Overview
- Data from DeFi Llama shows April 2026 logged the most crypto exploits on record, with CertiK tallying about $651 million in confirmed losses and one report attributing nearly 95% of the total to the Lazarus Group.
- Kelp DAO lost $292 million, while Solana-based Drift Protocol reported losses above $280 million that it called a six-month “structured intelligence operation.”
- The Kelp breach raised worries about bad debt at Aave, and Arbitrum DAO opened a vote on April 30 to release 30,766 frozen ETH to DeFi United tied to the fallout.
- Analysts say several major hits relied on social engineering against people with admin keys rather than code flaws, which suggests audits alone cannot block these attacks.
- An on-chain analyst flagged a live exploit on April 30 that drained hundreds of long-dormant Ethereum wallets, and investigators were still confirming details.