April 2026 Was the Worst Month for Crypto Hacks Since February 2025 and Two Attacks Caused 90% of the Losses

[etfs]

Nearly $630 million in digital assets were stolen across 25 separate incidents in April 2026, making it the most damaging month for crypto hacks since February 2025 when $1.47 billion was stolen according to DefiLlama data. Two attacks account for more than 90% of all April losses. The Kelp liquid staking protocol hack remains the largest exploit of 2026 at $293 million, while the Drift Protocol attack came in close behind at $285 million. Together these two incidents set the tone for a month that has reshaped the DeFi landscape on Solana and beyond, triggering protocol shutdowns, contagion across affiliated projects, and a coordinated industry response that is still unfolding.

The Drift exploit was particularly notable for how it was executed. Preliminary findings described a highly coordinated attack involving months of social engineering in which a group of hackers gradually gained admin control before draining more than half the protocol's total value locked in a single operation. The sophistication and patience of the attack represents a different threat model than the flash loan exploits or smart contract vulnerabilities that have characterized most previous large DeFi hacks. The months-long preparation phase and the social engineering component make it significantly harder to prevent through technical audits alone, raising questions about governance security and admin key management that the broader DeFi industry will need to address systematically rather than on a protocol-by-protocol basis.

[cryptohog]

North Korea stole 76% of all crypto hack losses in April using two attacks and did not need to touch 97% of the other incidents to do it, efficiency is a skill.