Defillama has confirmed April 2026 as the most-hacked month in crypto history by incident count, logging 28 to 30 separate exploits that drained more than $625 million across the industry. The previous monthly peak rarely exceeded 12 to 15 incidents, making April's tally a record more than double any prior month.
Two Mega Exploits Drove 93% of April Losses
No single catastrophic event set the record. Drift Protocol on Solana lost roughly $285 million on April 1 in a social-engineering attack linked to North Korea's Lazarus Group. KelpDAO lost approximately $293 million around April 18 through a Layerzero bridge message spoofing exploit. Together, these two incidents accounted for nearly 93% of the month's total losses. The remaining 26+ exploits were mostly below $5 million, many under $1 million, hitting lending pools, vaults, staking contracts, oracle configurations, and cross-chain bridges.
Attack Frequency Hit Nearly One Per Day
A chart released by Defillama on April 30 showed the monthly incident count spiking to the highest since tracking began. April averaged close to one attack per day. Onchain researcher Stacy Muur posted a running tally on X on April 29, listing 24 confirmed hacks with losses exceeding $624 million and noting the month still had days left; final figures pushed the count higher.
In dollar terms, April's losses ranked as the worst since the February 2025 Bybit breach (~$1.4B). But in incident count, April 2026 stands alone. Year-to-date through April, the industry recorded roughly 68 incidents and over $1 billion stolen, already ahead of 2025's pace excluding Bybit. April alone was 3.7 times larger than all of Q1 2026, which saw about $165 million lost across 35 incidents.
Notable Smaller Incidents in April
Other April exploits include Rhea Finance ($18.4M), Grinex ($15M), Volo Vault ($3.5M), Hyperbridge ($2.5M), Sweat Foundation ($3.5M), and Wasabi Protocol (~$5M on April 30). Dozens more ranged from $50,000 to $1.5 million.
Following the KelpDAO hack, reports showed more than $14 billion in total value locked (TVL) leaving DeFi protocols within days, concentrated in bridge and lending platforms.
Community and Security Trends
Community reaction ranged from alarm to calls for structural change. Security researchers pointed to social engineering and access-control failures as dominant vectors, moving beyond the smart-contract bugs that defined earlier DeFi exploits. Calls for multi-sig key management, AI-assisted monitoring, protocol security sprints, and user-level insurance products appeared across forums and social media.
Defillama's lifetime totals now show crypto hacks exceeding $16.5 billion, with DeFi-specific losses near $7.7 billion and bridge exploits accounting for approximately $2.9 billion. Private-key compromises and operational security failures remain the most common attack vectors across all categories.