One attack per day, $625 million gone: April 2026 will go down in the annals of crypto

April 2026 stands out as an unusual month for crypto. More than $625 million was stolen through a series of close-quarters attacks, at a rate rarely seen. Two incidents account for most of the losses and illustrate an evolution in methods, now focused as much on human as technical faults. This sequence reveals a persistent fragility of DeFi and raises the question of its capacity to absorb shocks of such magnitude.

A record month dominated by two major attacks

The month of April stands out as a turning point in the recent history of decentralized finance, with a brutal intensification of cyberattacks. In a few weeks, the protocols were hit at an unusual rate, reflecting a rise in the offensive capabilities of hackers.

This dynamic is observed both in the frequency of incidents and in their scale, revealing constant pressure on the entire ecosystem. The evolution is not only due to the volume of attacks, but to their nature, which is increasingly structured and targeted.

Two operations particularly marked this sequence, accounting for the majority of losses recorded during the month. The 1^er April, Drift Protocol was drained of $285 million after a gradual infiltration carried out over several months, with hackers exploiting pre-signed withdrawal instructions to act in just twelve minutes.

KelpDAO suffered a separate but equally devastating attack on April 18, with $293 million lost after its system was manipulated to release tokens without real collateral. These attacks, attributed to North Korean groups, illustrate growing sophistication. Like the underlines Ari Redbord from TRM Labs: “North Korea is now acting with unprecedented speed and precision”.

• More than $625 million stolen during the month;
• Between 20 and 30 attacks recorded, or almost one per day;
• A level higher than previous monthly records, generally limited to 12 to 15 incidents;
• Two major attacks concentrated most of the losses.

Systemic Effects and a Change in Risk in DeFi

Beyond the direct losses, the explosion has spread to the entire ecosystem. The attack on KelpDAO had immediate repercussions on Aave, where the fraudulent tokens were used as collateral to borrow nearly $190 million in Ethereum.

Within 48 hours, deposits on the platform fell from $26.4 billion to $17.9 billion, while bad debt soared to between $123.7 million and $230 million. Distrust quickly set in, causing the withdrawal of more than $13 billion from DeFi protocols and forcing several platforms to suspend certain operations in the face of massive capital outflows.

This crisis of confidence takes place in a context marked by the domination of North Korean groups in crypto cyberattacks. According to TRM Labs, these entities would be responsible for 75% of the losses recorded in 2026, or $577 million out of a total of $759 million.

Since 2017, more than 6 billion dollars have been stolen in this context. DeFi will remain a niche market until risk is properly assessed and integrated. This reality reveals a paradox: while attack response mechanisms have improved, including the freezing of $71 million by the Arbitrum Security Council, offensive techniques are evolving even more rapidly.

If the trend continues, losses could reach $7.5 billion in the coming months. This projection questions the ability of DeFi to absorb shocks of this magnitude while maintaining user confidence. Between progress in security and the increasing sophistication of attacks, the balance remains fragile, leaving lasting uncertainty over the future of the sector.