Crypto protocols lost over $606 million to hacks in just 18 days of April 2026. That makes it the single worst month for exploits since February 2025.
The surge comes from two attacks on KelpDAO and Drift Protocol. Together, they account for 95% of April's losses and 75% of 2026's total of $771.8 million.
According to data from DefiLlama, April's $606.2 million total across 12 incidents, it has already eclipsed the first quarter's $165.5 million haul. That makes the month roughly 3.7 times as large as January, February, and March combined.
Follow us on X to get the latest news as it happens
Every month since February 2025 has held under $240 million, per DefiLlama's tracker. That earlier figure was skewed by the $1.4 billion Bybit breach, which drove February 2025's total to $1.466 billion.
April 2026's losses arrived without any headline exchange hack of that size. The pattern shows how quickly attackers pivoted to Decentralized Finance (DeFi) infrastructure.
BeInCrypto reported that KelpDAO lost over $290 million on April 18, now the year's largest single hack. Drift Protocol sits just behind at $285 million.
The damage has stacked up in recent days. Incidents at Vercel, Hyperbridge, Grinex Exchange, and Rhea Finance have piled in 2026.
DeFi total value locked (TVL) fell by more than 7% over the past 24 hours following the Kelp exploit. Aave alone dropped from $26.4 billion to near $17.9 billion.
Hack frequency is also climbing sharply. DeFi recorded 47 incidents in the first 4.5 months of 2026, compared with 28 over the same period in 2025. That works out to a roughly 68% year-over-year rise.