April Saw Record 29 Crypto Hacks, Highest Monthly Total Ever

Crypto faced a record 29 hacks and exploits in April, the highest monthly tally the industry has ever recorded.

Two attacks on DeFi protocols accounted for ₱35.55 billion ($579 million) in combined losses. Drift, a Solana-based exchange, lost ₱17.5 billion ($285 million) after North Korean hackers compromised two employees through social engineering. Kelp DAO, an Ethereum-based restaking app, lost ₱16.76 billion ($273 million) when attackers exploited a LayerZero bridge instance configured with a single operator.

Cyvers Vice President of Strategy Michael Pearl said the pattern is clear. DeFi has become the primary target, and hackers have shifted from exploiting code to manipulating humans. That marks a tactical change from earlier years when bugs dominated the loss profile.

Code bugs caused 24 out of 29 incidents in April but accounted for just ₱2.58 billion ($42 million) in losses, about 6.6% of the month's $635 million total. The concentration of losses in social engineering attacks explains the gap. Bybit lost $1.5 billion to North Korean hackers in February 2025 through a similar employee compromise. Arkham Intelligence discovered that LuBian, a Bitcoin mining company, had $3.5 billion stolen from its wallets in December 2020 but didn't notice for almost five years.

Curve Finance and Yield Basis founder Michael Egorov said DeFi design should minimize human-centric points of failure, not add to them. April's losses fell below three other months on record — August 2021, March 2022, and October 2022 all saw higher dollar amounts stolen, but the 29 separate incidents in April 2026 broke the previous record for monthly hack frequency.