Drift

LayerZero

Impact

April

THORChain

April 2026 turned out to be an unusual month for the crypto market. While overall activity remained steady on the surface against significant geopolitical turmoil, the space saw a series of exploits that shook investor confidence.
The leading blockchain security firm, CertiK, reported that crypto-related exploits and incidents in April 2026 resulted in total losses of over $650 million.
<h2 id="april-hacks">April Hacks</h2>
The largest incidents were <a href="https://x.com/CertiKAlert/status/2049821076654297529" rel="noopener noreferrer nofollow">led</a> by KelpDAO, which lost $292 million, followed by Drift Protocol at $285.2 million. The Drift Protocol exploit followed weeks of setup and months of social engineering to gain access to protocol signers. The funds were drained in about 12 minutes. In comparison, the KelpDAO hack stemmed from a single-verifier flaw in a LayerZero bridge, as attackers later moved funds through THORChain after over $70 million was <a href="https://cryptopotato.com/arbitrum-freezes-70-million-in-eth-linked-to-kelpdao-exploit-in-emergency-security-move/" rel="noopener noreferrer nofollow">frozen</a> on Arbitrum
Other exploits <a href="https://cryptopotato.com/garantex-successor-grinex-collapses-days-after-coordinated-wallet-exploit/" rel="noopener noreferrer nofollow">include</a> Rhea Finance at $18.4 million, Grinex at $16.2 million, among others. By sector, DeFi projects saw the highest losses at $609.3 million, while unverified contracts lost $8.5 million, GameFi $3.4 million, bridge-related incidents $2.8 million, and meme-related projects $1.9 million.
In terms of categories, wallet compromises accounted for the majority of losses at $611 million, followed by price manipulation at $18.8 million, code vulnerabilities at $16.9 million, phishing at $3.5 million, and front-end attacks at $544.7k.
<h2 id="fewer-attacks-higher-financial-impact">Fewer Attacks, Higher Financial Impact</h2>
North Korean hacking groups made up 76% of all crypto hack losses in 2026 through April, according to TRM Labs. This was not because they carried out more attacks, but because two major incidents alone caused $577 million in losses, which ended up outweighing all other activity. This pattern of fewer but higher-impact attacks has been typical of North Korea’s strategy since 2017.
TRM <a href="https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks" rel="noopener noreferrer nofollow">found</a> that their share of total crypto theft has steadily increased over the years, rising from under 10% in 2020 and 2021 to 22% in 2022, 37% in 2023, 39% in 2024, and 64% in 2025. That jump in 2025 was largely driven by the Bybit breach, where $1.46 billion was taken through a compromised Safe{Wallet} signing interface, which made it the largest crypto hack recorded so far.
In 2026, the combined losses from KelpDAO and Drift stand out in a similar way. What remains consistent is the pace of activity, with only a small number of carefully planned operations each year. What is changing, however, is how these attacks are carried out.
North Korea’s total crypto theft has now crossed $6 billion since 2017, as per TRM’s findings. Experts believe that these groups may be using AI tools to improve reconnaissance and social engineering for more precise and targeted exploits.
The post <a href="https://cryptopotato.com/kelpdao-and-drift-lead-devastating-650m-crypto-hack-wave-of-april/" rel="noopener noreferrer nofollow">KelpDAO and Drift Lead Devastating $650M Crypto Hack Wave of April</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

KelpDAO and Drift Lead Devastating $650M Crypto Hack Wave of April

Table of Contents

CryptoPotato_News

Other articles published on May 2, 2026

Join our free newsletter for daily crypto updates!