Crypto Hacks Hit $600M in April: Market Prices in ‘Security Tax’

by

Crypto hacks top $600m in April as market prices in ‘security tax’

So far this April, over $600 million has been stolen in the decentralized finance (DeFi) space, from cryptocurrency bridges, and through wallet hacks. This surge in thefts has moved security from being just a technical issue for individual projects to a major risk factor for the entire market.

Summary

  • Crypto protocols have already lost more than $600m to hacks in April, led by $292m stolen from KelpDAO and $285m from Drift Protocol.
  • Exploits now cut across smart contracts, infrastructure and social‑engineering attacks, including AI‑driven campaigns against wallets like Zerion.
  • Between 11:00 and 13:00 UTC, mid‑cap DeFi names saw capitulation‑style selloffs as derivatives markets priced in a persistent “security risk premium.”

Recent data reveals that cryptocurrency platforms have suffered over $606 million in losses due to hacks in just the first 18 days of April. This makes it the worst month for these kinds of attacks since February 2025, and brings the total losses for the year 2026 to over $770 million. DefiLlama reports that at least 13 platforms have been hacked this month, with KelpDAO and Drift Protocol responsible for about 95% of the April losses and around 75% of the year’s total so far.

Two major DeFi platforms were recently attacked. On April 18th, KelpDAO, which operates on Ethereum, lost approximately $292 million worth of rsETH due to a hacker manipulating messages sent through the LayerZero bridge. Earlier, on April 1st, Drift, a large Solana-based exchange, suffered a “sophisticated” exploit resulting in a loss of around $285 million – making it the second-largest security incident in Solana’s history, following the $326 million Wormhole hack in 2022.

From contract bugs to AI‑driven social engineering

Recent hacks aren’t limited to problems with smart contracts or new restaking technologies. Attacks have targeted core systems like Hyperbridge, which handles transaction routing, and even companies that provide essential services like Vercel. Attackers gained access to Vercel’s internal systems and are reportedly trying to sell stolen data for $2 million, potentially to launch broader attacks on the software supply chain.

Zerion, a digital wallet provider, recently revealed it was hacked by a group believed to be linked to North Korea. The hackers used sophisticated, long-term social engineering tactics, aided by artificial intelligence, to gain access to keys for its ‘hot wallets’ and stole around $100,000. Fortunately, user funds and Zerion’s main systems were not affected. The Security Alliance (SEAL) has tracked at least 164 fake websites connected to this group, known as UNC1069, and describes their approach as carefully planned and focused on exploiting existing relationships and trust.

Previous incidents, like the $70 million theft from the Phemex exchange in 2025, showed that groups linked to North Korea often quickly trade stolen USDT and USDC for ETH. This is done to avoid being detected by systems that flag stolen cryptocurrency, and authorities say this pattern is still happening in 2026.

As a researcher, I observed how the market responded immediately to the series of hacks in April. On the days the news broke, specifically between 11:00 and 13:00 UTC, I noticed some concerning patterns in the order books of smaller, mid-sized DeFi projects. These projects experienced sharp declines – around 5 to 8% in a single day – with very few bids available. Investors were clearly moving their funds to protocols with a stronger history of security. Looking at derivatives markets, funding rates for DeFi as a whole dipped slightly, and overall liquidity decreased. This combination of factors suggests a widespread ‘security tax’ was being applied to all riskier crypto assets, rather than just reactions to individual project issues.

For traders, this means prioritizing security and being cautious. They’re reducing risky investments in decentralized finance (DeFi) when security breaches occur, favoring established, centralized platforms, and benefiting from market swings. They’re also holding onto cash to take advantage of potential sales when losses from bad debts become clear on the blockchain.

Read More

2026-04-20 17:28