April was brutal for DeFi. According to DefiLlama, losses across the month hit approximately $629.7 million. That figure spread across more than 25 protocols. Two incidents alone drove roughly 92% of the total number.
The rest still added up to tens of millions. Quietly. Across chains few people track closely.
Two Attacks Took Nearly Everything
Drift Protocol on Solana lost $285 million on April 1. The team disclosed the breach on X, confirming that funds were bridged out to Ethereum and NEAR. TRM Labs attributed the attack to UNC4736, a North Korean state-sponsored group. Chainalysis published a full post-mortem tracing how durable nonces were used against a compromised security council. Audits had passed. The breach was entirely operational.
KelpDAO followed on April 18. An attacker drained 116,500 rsETH through a LayerZero bridge running a 1-of-1 verifier configuration. One node. That was enough. Contracts were paused across chains. Halborn’s post-mortem and a Chainalysis breakdown both linked the incident to Lazarus Group activity. The loss came to $293 million.
Must Read: KelpDAO’s $292M Crisis Shows Why Crypto PR Wins
Combined, those two attacks account for 578 million dollars. Everything else across the month fills the remaining $51.7M.
Sui’s Six-Exploit Problem Nobody Can Ignore
Volo Vault lost $3.5 million on April 21. A private key compromise cleared three separate audits without detection. Recovery moved fast. Volo posted Recovery Update #6 on X on April 30, confirming all recovered funds now sit in a transparent wallet under volo.sui.
Scallop lost $150,000 on April 27. A bug had sat undetected in a deprecated contract for 17 months. Aftermath Finance was drained of $1.14 million on April 29 through a negative fee accounting flaw on Sui perpetuals. The attacker routed stolen funds directly to KuCoin. Aftermath paused the protocol and committed to full user compensation on X.
Three exploits. Single chain. Roughly two weeks.
Add Pawtato in January, Typus in October 2025, and Nemo in September 2025. The count reaches six. As @ourcryptotalk stated on X, “Six exploits from one ecosystem. A chain that requires heroic post-incident response every six weeks has already lost the plot. You cannot build a multi-year bull thesis on protocols that survive by reimbursing users out of pocket.”
That same account published a longer thread on X laying out why SUI may never reclaim its January 2025 all-time high of $5.35. The argument rests on tokenomics. 61% of all SUI stays locked. Between 42 and 53 million tokens unlock monthly through 2030. On April 1 alone, 53.4 million tokens entered circulation.
You Might Also Like: FBI: AI and Crypto Scams Drain Americans $21 Billion
SUI’s TVL peaked at $2.57 billion in late 2025. It collapsed to $573 million by March 2026. A 78% drop. Solana’s DeFi TVL sits above $10 billion today.
@Community_Sui on X put it plainly: “The tokenomics told a different story, working against the price and leading to a significant decline. We see this as a cautionary tale.”
Mid-Month Losses the Market Missed
Rhea Finance on NEAR lost $18.4 million on April 16 through a slippage and margin trading flaw. The team posted a detailed update on X confirming roughly $18 million recovered through user returns, Tether freezes, and ecosystem coordination. A $400,000 shortfall remains. The team committed to covering it.
Grinex, a sanctioned Russia-linked exchange, lost $15 million that same day. Hot wallet hack. Operations suspended immediately. Elliptic tracked fund movement through TRON and Ethereum. Reuters reported the exchange blamed foreign intelligence. No recovery followed.
Must Read: South Korea Wants Blockchain Running Government Money Now
Purrlend lost 1.5 million dollars on April 25 spanning HyperEVM and MegaETH. Attacker wallets were identified. GoPlus Security flagged the activity on X. No meaningful recovery was reported. Community voices called it a rug.
The Losses Nobody Reported
SweatEconomy lost roughly $3 million on April 29. Blockaid issued an alert on X with transaction details and flagged the attacker address. Hyperbridge lost $2.5 million on April 12 through a fake state proof attack. Aethir was drained of $423,000 on April 9 via an access control flaw.
Dango lost $410,000 on April 13. Silo V2 lost $392,000 on April 3 from a misconfigured oracle. BSC TMM/USDT lost $1.67 million on April 4 via reserve manipulation. Giddy lost $1.3 million. LML/USDT staking was drained of $950,000.
Zerion Wallet lost $100,000 on April 14 through a hot wallet compromise via social engineering. SubQuery Network lost $60,000 on April 12. Judao was hit for $228,000 on April 28 in a flashloan exploit. Singularity Finance lost $413,000. ZetaChain lost $300,000. Juicebox V3 lost $52,000 on April 20 through a borrowFrom spoof attack.
Every incident above is tracked on DefiLlama’s hacks dashboard.
You Might Also Like: The Crypto PR Race Has Changed. Has Your Strategy?
This article was created by News Coverage Agency, the best PR agency helping all firms get access to media. newscoverage.agency