April's $606M in Crypto Hacks Already Exceeds Q1 by Nearly 4x — And the Month Isn't Over
Two incidents — Drift on April 1 and Kelp on April 19 — account for most of it, but a dozen smaller exploits filled the gaps.
The tally
Crypto protocols have lost over $606 million to hacks in the first 18 days of April 2026, per DeFi Llama. That single-month figure already runs roughly 4× Q1 2026's total, making April the worst month for exploits since February 2025.
The two that mattered
Two incidents drive most of the number. Drift Protocol (Solana perps) lost about $285M on April 1 in an attack later tied to North Korea-affiliated actors. Kelp DAO's rsETH bridge was drained for $292M on April 19 (LayerZero attributes to TraderTraitor). Together: roughly $577M, or 95% of the month.
The long tail
A dozen smaller exploits filled in the rest of the ledger — CoW Swap, Zerion, Rhea Finance, Silo Finance and others. DeFi Llama's 12-month running total is now $1.71 billion.
Pattern break
March 2026 saw just $52M in hack losses, and January–February were dominated by phishing rather than protocol exploits. April is the first month in 2026 where protocol-level design failures — RPC nodes, verifier configs — drove the headline number.
BlockAI Take
The phishing-to-protocol shift is the real signal. Attackers are no longer chasing whale approvals; they're attacking shared infrastructure where one compromise spreads to every app that imports it. Cross-chain messaging, RPC providers, and oracle feeds are now the highest-value targets on the map.
