April 2026 Sets All-Time Crypto Hack Record: $630M Lost in 30 Incidents
April 2026 is now the most damaging month in crypto history, with CertiK reporting $630 million stolen across roughly 30 separate exploits confirmed by DeFiLlama. Two state-sponsored attacks accounted for the overwhelming majority of losses, reshaping how the industry understands systemic risk. The month closed with Carrot, a Solana yield platform caught in the fallout, announcing its shutdown on April 30.
Two Strikes, $577 Million Gone
The destruction was concentrated rather than distributed. Drift Protocol, the Solana-based perpetual exchange, lost $285 million on April 1 in what the team later described as the result of a six-month intelligence operation. KelpDAO’s cross-chain bridge was drained of 116,500 rsETH worth approximately $292 million on April 18, becoming the largest single DeFi exploit of the year. Together, those two incidents represented roughly 82% of April’s total losses and just a fraction of the month’s incident count, as detailed in our earlier coverage of Kelp DAO’s bridge exploit triggering contagion across nine protocols.
TRM Labs attributed both attacks to North Korean actors, with the Lazarus Group’s TraderTraitor unit identified as the likely perpetrator behind the KelpDAO breach. The firm’s data shows North Korean groups have now claimed 76% of all crypto hack losses in 2026 through April, totaling $577 million across just two operations. That figure extends a multi-year trajectory: their share of total theft stood below 10% in 2020 and 2021, climbed to 22% in 2022, then reached 37%, 39%, and 64% in successive years.
The Block reported that a further exploit involving dormant Ethereum mainnet addresses emerged as April closed, underscoring that the month’s incident count was still climbing in its final hours. Smaller but notable losses included Wasabi Protocol, which was drained of more than $5 million across Ethereum, Base, Berachain, and Blast after an admin key was compromised, and Syndicate Labs, where a leaked upgrade key allowed an attacker to hijack its Commons bridge and extract approximately $330,000 in SYND tokens plus user funds.
Bitcoin BTC$64,058.00▲0.85%
Ethereum ETH$1,721.94▼0.11%
Tether USDT$0.9989▼0.02%
BNB BNB$586.19▲0.12%
USDC USDC$0.9998▼0.00%
XRP XRP$1.14▼0.31%
Solana SOL$73.20▲2.37%
TRON TRX$0.3262▲0.48%
Figure Heloc FIGR_HELOC$1.03▲0.00%
Hyperliquid HYPE$67.85▼4.31%Precision Over Volume: The Threat Model Has Changed
TRM Labs noted that attack frequency has not increased. What has changed is the targeting precision. Analysts have begun to assess whether North Korean operators are incorporating AI tools into reconnaissance and social engineering, a development consistent with the Drift breach, which reportedly required weeks of manipulation of complex blockchain mechanisms rather than the simpler private key compromises that characterized earlier campaigns. That operational shift demands a corresponding evolution in how protocols assess and monitor risk, particularly across governance permissions and off-chain dependencies that now routinely influence on-chain outcomes.
The broader infrastructure toll is real and measurable. Aave’s total value locked dropped sharply after the KelpDAO exploit, and the recovery effort remains incomplete, with DeFi United raising $160 million toward a $200 million bad debt target as of late April. April’s record does not mean the ecosystem is broken; it means the attack surface has matured faster than the defenses protecting it, and that gap is now costing the industry at a scale that demands more than reactive audits.
