Image credit: Pexels
Key Takeaways
- Over $606M lost in 18 days, the worst month since the 2025 Bybit breach.
- KelpDAO and Drift Protocol account for 95% of April’s losses.
- Hack frequency is up 68% year-over-year, signaling rising security risks.
Crypto protocols lost more than $606 million to hackers in just the first 18 days of April 2026, making it the single worst month for exploits since the $1.466 billion Bybit breach of February 2025, according to data from DefiLlama, underscoring renewed security risks for DeFi users and protocols.
Two DeFi Exploits Account for Nearly All of April’s Damage
The losses were driven mainly by attacks on KelpDAO and Drift Protocol, which together accounted for 95% of April’s total losses and 75% of the $771.8 million recorded across 47 hacks so far in 2026.
April’s toll has already surpassed the entire first quarter, which logged $165.5 million across January, February, and March combined, making April roughly 3.7 times larger than Q1 in isolation.
According to DefiLlama’s tracker, every month between March 2025 and March 2026 came in under $240 million; April has exceeded previous monthly totals without involving any single high-profile exchange compromise comparable to Bybit.
KelpDAO and Drift Drive a Historic Surge in DeFi Losses
According to DefiLlama data, KelpDAO and Drift Protocol were linked to losses of roughly $290 million and $285 million, respectively.
Smaller incidents at Vercel, Hyperbridge, Grinex Exchange, and Rhea Finance have added to the cumulative toll in recent weeks, though none approach the scale of the two headline hacks. The pattern has drawn commentary from market observers, with one analyst writing:
“None of these accounts for the collateral damage seen across TVL, user trust, valuations, and the space’s morale. DeFi remains a niche market until risk can be properly priced; at this time, we’re far from it.”
DeFi TVL Drops More Than 7% as Hack Frequency Climbs 68% Year-Over-Year
DeFi total value locked fell more than 7% in the 24 hours following the Kelp exploit, with Aave alone dropping from $26.4 billion to approximately $17.9 billion. Analyst Ted Pillows explained that every protocol is taking a hit now, adding that the losses come amid ongoing concerns about security and user trust.
Hack frequency is rising sharply even as the dollar figures remain below the Bybit-distorted pace of early 2025. DeFi recorded 47 incidents in the first four and a half months of 2026, compared with 28 over the same period last year, a year-over-year increase of roughly 68%.
April Exploit Surge Raises Questions About DeFi Security
The combination of rising incident frequency and large losses has raised concerns among analysts about whether DeFi’s risk-pricing mechanisms have kept pace with the scale and sophistication of infrastructure-layer attacks.
Dollar losses through April 2026 still trail the Bybit-inflated totals from the same stretch in 2025, yet the pace of incidents has accelerated meaningfully. It remains unclear whether April’s surge represents a sustained trend or a temporary spike.
Categories:
Talik Evans
Journalist and Financial Analyst
Talik Evans is a financial writer and crypto researcher with a growing focus on digital assets, Bitcoin markets, and blockchain innovation. Since 2021, she has been exploring the world of cryptocurrency, writing about everything from exchange comparisons to regulatory updates and security practices.