While markets were watching $79,000 and the Iran ceasefire, something else happened in April that deserves serious attention.Crypto protocols lost over $606 million to hacks in just 18 days of April 2026, making it the worst month since February 2025's Bybit breach. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April's $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026's year-to-date theft total to approximately $771.8 million across 47 separate incidents.

Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea's Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month's losses and approximately 75% of everything stolen in crypto in 2026 so far.

The same state-sponsored hacking group behind both attacks. Different protocols. Different chains. Different vulnerability types. Same attacker.Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL.

This is the part that most coverage misses. It's not just the dollar amounts. It's the shift in how protocols are being attacked. April's exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. As crypto's cumulative hack losses have crossed $17 billion over the past decade, attackers are increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering.

AI-driven social engineering attacks. That's new and it's serious. As protocols hardened their smart contract code through multiple audits, sophisticated attackers evolved to target the humans operating the infrastructure — developers with admin keys, bridge operators, multisig signers.Jefferies has warned the string of marquee hacks could temporarily slow Wall Street's appetite for DeFi tokenization projects. PowerDrillThis is where the institutional story intersects with the security story. BlackRock, Morgan Stanley, Stripe — they're all building infrastructure on or adjacent to DeFi rails. If $600M+ can be stolen in 18 days from protocols that were considered secure, institutional risk departments need new frameworks before they commit more capital."DeFi remains a niche market until risk can be properly priced," one analyst wrote.

That's the honest state of things. The technology is powerful. The security model isn't mature enough for the capital it's trying to hold. Both things are true simultaneously.

#CryptoHacks #DeFiSecurity #LazarusGroup #KelpDAO #CryptoSecurity