April will go down in the history books as one of the most punishing months the cryptocurrency industry has ever endured, testing the patience and resolve of even its most devoted supporters.
According to comprehensive data compiled by DefiLlama, a staggering 29 distinct crypto projects suffered hacks or malicious exploits over the course of the month. This grim milestone represents the highest monthly tally of security breaches in the entire history of the digital asset industry, shattering previous records and dragging decentralized finance back into the spotlight for all the wrong reasons.
The attacks resulted in an aggregate loss of roughly $635 million, with two massive incidents dominating the landscape. The breaches of Solana-based decentralized exchange Drift and Ethereum-based restaking application Kelp DAO alone accounted for a combined $579 million drain.
This unprecedented surge in criminal activity has sparked a profound crisis of confidence across the ecosystem. Long-term believers and everyday users alike are increasingly left questioning whether the foundational tradeoffs inherent in decentralized technology—where users must often trust complex code and opaque administrative structures—are genuinely worth the mounting risks.
In recent years, both the frequency of crypto hacks and the sheer volume of stolen capital had appeared to edge higher, reflecting the vast sums of money flowing through the sector. The fast-moving and experimental decentralized finance space, once notoriously plagued by high-profile exploits during earlier bull markets, was widely thought to have matured. Security practices had ostensibly improved, audits had become standard procedure, and developers were expected to build with greater care.
However, the events of April proved that the threat landscape has merely evolved rather than receded. Security experts note that the nature of cyberattacks targeting the blockchain ecosystem has fundamentally transformed.
"Right now, DeFi seems to be the primary target," Michael Pearl, vice president of strategy at crypto security firm Cyvers, previously told DL News. "In general, everything has shifted now to hacking humans rather than hacking systems."
Single Points of Failure
The vulnerability of modern decentralized finance protocols often stems from structural compromises that undermine the core ethos of decentralization. According to Michael Egorov, the founder of prominent DeFi protocols Curve Finance and Yield Basis, the root of the problem lies in the persistence of centralization within otherwise distributed networks.
"We need to reduce the number of single points of failure as much as possible," Egorov said in a statement shared with DL News. "The goal of DeFi design should be to minimise human-centric points of failure, not add to them."
This diagnosis was borne out vividly in the attacks on both Drift and Kelp DAO, which both ultimately traced back to centralized weak points within their respective architectures.
The assault on Drift involved a sophisticated, targeted social engineering campaign orchestrated by North Korean hackers. The attackers successfully compromised two Drift employees, extracting credentials or exerting psychological pressure that granted the bad actors the power to alter administrative settings on the protocol. Armed with these privileged admin controls, the hackers were able to manipulate the platform and siphon off approximately $285 million in user funds.
The breach at Kelp DAO demonstrated a different flavor of centralized vulnerability, this time residing within infrastructure dependencies. The protocol relied on an instance of the LayerZero crypto bridge that was configured in a manner requiring only a single operator to authorize actions. Hackers identified and exploited this centralized choke point, making off with $273 million.
Yet, structural centralization is far from the only vector through which DeFi protocols are being caught off guard. Beyond the massive administrative exploits, code vulnerabilities continue to plague the development lifecycle of smart contracts.
During April, 24 out of the 29 reported security incidents—accounting for nearly 83% of all attacks—were triggered by underlying code bugs.
Security researchers and industry analysts have previously warned DL News that rapid advancements in artificial intelligence are drastically altering the dynamics between defenders and attackers. Bad actors are increasingly leveraging the large language models that power advanced AI chatbots like ChatGPT and Claude to parse through thousands of lines of code in a fraction of a second. Tasks that once required human hackers to spend weeks manually reviewing repositories can now be executed almost instantaneously, making it significantly cheaper, easier, and faster to probe DeFi protocols for overlooked flaws.
Interestingly, while code bugs represented the vast majority of the month’s incidents, they accounted for a relatively small fraction of the total stolen capital. The 24 bug-related exploits resulted in around $42 million in losses, representing roughly 6.6% of April’s total $635 million tally. By contrast, the few massive exploits targeting human-centric and bridge-related central points of failure made up the lion’s share of the financial damage.
Putting the Numbers in Perspective
Even though April set an all-time record for the sheer volume of individual security breaches, it did not claim the dubious title of the worst month in history when measured strictly by the total value of funds stolen.
That distinction belongs to December 2020, a period when hackers reportedly made off with an estimated $3.5 billion in digital assets. However, security analysts universally view that historical spike as a profound statistical outlier. The vast majority of the December 2020 figure stemmed from a massive, covert hack targeting wallets belonging to LuBian, a prominent Bitcoin mining company.
Neither LuBian nor the suspected perpetrators have ever publicly acknowledged the breach, and the massive theft remarkably remained unnoticed by the broader public for nearly five years. Arkham Intelligence, the blockchain data platform that eventually uncovered and publicized the hack, concluded that the incident was likely facilitated by LuBian’s use of a flawed private key generation algorithm. This cryptographic weakness left their wallets catastrophically susceptible to brute-force attacks.
Other historical periods have also outpaced April in terms of total capital lost. In February of the previous year, North Korean state-sponsored hackers managed to swipe $1.5 billion from a centralized crypto exchange, dwarfing typical monthly averages. Additionally, total stolen funds slightly exceeded April’s figures during August 2021, March 2022, and October 2022, respectively, driven by massive exploits of major cross-chain bridges and lending protocols during those periods.
As the industry digests the grim milestones of April, developers, auditors, and investors are forced to re-evaluate their defenses against an enemy that is exploiting both human psychology and machine intelligence with unprecedented efficiency.
Tim Craig is DL News’ Edinburgh-based DeFi Correspondent. Reach out with tips at [email protected].
