data<\/a> from DefiLlama at least 13 protocols have been compromised this month, with KelpDAO and Drift Protocol alone accounting for around 95% of April\u2019s losses and roughly 75% of 2026\u2019s total.<\/p>\n <\/p>\n
KelpDAO, an Ethereum liquid\u2011staking protocol, suffered an attack on April 18 that drained about 116,500 rsETH, valued at roughly $292m, after an attacker forged cross\u2011chain messages to trick a LayerZero EndpointV2 bridge contract into releasing reserves. Drift, Solana\u2019s largest decentralized perpetuals exchange, was hit on April 1 in what regional media called a \u201csophisticated\u201d exploit, losing about $285m in what is now the second\u2011largest security breach in Solana\u2019s history after the $326m Wormhole hack in 2022.<\/p>\n
From contract bugs to AI\u2011driven social engineering<\/h1>\n
The latest wave of hacks is not confined to smart\u2011contract bugs or restaking primitives. Incidents have hit routing and infrastructure layers such as Hyperbridge as well as front\u2011end and DevOps providers like Vercel, where attackers accessed internal systems and are allegedly shopping stolen data for $2m to fuel \u201cglobal supply chain attacks.\u201d<\/p>\n
On the human side, wallet provider Zerion disclosed that it was targeted by North Korean hackers who used AI\u2011powered, long\u2011horizon social\u2011engineering campaigns to compromise hot\u2011wallet keys, stealing about $100,000 while leaving user funds and core infrastructure intact. The Security Alliance (SEAL) has identified at least 164 malicious domains tied to the DPRK\u2011linked group UNC1069, describing its playbook as defined by \u201cpatience, precision, and the deliberate weaponization of existing trust relationships.\u201d<\/p>\n
Industry data from earlier episodes, such as the $70m hot\u2011wallet exploit at Singapore\u2011based exchange Phemex in 2025, had already highlighted North Korea\u2011linked actors\u2019 tendency to quickly convert stolen USDT and USDC into ETH to evade blacklists, a pattern authorities say continues in 2026.<\/p>\n
Market structure reacted in real time as April\u2019s hacks piled up. Between 11:00 and 13:00 UTC on key news days, order books in weaker mid\u2011cap DeFi names showed classic \u201ccapitulation\u201d signatures: single\u2011session drawdowns of roughly 5\u20138%, thin bids and a visible rotation into protocols with cleaner security track records. Derivatives venues saw basket funding for DeFi tilt mildly negative while spot liquidity drained, the kind of configuration desks associate with a broad \u201csecurity tax\u201d on risk assets rather than isolated idiosyncratic shocks.<\/p>\n
For traders, that has turned security into an explicit factor: fading leveraged DeFi beta on exploit headlines, staying long centralized venues and volatility\u2011monetizing infrastructure, and keeping dry powder for forced sellers once bad debt and write\u2011downs are fully recognized on\u2011chain.<\/p>\n
<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
April has already seen over $600m stolen across DeFi, bridges and wallets, turning security from a protocol\u2011level concern into a full\u2011blown market risk premium. Summary Crypto protocols have already lost…<\/p>\n","protected":false},"author":1,"featured_media":16591,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-26361","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=26361"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26361\/revisions"}],"predecessor-version":[{"id":26362,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/26361\/revisions\/26362"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/16591"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=26361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=26361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=26361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}