Crypto hacks hit record high in April as 20+ exploits shake DeFi

April 2026 was the worst month on record for crypto security: 28–30 DeFi attacks stole over $625 million, driven largely by two North Korea-linked exploits — Drift Protocol ($285M, April 1) and KelpDAO ($293M, April 18). The KelpDAO attackers used stolen tokens as collateral on Aave, prompting Aave deposits to plunge from $26.4B to about $17.9B in 48 hours, stablecoin pools to reach full utilization, and estimated bad debt of $123.7M–$230M. Panic withdrawals forced >$13B out of DeFi, freezing of services at major platforms and emergency interventions (e.g., Arbitrum freezing $71M; a $300M DeFi rescue pledge). The scale and sophistication of human-manipulation attacks have amplified systemic risk, threatening TVL, valuations and user trust and implying possible further losses (~$7.5B if the pace continues).