At least 12 DeFi protocols and crypto businesses have been attacked in just over two weeks since the $280 million Drift Protocol exploit on April 1.
Attacks aimed at crypto protocols or companies since the start of April include CoW Swap, Hyperbridge, Bybit, Dango, Silo Finance, BSC TMM, Aethir, MONA, Zerion and, most recently, Rhea Finance and the Grinex exchange.&nbsp;
The <a href="https://cointelegraph.com/news/drift-protocol-pause-deposit-unusual-activity" rel="noopener noreferrer nofollow">Drift Protocol</a> was hit with one of the largest <a href="https://cointelegraph.com/news/researchers-discover-malicious-ai-agent-routers-that-can-steal-crypto" rel="noopener noreferrer nofollow">exploits</a> this year on April 1, losing around $280 million in a long-running social engineering attack suspected to involve North Korean-affiliated actors.
The attacks also come amid growing concerns this month that advancing AI models, such as <a href="https://cointelegraph.com/news/china-has-compute-train-its-own-mythos-ai-nvidia-ceo" rel="noopener noreferrer nofollow">Anthropic’s Claude Mythos and equivalent</a> models, could eventually make it even easier for cyberattackers in the future.
<h2 id="rhea-finance-exploited-for-7-6-million">Rhea Finance exploited for $7.6 million</h2>
DeFi protocol Rhea Finance <a href="https://x.com/rhea_finance/status/2044934579774251493" rel="noopener noreferrer nofollow">reported</a> on Thursday that an attacker “leveraged a vulnerability in Rhea’s Margin Trading feature to execute a coordinated pool manipulation attack,” impacting the Rhea Lend smart contract.&nbsp;
<figure><img alt="Hackers, Hacks, DeFi" src="https://s3.cointelegraph.com/uploads/2026-04/019d99c9-d9ce-7975-842d-b9d7afbf3c08.jpg">
 <figcaption>Rhea Finance updates its users on the exploit. Source: <a href="https://x.com/rhea_finance/status/2044934579774251493" rel="noopener noreferrer nofollow">Rhea Finance</a>
 </figcaption>
</figure>
Around $7.6 million was extracted, <a href="https://x.com/CertiKAlert/status/2044791732575912321" rel="noopener noreferrer nofollow">according</a> to blockchain security firm CertiK.&nbsp;
“The attacker created fake token contracts and added liquidity in fresh pools, likely misleading the oracle and validation layer,” it explained.&nbsp;
Meanwhile, the Russia-linked Grinex exchange suspended operations after a $13.7 million hack on Thursday, <a href="https://grinex.io/?lang=en" rel="noopener noreferrer nofollow">blaming</a> “unfriendly states” for the incursion.&nbsp;
Related: <a href="https://cointelegraph.com/news/circle-faces-class-action-lawsuit-after-drift-protocol-hack" rel="noopener noreferrer nofollow">Stablecoin issuer Circle faces lawsuit over $280M Drift Protocol hack</a>
Another attack this month was aimed at the Binance Smart Chain TMM/USDT liquidity pool, which suffered a reserve manipulation attack, resulting in the loss of around $1.67 million in early April, R3ACH Network analyst Jussy <a href="https://x.com/jussy_world/status/2044684951891898473" rel="noopener noreferrer nofollow">said</a> on Thursday.&nbsp;
It followed just days after bridge aggregator Dango lost $410,000 from a smart contract bug on April 13.
In the same month, lending protocol Silo Finance lost $392,000 on April 3 from a misconfigured oracle exploit and decentralized GPU cloud computing platform Aethir lost $423,000 in an access control exploit on April 9.&nbsp;
<h2 id="dprk-ups-ai-social-engineering-attacks">DPRK ups AI social engineering attacks</h2>
The Drift Protocol and Zerion wallet exploits were two examples of Democratic People’s Republic of Korea-affiliated groups using <a href="https://cointelegraph.com/news/north-korean-hackers-use-ai-enabled-social-engineering-latest-attack" rel="noopener noreferrer nofollow">AI and social engineering</a> to infiltrate crypto companies to steal credentials and funds.&nbsp;
Malicious actors <a href="https://cointelegraph.com/news/defi-hacks-169m-q1-2026-crypto-exploits-decline" rel="noopener noreferrer nofollow">pilfered over $168.6 million</a> in cryptocurrency from 34 DeFi protocols in the first quarter of 2026, according to data from DefiLlama.
Magazine: <a href="https://cointelegraph-magazine.com/clarity-act-define-path-non-custodial-defi-us/" rel="noopener noreferrer nofollow">Forget stablecoin yield, how does the CLARITY Act treat DeFi?</a>

At least a dozen crypto entities attacked since Drift Protocol hack

Table of Contents

Cointelegraph

Other articles published on Apr 17, 2026

Join our free newsletter for daily crypto updates!