DeFi Sets New Hack Record as April Logs 28 Exploits with $635M Stolen

Why It Matters

The surge underscores that operational and human‑factor vulnerabilities now dominate DeFi risk, demanding broader security strategies beyond code audits. It also signals state‑backed actors leveraging advanced tools, raising systemic concerns for the broader crypto ecosystem.

Key Takeaways

• April saw 28 DeFi exploits, $635M stolen
• Kelp DAO bridge hack cost $293M, linked to North Korea
• Drift Protocol loss $285M, also DPRK‑attributed
• AI tools increasingly aid attackers in reconnaissance and social engineering
• DeFi United raised $300M to restore rsETH backing after Kelp hack

Pulse Analysis

April marked the most violent month on record for decentralized finance, with 28 separate breaches draining $635 million from vulnerable protocols. While earlier hack cycles were dominated by smart‑contract bugs, this surge was driven by operational failures: forged bridge messages, compromised multisig keys, and fake‑collateral schemes. The two headline incidents – Kelp DAO’s $293 million bridge exploit and Drift Protocol’s $285 million drain – alone accounted for 91 percent of the total loss, illustrating how a single point of failure can devastate the ecosystem.

Analysts increasingly point to artificial intelligence as a force multiplier for attackers. North‑Korean groups, identified by TRM Labs, appear to be integrating frontier AI models into reconnaissance, automating the identification of under‑maintained contracts and crafting persuasive social‑engineering lures. This AI‑assisted approach enables rapid, low‑cost targeting of projects that have not updated their code in months, as seen in the Sweat Foundation breach. The convergence of state‑backed resources and cutting‑edge AI tools raises the bar for threat actors, making traditional code audits insufficient on their own.

The industry’s reaction has been swift but fragmented. The DeFi United coalition mobilized over $300 million to restore the backing of rsETH, signaling a willingness to pool resources in crisis. Yet experts like Certora’s Seth Hallem argue that a holistic, company‑wide threat‑modeling mindset is essential. Future resilience will depend on integrating security into governance, multi‑sig processes, and bridge design, while continuously monitoring AI‑driven threat intelligence. As operational vectors dominate, the next wave of defenses must evolve beyond code reviews to encompass people, processes, and technology.