April Sees Record Number of Crypto Hacks, DeFi Projects Major Targets

In April 2026, the crypto industry witnessed a record-breaking 29 hacks, making it the highest monthly total ever documented. Among the most significant incidents were the hacks on Solana-based exchange Drift and Ethereum-based restaking app Kelp DAO, which together accounted for a loss of $579 million.

This surge in hacking incidents has raised concerns, particularly regarding the vulnerabilities inherent in centralized processes within decentralized finance (DeFi). In the case of Drift, North Korean hackers executed a social engineering campaign to compromise the accounts of two employees, leading to unauthorized administrative changes and the theft of approximately $285 million. Similarly, Kelp DAO was exploited through a weakness in the LayerZero crypto bridge, allowing hackers to steal around $273 million due to its setup requiring only a single operator.

Experts note that a considerable portion of these hacks is attributed to code vulnerabilities. In April, nearly 83% of the hacking incidents were linked to bugs in the underlying code, although these accounted for only $42 million of the total $635 million loss for the month. This discrepancy highlights that while code errors are frequent, they often do not result in the largest financial losses compared to attacks exploiting organizational weaknesses.

Michael Egorov, founder of DeFi protocols Curve Finance and Yield Basis, emphasized the need to minimize single points of failure to enhance security. He states, “We need to reduce the number of single points of failure as much as possible. The goal of DeFi design should be to minimize human-centric points of failure, not add to them.”

The increase in hacks can also be partly attributed to advancements in artificial intelligence, which have made it easier for hackers to identify and exploit weaknesses in DeFi code bases quickly. As the DeFi sector continues to mature, the rising incidences of hacking incidents have eroded confidence among investors and users, sparking debates about the trade-offs associated with decentralization.

While April 2026 recorded a significant number of hacks, it does not represent the worst loss month on record. That distinction belongs to December 2020, when approximately $3.5 billion was reported stolen, primarily through a major incident involving a Bitcoin mining company's wallets. These fluctuations in both incidents and loss amounts reflect the evolving landscape of security challenges within the crypto industry.