Over $600 million lost in 18 days — the DeFi weakness Lazarus Group exploited
Why April Became Crypto's "Worst Hacking Month" in History
In April 2026, the crypto industry was hit by two massive hacks in just 18 days. On April 1, the Drift Protocol incident resulted in losses of roughly $285 million; on April 18, the KelpDAO incident cost approximately $292 million. Combined, the two attacks drained around $577 million, and both have been linked to the North Korea-affiliated hacking group known as Lazarus Group. The scale of the losses isn't the only notable factor. Neither attack exploited a "code bug" — instead, both took advantage of human trust, operational design, and structural weaknesses in bridges, exposing a deep-rooted problem across the industry.
