With less than two weeks remaining in April, the crypto industry appears set to record its highest monthly hack losses since February 2025, following the KelpDAO exploit over the weekend.
By April 20, hackers had stolen about $606,215,950 from the cryptocurrency space, according to data from DeFiLlama analyzed by Finbold. On April 18, attackers targeted KelpDAO, an Ethereum (ETH)-based liquid restaking protocol, and drained approximately $293 million.
At the beginning of this month, Drift Trade – an open source perpetual futures exchange on the Solana (SOL) network – was siphoned of around $286 million. As such, crypto losses from hacks surged 1,368% month over month (MoM), reaching a new record in 14 months.
Crypto investors flee DeFi space after KelpDAO attack
Following the heightened risk of sophisticated attacks on Decentralized Finance (DeFi) in April, crypto investors have been exiting en masse. Over the past 24 hours, all the top 20 DeFi chains registered net outflows of over $10 billion in total value locked (TVL). Precisely, the total TVL in DeFi declined from $99.49 billion on April 18 to hover roughly $85.41 billion at the time of publication, based on metrics from DeFiLlama.
The Ethereum network was the worst hit after the KelpDAO attack, with its TVL declining by $10.34 billion, in two days, to hit approximately $46.16 billion at press time. Furthermore, the TVL on AAVE (AAVE), a top multi-chain lending protocol, fell to its lowest level in 2026 at reporting time, to about $17.51 billion, down from $26.39 billion on April 18, as indicated on DeFiLlama.
Web3 expert warns of a systemic risk
The attack on Kelp DAO could spread across numerous DeFi protocols, as per analysis from David Schwartz, former Chief Technology Officer (CTO) at Ripple Labs. Furthermore, he noted that several DeFi protocols might be using security shortcuts to catapult the adoption rate.
If the DeFi space fails to implement stronger security measures, more hacks and funds loss in the near term could make this month the worst. Furthermore, security experts believe that North Korea-linked group TraderTraitor, which is a subset of the Lazarus Group, may be the bad actor stealing crypto users’ funds.
