated inputs.
First-hand operational strain inside DeFi systems
Internal protocol responses across several incidents revealed consistent operational stress. Teams froze deposits, paused withdrawals, and coordinated with external security firms within minutes of detection. In multiple cases, emergency governance actions activated to prevent further drain, including partial asset freezes by network councils such as Arbitrum governance bodies.
These responses limited additional losses but also highlighted reaction speed constraints across decentralized systems. In several cases, attackers moved funds faster than protocols could coordinate defensive actions.
April signals structural change in DeFi risk
April 2026 now stands as a reference point for two simultaneous shifts: a record number of exploits and a concentration of losses in infrastructure-level attacks.
The data shows that smart contract audits alone no longer define security outcomes. Instead, system design choices around cross-chain messaging, administrative access, and oracle dependencies now determine exposure levels.
With more than 20 incidents in a single month and hundreds of millions in losses concentrated in a handful of breaches, April reshaped how DeFi risk is measured across the ecosystem.
Kristian Koch
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
