DeFi Sector Lost Nearly $800M in 2026 Due to Hacks: April Becomes Worst Month in History

• Analyst known as jussy_world stated that following the roughly $280 million exploit of Drift Protocol, another 12 protocols were attacked.
• According to his data, total losses from these incidents exceeded $450 million.
• Memento Research estimated total DeFi losses in 2026 at $795 million as of mid-April, calling April the worst month in DeFi history by losses.

Researchers noted that DeFi is facing a “persistent security crisis.” In January, the sector lost about $86 million due to smart contract bugs. February saw around $27 million in losses from bridge and oracle attacks. In March, another $52 million was lost due to exploits tied to stablecoin issuance and lending pools.

The largest losses occurred in April — about $630 million. Memento Research identified it as the worst month ever for DeFi by loss volume.

Losses from hacking attacks in the DeFi sector since the start of 2026. Infographic by Incrypted.

One of the largest incidents was the hack of Drift Protocol, which resulted in over $280 million in losses. Later, liquid restaking protocol KelpDAO suffered an attack that led to $293 million being stolen.

Some market participants linked the increasing complexity of attacks to the recent release by Anthropic (Mythos product), although no direct evidence was provided, researchers noted.

The report also included risk management recommendations: reconsider holding capital in DeFi protocols amid low yields, review wallet permissions, strengthen operational security, and avoid concentrating assets in a single market segment.

Analyst jussy_world added that in the past two weeks alone, 12 protocols were attacked following the Drift exploit. Since the beginning of the year, about 45 protocols have been affected, with total losses exceeding $450 million.

Among recent incidents, he highlighted the frontend hijack of CoW Swap, a forged message exploit in Hyperbridge (resulting in 1 billion tokens minted and price collapse), a $1 billion attack attempt on Bybit (blocked), $9.5 million laundered through KuCoin, and the compromise of over 2,000 accounts at Kraken via an insider extortion scheme.

He also mentioned several smaller incidents:

• smart contract bug in Dango ($410,000);
• oracle exploit in Silo V2 ($392,000);
• reserve manipulation in BSC TMM ($1.67 million);
• access control issues in Aethir and SubQuer (combined $480,000);
• token burn address exploit in MONA ($61,000);
• social engineering attack on Zerion ($100,000).

See also: "Hyperliquid Expands Its Share in the Perpetual Contracts Segment"

#DeFi tokens #crypto theft

Share: