Crypto protocols have lost more than $606 million to hacks and exploits in just the first 18 days of April 2026, making it the single worst month for theft in the industry since the $1.4 billion Bybit breach in February 2025, according to data from DefiLlama.
Summary
- Over $606 million was stolen from crypto protocols across 12 incidents in the first 18 days of April 2026, according to DefiLlama data.
- Two attacks, the $285 million Drift Protocol exploit and the $292 million KelpDAO breach, account for approximately 95% of April’s losses.
- April’s total is already 3.7 times larger than the entire first quarter’s combined losses of $165.5 million, with the month not yet over.
Crypto protocols have lost more than $606 million to hackers across 12 separate incidents in just 18 days of April 2026, according to data tracked by DefiLlama. Yahoo Finance reported the figure from BeInCrypto’s analysis, confirming that April has already become the worst month for crypto theft since February 2025, when the Bybit breach alone accounted for $1.4 billion.
April 2026 Crypto Hacks Dwarf the Entire First Quarter
The scale of April’s damage is stark in context. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April’s $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026’s year-to-date theft total to approximately $771.8 million across 47 separate incidents. Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea’s Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month’s losses and approximately 75% of everything stolen in crypto in 2026 so far. As crypto.news reported, the KelpDAO exploit alone triggered over $10 billion in Aave outflows and sent shockwaves across more than 20 connected protocols.
The Attack Frequency Problem Is Getting Worse
Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The shift in attack methods is equally significant. As crypto.news documented, April’s exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL. “None of these accounts for the collateral damage seen across TVL, user trust, valuations, and the space’s morale. DeFi remains a niche market until risk can be properly priced,” an analyst wrote in BeInCrypto’s coverage.
What the April Hack Surge Means for Crypto Markets
Markets have already begun pricing in what analysts are calling a “security risk premium” on DeFi assets. As crypto.news tracked, crypto’s cumulative hack losses have now crossed $17 billion over the past decade, with attackers increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering. Institutional players are responding with emergency rate limits and frozen bridge flows, while Jefferies has warned the string of marquee hacks could temporarily slow Wall Street’s appetite for DeFi tokenization projects. If even one more mid-size exploit occurs before April 30, the month’s total could approach $700 million, according to DefiLlama data cited by BeInCrypto.
DefiLlama’s hacks tracker shows the attack frequency running at approximately one incident every 2.9 days in 2026, a pace researchers say reflects a growing attack surface driven by DeFi TVL exceeding $120 billion and the proliferation of cross-chain bridge infrastructure.
