April 2026 has produced $606.2 million in crypto theft across at least 12 incidents in 18 days, making it the worst single month for DeFi exploits since the $1.46 billion Bybit hack in February 2025. Two attacks — the $285 million Drift Protocol breach on April 1 and the $292 million Kelp DAO bri...
"Aave is my life's work and we're working nonstop to find the best possible outcome for users. I'm personally contributing 5,000 ETH to DeFi United." — Stani Kulechov, Founder, Aave
April 2026 has produced $606.2 million in crypto theft across at least 12 incidents in 18 days, making it the worst single month for DeFi exploits since the $1.46 billion Bybit hack in February 2025. Two attacks — the $285 million Drift Protocol breach on April 1 and the $292 million Kelp DAO bridge drain on April 18 — account for 95% of losses. Both have been attributed to North Korea's Lazarus Group by blockchain analytics firms Chainalysis, Elliptic, and TRM Labs.
The Kelp DAO exploit alone triggered a $13.2 billion DeFi TVL contraction in 48 hours, pushed Aave's total value locked from $26.4 billion to $17.5 billion, and generated between $124 million and $230 million in bad debt across lending markets. The attack mechanism — off-chain RPC node poisoning rather than smart contract exploitation — exposed a category of infrastructure risk that existing audit frameworks do not cover.
Year-to-date theft now stands at $771.8 million across 47 incidents, compared with 28 incidents over the same period in 2025. Bridge exploits dominate the loss profile. The data raises a structural question for the DeFi sector: whether the economic value of cross-chain composability justifies the systemic risk it introduces to lending markets.
The month's damage concentrated into two distinct clusters, both attributed to DPRK-linked actors.
April 1 — Drift Protocol ($285M): Solana-based perpetuals DEX Drift Protocol was drained of over 50% of its TVL in 12 minutes. The breach originated from a six-month social engineering campaign in which attackers posed as a quantitative trading firm to gain trust with Drift contributors. Attackers exploited Solana's "durable nonces" system to trick Security Council members into pre-signing dormant transactions that, when triggered, transferred admin control. Drift's TVL fell from $550 million to under $300 million within an hour. According to TRM Labs, this was the 18th crypto theft attributed to North Korea in 2026, bringing their annual total above $300 million.
April 14 — CoW Swap ($1.2M): A domain hijacking attack drained $1.2 million from the decentralized exchange aggregator.
April 18 — Kelp DAO ($292M): Attackers drained 116,500 rsETH — approximately 18% of the token's circulating supply — from Kelp DAO's LayerZero-powered cross-chain bridge. The exploit took 46 minutes from first forged packet to final withdrawal. The attacker subsequently attempted a second extraction of 40,000 rsETH (~$95 million), which was blocked.
Additional incidents across the month hit Step Finance, Grinex, Zerion, Rhea Finance, and Silo Finance, among others. The first 18 days of April produced $606.2 million in losses — 3.7 times the entire Q1 2026 total of $165.5 million.
The Kelp DAO exploit was not a smart contract vulnerability. It was an infrastructure attack targeting the off-chain verification layer of a cross-chain bridge.
The mechanism, step by step:
Attackers identified that Kelp DAO's bridge used a 1-of-1 Decentralized Verifier Network (DVN) configuration on LayerZero — meaning only a single verification node needed to approve cross-chain messages.
Attackers compromised two internal RPC nodes hosted by LayerZero that the DVN used to read source-chain state. The modified nodes returned forged data to the DVN while continuing to provide truthful data to other systems, including LayerZero's monitoring service.
A DDoS attack was launched against uncompromised external RPC nodes, triggering automatic failover to the poisoned nodes.
The poisoned nodes reported that rsETH had been burned on the source chain (Unichain). No such burn had occurred.
The LayerZero Labs DVN, reading only from the compromised nodes, confirmed the forged cross-chain message as valid.
The Ethereum-side bridge contract released 116,500 rsETH to an attacker-controlled address at 17:35 UTC.
The attacker then deposited 89,567 rsETH into Aave as collateral and borrowed approximately $190 million in ETH and related assets across Ethereum and Arbitrum.
Attribution: LayerZero Labs attributed the attack to DPRK's Lazarus Group, specifically the TraderTraitor sub-group, according to their incident statement published April 20.
The blame dispute: LayerZero stated that Kelp DAO chose a 1/1 DVN configuration against recommendations. Kelp DAO countered that LayerZero's default settings were responsible. The dispute remains unresolved. Regardless of attribution, the 1/1 DVN design was the single enabling factor — a multi-DVN configuration (e.g., 2-of-3) would have prevented the exploit even with two compromised nodes.
Drift's $285 million loss on April 1 foreshadowed the month's pattern in two respects: state-level sophistication and off-chain attack vectors.
The attack sequence spanned six months. Lazarus operatives posed as a quantitative trading firm to build relationships with Drift contributors. They created CarbonVote Token (CVT) on March 12 with a 750-million-token supply, seeded a small Raydium liquidity pool, and wash-traded CVT to anchor its price at approximately $1 while deploying a controlled price oracle feeding that artificial price to Drift's systems.
The critical exploit used Solana's durable nonce transactions — a feature designed for legitimate use cases — to have Security Council members unknowingly pre-sign transactions that later transferred administrative control. Vaults holding USDC, WETH, JLP tokens, and other assets were drained through compromised administrative privileges.
Drift's loss was the second-largest exploit in Solana's history, behind only the $326 million Wormhole bridge hack in February 2022. The attack demonstrated that DeFi's security perimeter extends well beyond smart contracts into human and infrastructure layers.
The Kelp DAO exploit produced damage far exceeding the $292 million directly stolen, because rsETH was embedded as collateral across at least nine separate lending markets on more than 20 networks.
Immediate impact (hours 0–24):
48-hour impact:
Bad debt formation: The attacker deposited stolen rsETH into Aave as collateral and borrowed real ETH against it. With rsETH depegged, those positions became unrecoverable. Aave faced $124 million to $230 million in bad debt depending on how losses are distributed — $124 million if spread across all rsETH holders, $230 million if isolated to Layer 2 networks.
The contagion ratio: $292 million drained at the bridge produced $13.21 billion in DeFi TVL outflows — a 45:1 amplification ratio. This demonstrates the systemic leverage embedded in cross-chain collateral structures.
In response to the potential bad debt crisis, an industry-wide coordination effort — dubbed "DeFi United" — was organized within days.
Key commitments as of April 23:
Recovery progress: The Arbitrum Security Council executed an emergency action to freeze 30,766 ETH ($71 million) on Arbitrum One at the exploiter's address, with input from law enforcement. Approximately $70 million in ETH has been recovered. The attacker attempted to move approximately $175 million in ETH, which is being tracked by Chainalysis and law enforcement agencies.
The DeFi United effort represents an ad hoc mutual-aid arrangement rather than a formal insurance mechanism. The distinction matters: contributions are voluntary, governance-dependent, and unreliable as a precedent for future incidents.
The Kelp DAO exploit has forced a reassessment of cross-chain bridge security configurations across the industry.
The DVN model: LayerZero v2 introduced the X-of-Y-of-N verification model, allowing applications to specify exactly how many DVNs must verify a message. The canonical configuration is "2 of 3 of 5" — two required DVNs must sign, plus any three of five optional DVNs. Kelp DAO used 1-of-1.
Post-exploit changes:
The audit gap: Traditional smart contract audits do not cover off-chain infrastructure. RPC node security, DVN configurations, failover logic, and monitoring system integrity fall outside the scope of standard audits. The Kelp DAO exploit succeeded entirely within this uncovered perimeter.
| Period | Incidents | Total Losses | |--------|-----------|-------------| | Q1 2026 (Jan–Mar) | 35 | $165.5M | | April 1–18, 2026 | 12 | $606.2M | | YTD through April 18 | 47 | $771.8M | | Same period 2025 | 28 | ~$1.7B* |
*2025 figure inflated by the $1.46 billion Bybit hack in February 2025.
The 2026 incident count (47) represents a 68% increase over the same period in 2025 (28), even as the total dollar figure remains lower due to the singular scale of the Bybit exploit. Bridge exploits remain the dominant attack vector by dollar volume.
North Korea attribution: TRM Labs reports that DPRK-linked actors have conducted at least 18 crypto thefts in 2026, totaling over $300 million. The Drift and Kelp DAO attacks together — if attribution holds — would represent approximately $577 million in DPRK-linked theft, approaching the pace of the group's $1.34 billion in estimated 2024 hauls.
April 2026 produced $606.2 million in DeFi losses across 12 incidents in 18 days, making it the worst month for crypto theft since February 2025. Two incidents — Drift ($285M) and Kelp DAO ($292M) — account for 95% of losses.
The Kelp DAO exploit was an infrastructure attack, not a smart contract bug. Poisoned RPC nodes fed false data to a single-point-of-failure DVN, exposing a category of risk that conventional audits do not cover.
A $292 million bridge drain produced a $13.2 billion DeFi TVL contraction — a 45:1 amplification ratio — because rsETH was embedded as collateral across at least nine lending markets on 20+ chains.
Aave absorbed the worst secondary damage: $8.45 billion in TVL outflows, 100% pool utilization across major assets, and $124M–$230M in bad debt. The DeFi United bailout coordination is voluntary and governance-dependent.
Both major April exploits are attributed to North Korea's Lazarus Group. DPRK-linked actors have conducted at least 18 crypto thefts in 2026 totaling over $300 million, per TRM Labs.
LayerZero will end support for single-DVN configurations. EtherFi moved to 4/4 verification. The industry standard for high-value bridges is shifting to mandatory multi-DVN architectures.
DeFi's total economic losses from exploits now exceed its fee revenue relative to the subsidies required to sustain it — reinforcing the question of whether the sector's composability benefits justify the systemic risk introduced by cross-chain collateral dependencies.
The data from April 2026 presents a structural problem rather than an isolated incident cluster. Cross-chain bridges remain the highest-value attack surface in DeFi, and the composability that makes liquid restaking tokens useful also makes them vectors for systemic contagion. A single $292 million exploit erased $13.2 billion in DeFi TVL because the same collateral asset was recycled across multiple lending markets on multiple chains — each treating it as independently safe.
The Kelp DAO attack also revealed a category gap in DeFi's security stack. Smart contract audits, which dominate protocol security budgets, cover on-chain logic. The exploit succeeded entirely off-chain, in the RPC and verification layer. No amount of Solidity auditing would have detected or prevented it.
The DeFi United response — an ad hoc industry bailout involving voluntary ETH contributions — addressed the immediate crisis but does not constitute a durable solution. Aave's 25,000 ETH commitment, if approved by governance, would represent approximately $45 million in self-insurance against a $230 million worst-case bad debt. The gap implies either that the sector accepts residual risk of this magnitude or that formal insurance mechanisms will need to emerge.
For cross-chain infrastructure, the direction is clear: multi-DVN verification is moving from optional configuration to mandatory requirement. LayerZero's pledge to end single-DVN support and EtherFi's move to 4/4 verification represent the minimum corrective baseline. Whether these changes will prove sufficient against state-level adversaries with six-month planning horizons remains an open question.