April saw a record number of hacks in the crypto industry, with DefiLlama reporting over 20 incidents for the month.
April ends as the most-hacked month in crypto history, by number of incidents. pic.twitter.com/Cx67K3z86O
— DefiLlama.com (@DefiLlama) April 30, 2026
According to CertiK, total losses from these attacks reached $651 million. While this amount is not a record, the number of individual hacks surpassed historical highs.
#CertiKStatsAlert 🚨
— CertiK Alert (@CertiKAlert) April 30, 2026
Combining all the incidents in April we’ve confirmed ~$651M lost to exploits with
~$3.5M of the total attributed to phishing.
April has had the highest losses recorded since March 2022 (~$715M), excluding Feb 2025 (Bybit).
More details below 👇 pic.twitter.com/x9uAbLbtMz
Analyst Stacy Muur noted that there were 24 recorded cases of fund theft.
Full list of protocols & pools exploited in April (+2 since yesterday) ↓
— Stacy Muur (@stacy_muur) April 30, 2026
Wasabi Protocol: $ unknown
Sweat: $3,500,000
Aftermath Finance: $114,000
Judao: $228,000
Singularity Finance: $413,000
ZetaChain: $300,000
Scallop Lend: $150,000
Purrlend: $1,500,000
Giddy:… https://t.co/pPQ3StmiZv
The largest incident was the hack of Kelp, resulting in a loss of $292 million. This attack caused issues with "bad debts" in the lending protocol Aave, prompting the community to seek emergency loans and donations.
In second place was the hack of Drift Protocol on the Solana blockchain, with damages exceeding $280 million. Project representatives stated that the attack was not due to a code bug, but rather a planned operation that took about six months to prepare, utilizing social engineering techniques.
Another notable case involved the hack of the Hyperbridge protocol on Polkadot, which lost $2.5 million due to forged cross-chain messages. The attacker issued around 1 billion DOT tokens and sold them.
At the end of the month, an expert known as Wazz reported the hacking of hundreds of wallets on the Ethereum network, many of which had been inactive for over seven years.
Hundreds of wallets (many of which haven't been active in 7+ years) just got drained by the same address on ETH mainnet
— Wazz (@WazzCrypto) April 30, 2026
Seems like a new live exploit, worth flagging https://t.co/QiKU1b86Uv pic.twitter.com/o1uU85CLPT
According to CertiK, the losses in April were the largest since March 2022, excluding the Bybit incident. Approximately $3.5 million of the total was attributed to phishing.
It is worth noting that on April 30, hackers breached the Wasabi project, with losses exceeding $5 million.
On April 28, the Ethereum infrastructure project Syndicate was attacked, with cybersecurity experts estimating losses at $330,000.
At the same time, hackers breached the Aftermath Finance exchange within the Sui ecosystem, stealing around $900,000 in USDC.
The day before, the L1 network ZetaChain was affected by an attack. Developers stated that the incident only impacted the team's internal wallets, with losses amounting to $333,868.