MegaETH

Ethereum

Aave

Galaxy

DeFi

Lending protocol Purrlend confirmed Saturday that it detected irregular activity across its deployments on both the <a href="https://www.megaeth.com/" rel="noopener noreferrer nofollow">MegaETH</a> and <a href="https://hyperliquid.gitbook.io/hyperliquid-docs/hyperevm" rel="noopener noreferrer nofollow">HyperEVM</a> networks and has paused the protocol while it investigates.
For context, both are newer blockchain networks designed for speed. MegaETH is an <a href="https://www.coindesk.com/tech/2026/02/09/megaeth-debuts-mainnet-as-ethereum-scaling-debate-heats-up" rel="noopener noreferrer nofollow">Ethereum layer-2 network</a> backed by Ethereum co-founder Vitalik Buterin that launched its public mainnet in February.
HyperEVM is the smart contract layer of <a href="https://www.dwellir.com/blog/what-is-hyperliquid" rel="noopener noreferrer nofollow">Hyperliquid</a>, a blockchain built primarily for trading. Purrlend operates as a lending platform on both — meaning users deposit crypto assets and either earn interest or borrow against their holdings.
On-chain analyst <a href="https://x.com/kirbyongeo" rel="noopener noreferrer nofollow">kirbyongeo</a> broke down the damage.
The attacker drained roughly $1.2 million from HyperEVM — including 449,683 USDC and 214,125 USDT0, both dollar-pegged stablecoins, along with 194,745 USDH, another stablecoin, and smaller amounts of UBTC (a tokenized version of Bitcoin), wstHYPE, UETH, kHYPE, and WHYPE.&nbsp;
From MegaETH, the attacker took another $324,549 in USDT0, WETH (wrapped Ethereum), and USDm. The grand total sits at approximately $1.52 million.
The exploiter's wallet addresses have been identified on both <a href="https://hyperevmscan.io/" rel="noopener noreferrer nofollow">HyperEVM</a> and <a href="https://mega.etherscan.io/" rel="noopener noreferrer nofollow">MegaETH</a> block explorers — public ledgers where anyone can track the stolen funds — though nothing has been recovered.
TheStreet <a rel="noopener noreferrer nofollow">Roundtable</a> reached out to Purrlend for comment and had not received a response by the time of publication.
<a href="https://www.thestreet.com/crypto/markets/major-defi-hack-becomes-the-largest-of-2026-yet" rel="noopener noreferrer nofollow">Related: Major DeFi hack becomes the largest of 2026 yet</a>
<h2 id="april-s-606-million-nightmare">April's $606 million nightmare</h2>
Purrlend is not an isolated incident.&nbsp;
It lands in what is being called the crypto's "$606 million April nightmare" — 12 hacks in 18 days, the worst month for digital asset security since the Bybit heist in February 2025.
The largest was <a href="https://www.thestreet.com/crypto/markets/major-defi-hack-becomes-the-largest-of-2026-yet" rel="noopener noreferrer nofollow">KelpDAO</a>, where an attacker drained <a href="https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains" rel="noopener noreferrer nofollow">$292 million in wrapped ether</a> from a cross-chain bridge — infrastructure that lets users move crypto between different blockchains — on April 18.&nbsp;
The attacker overwhelmed a single security checkpoint with junk traffic and fed it fake transfer requests. The exploit was later <a href="https://www.elliptic.co/blog/drift-protocol-exploited-for-286-million-in-suspected-dprk-linked-attack" rel="noopener noreferrer nofollow">attributed to North Korea's Lazarus Group</a>, the state-backed hacking unit responsible for some of the largest crypto thefts in history.
&nbsp;The fallout triggered <a href="https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack" rel="noopener noreferrer nofollow">$13 billion in DeFi withdrawals</a> in just two days, with lending giant Aave alone losing $8.45 billion in deposits as users rushed to pull their money out.
Drift Protocol, a trading platform on the Solana blockchain, was hit on April 1 for <a href="https://finance.yahoo.com/markets/crypto/articles/drift-protocol-hit-285m-exploit-074032288.html" rel="noopener noreferrer nofollow">$285 million</a> after attackers spent three weeks impersonating a trading firm and tricking the protocol's security council — a small group of keyholders who approve major transactions — into pre-signing approvals. Once they had the signatures, the attackers drained the platform's vaults in roughly 12 minutes.
Other April incidents include <a href="https://www.coindesk.com/markets/2026/04/22/another-defi-protocol-loses-millions-in-hack-days-after-kelpdao-breach" rel="noopener noreferrer nofollow">Volo Protocol losing $3.5 million</a> from vaults holding Bitcoin and stablecoin deposits on April 22, GiddyDefi being <a href="https://hacked.slowmist.io/" rel="noopener noreferrer nofollow">exploited for $1.3 million</a> on April 23 through a flaw in how it verified transaction approvals, and decentralized exchange aggregator CoW Swap losing $1.2 million to a domain hijacking attack on April 14.
<h2 id="more-from-thestreet-roundtable">More from TheStreet Roundtable:</h2>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/major-defi-hack-becomes-the-largest-of-2026-yet" rel="noopener noreferrer nofollow">Major DeFi hack becomes the largest of 2026 yet</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/gold-giant-freezes-344-million-tied-to-illicit-activity" rel="noopener noreferrer nofollow">Tether freezes $344 million tied to illicit activity</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/treasury-secretary-bessent-introduces-new-plan-to-combat-money-laundering" rel="noopener noreferrer nofollow">Treasury Secretary Bessent introduces new plan to combat money laundering</a></li>
</ul>
<h2 id="2026-s-running-total">2026's running total</h2>
DeFi losses — referring to hacks targeting decentralized finance platforms, which are crypto-based alternatives to banks and brokerages that let users lend, borrow, and trade without intermediaries — have now <a href="https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/" rel="noopener noreferrer nofollow">topped $750 million in 2026</a> through mid-April.&nbsp;
With Purrlend and other late-April incidents, the number is climbing past $800 million. Q1 alone saw over $137 million drained, including Step Finance's $27.3 million treasury theft in January.
The pattern has changed. Traditional coding errors in smart contracts — the self-executing programs that run these platforms — are reportedly <a href="https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained" rel="noopener noreferrer nofollow">down roughly 89%</a> from prior years, meaning security audits are catching more of the obvious bugs. What audits cannot catch — social engineering, forged cross-chain messages, compromised keyholders — is now where the real damage is concentrated.
Cross-chain bridges in particular keep producing the largest single-day losses in crypto history. As <a href="https://www.galaxy.com/insights/research/kelpdao-layerzero-exploit-defi" rel="noopener noreferrer nofollow">Galaxy Research noted</a> in its KelpDAO postmortem, the weak security setup that enabled that attack was a known design risk that had been publicly discussed for months before it was exploited.

Another DeFi platform just got hit with a $1.5 million exploit, services suspended

Table of Contents

TheStreet Roundtable

Other articles published on Apr 25, 2026

Join our free newsletter for daily crypto updates!