The total losses of the decentralized finance sector (DeFi) in 2026 have already exceeded $795 million as of mid-April. According to analysts, April has become the worst month in DeFi history in terms of losses from hacking attacks and exploits.
This is reported by Business • Media
Major Attacks and Causes of Losses
Experts believe that the DeFi sector is in a state of “constant security crisis.” In January 2026, vulnerabilities in smart contracts resulted in losses of about $86 million. In February, the main causes were attacks on cross-chain bridges and oracles, leading to losses of $27 million. March brought an additional $52 million in losses due to exploits related to stablecoin issuance and lending pools.
The sector suffered the biggest blow in April, when total losses reached approximately $630 million. Researchers at Memento Research note that DeFi has not experienced such large-scale losses in any previous month.
Experts stated that DeFi is undergoing a “constant security crisis.”
Among the most notable incidents is the hack of the decentralized exchange Drift Protocol, resulting in losses of over $280 million. Similarly, the liquid restaking protocol KelpDAO was attacked, leading to the theft of $293 million. According to an analyst using the pseudonym jussy_world, immediately after the Drift exploit, another 12 protocols fell victim to attacks, with total losses in these incidents exceeding $450 million. Since the beginning of the year, about 45 protocols have been targeted.
Recent Incidents and Expert Recommendations
Recent events include the frontend takeover of CoW Swap, an exploit involving fake messages in Hyperbridge that led to the issuance of a billion tokens and a collapse in their price, a $1 billion exploit attempt on Bybit (which was timely blocked), laundering of $9.5 million through KuCoin, and the compromise of over 2000 accounts on Kraken due to an insider extortion scheme.
Less significant attacks include:
- a bug in the Dango smart contract with losses of $410,000;
- an oracle exploit in Silo V2 for $392,000;
- reserve manipulation in BSC TMM for $1.67 million;
- access control issues in Aethir and SubQuer with total losses of $480,000;
- an exploit of the token burn address in MONA for $61,000;
- a social engineering attack on Zerion that caused losses of $100,000.
The Memento Research team recommends that DeFi users reconsider the feasibility of storing capital in such protocols with low profitability, carefully check the permissions of crypto wallets, enhance operational security, and avoid concentrating all assets in one market segment.
It is noted that part of the market associates the increase in attack complexity with the release of the Mythos tool from Anthropic. However, at this time, researchers have no direct evidence of such a connection.
It was previously reported that total losses from crypto fraud in 2025 exceeded $11.3 billion.
