What happened with KelpDAO and Drift Protocol in April 2026?

KelpDAO and Drift Protocol were hit by major exploits that together drove nearly $600 million in losses during April 2026. KelpDAO lost about $292 million due to a bridge flaw, while Drift Protocol lost $285.2 million after a social engineering attack. These two incidents made up the majority of the $650 million total crypto losses for the month.

Why were April 2026 crypto losses so high?

April’s losses exceeded $650 million largely because of two large-scale attacks rather than a broad increase in smaller hacks. The KelpDAO and Drift incidents dominated the totals. This shows how a few high-impact exploits can skew monthly loss figures significantly. It also highlights ongoing vulnerabilities in major protocols.

How did the Drift Protocol hack happen?

The Drift Protocol exploit involved months of social engineering to gain access to protocol signers. Once access was secured, attackers drained funds in about 12 minutes. This type of attack targets human weaknesses rather than just code flaws. It shows that operational security is just as critical as smart contract security.

What caused the KelpDAO exploit?

KelpDAO’s $292 million loss was caused by a single-verifier flaw in a LayerZero bridge. This type of vulnerability allows attackers to bypass security checks in cross-chain transfers. After the exploit, attackers moved funds through THORChain, although some assets were frozen on Arbitrum. Bridge infrastructure remains a high-risk area in DeFi.

Which crypto sector was hit hardest in April?

Decentralised finance (DeFi) was the most affected sector, with losses of $609.3 million. This far exceeded losses in GameFi, meme tokens, and other categories. DeFi protocols often hold large amounts of capital, making them prime targets. The complexity of these systems also increases attack surfaces.

What were the main types of crypto attack vectors in April?

Wallet compromises were the largest attack vector, accounting for $611 million in losses. Other methods included price manipulation ($18.8 million), code vulnerabilities ($16.9 million), phishing ($3.5 million), and front-end attacks. This shows that user-level security breaches are still the biggest risk. Technical exploits remain important but secondary in this period.

How does this affect crypto investor confidence?

Large-scale hacks like these can weaken investor confidence, especially in DeFi platforms. Even if the broader market appears stable, security incidents can trigger caution among users and traders. This may slow capital inflows into affected sectors. However, markets often recover if no systemic risk is perceived.

Is this bad for DeFi adoption in the long term?

In the short term, repeated hacks can slow DeFi adoption by raising security concerns. However, they can also push the industry to improve infrastructure and auditing standards. Stronger security over time could make DeFi more resilient. This is a potential outcome, not guaranteed.

KelpDAO and Drift hacks drive $650M crypto losses

Written by Jon CuthbertPublished May. 3 2026Last Updated May. 3 2026

April 2026 saw more than $650 million in crypto losses, driven largely by major exploits affecting decentralised finance protocols despite otherwise stable market activity.

Blockchain security firm CertiK reported that two incidents alone, involving KelpDAO and Drift Protocol, accounted for nearly $600 million of total losses.

KelpDAO lost approximately $292 million due to a single-verifier flaw in a LayerZero bridge, while Drift Protocol suffered a $285.2 million exploit following prolonged social engineering targeting protocol signers.

The Drift attack unfolded over months and resulted in funds being drained within roughly 12 minutes, while KelpDAO attackers later routed stolen assets through THORChain after partial funds were frozen on Arbitrum.

Additional incidents included losses at Rhea Finance and Grinex, with total damage across smaller exploits contributing to the broader $650 million figure reported for the month.

DeFi protocols were the most affected sector, accounting for $609.3 million in losses, far exceeding unverified contracts, GameFi, bridge-related projects, and meme tokens.

Wallet compromises were the dominant attack vector at $611 million, followed by price manipulation, code vulnerabilities, phishing, and front-end exploits, highlighting persistent security risks across the ecosystem.