April 2026 Crypto Hack Wave: $606M Lost in 18 Days, Drift and Kelp Lead the Breach

In the first 18 days of April 2026, cryptocurrency protocols lost $606.2 million to hacks, making it the worst month since the Bybit incident in February 2025. With around 3.7 times the quarterly figure, the total encompasses 12 occurrences and dwarfs Q1 2026 losses of $165.5 million.

Two hacks were responsible for 95% of April's losses: Drift Protocol on Solana, which lost $285 million on April 1 due to social engineering and an admin key compromise, and Kelp DAO's rsETH bridge on Ethereum, which was drained of $292 million on April 18 by a spoofed LayerZero message. LendHub v3 ($1.2 million on BSC) and CrestDAO ($4.8 million on Ethereum) were among the smaller hacks, while other events totaled around $29 million.

Context and comparison present a dismal year-to-date picture: losses in 2026 total $771.8 million across 47 hacks, with April alone accounting for around 75% of this total. Bybit's February 2025 hack, in which $1.4 billion was stolen from cold wallets by means of social engineering, remains the benchmark that no month has yet surpassed. This highlights ongoing security vulnerabilities and the growing risk landscape throughout cryptocurrency protocols.