lazarusgroup

While markets were watching $79,000 and the Iran ceasefire, something else happened in April that deserves serious attention.Crypto protocols lost over $606 million to hacks in just 18 days of April 2026, making it the worst month since February 2025's Bybit breach. The entire first quarter of 2026 saw $165.5 million in losses across a relatively quiet stretch. April's $606 million total arrived in under three weeks, making the month 3.7 times larger than Q1 combined and pushing 2026's year-to-date theft total to approximately $771.8 million across 47 separate incidents.
Two exploits account for nearly all of it. The $285 million Drift Protocol attack on April 1, later attributed to North Korea's Lazarus Group, and the $292 million KelpDAO breach on April 18, also linked to Lazarus, together represent roughly 95% of the month's losses and approximately 75% of everything stolen in crypto in 2026 so far.
The same state-sponsored hacking group behind both attacks. Different protocols. Different chains. Different vulnerability types. Same attacker.Beyond the dollar totals, the pace of attacks is accelerating in a way that concerns security researchers as much as the individual incident sizes. DeFi recorded 47 separate incidents in the first four and a half months of 2026, compared with 28 over the same period in 2025, a 68% year-over-year increase in attack frequency. The diversification of attack vectors means that technical audits and code reviews alone are no longer sufficient protection for protocols with significant TVL.
This is the part that most coverage misses. It's not just the dollar amounts. It's the shift in how protocols are being attacked. April's exploits cut across smart contract vulnerabilities, infrastructure attacks, and social engineering campaigns, including AI-driven attacks on wallets like Zerion. As crypto's cumulative hack losses have crossed $17 billion over the past decade, attackers are increasingly pivoting away from smart contract bugs toward private keys, signing infrastructure, and human-layer social engineering.
AI-driven social engineering attacks. That's new and it's serious. As protocols hardened their smart contract code through multiple audits, sophisticated attackers evolved to target the humans operating the infrastructure — developers with admin keys, bridge operators, multisig signers.Jefferies has warned the string of marquee hacks could temporarily slow Wall Street's appetite for DeFi tokenization projects. PowerDrillThis is where the institutional story intersects with the security story. BlackRock, Morgan Stanley, Stripe — they're all building infrastructure on or adjacent to DeFi rails. If $600M+ can be stolen in 18 days from protocols that were considered secure, institutional risk departments need new frameworks before they commit more capital."DeFi remains a niche market until risk can be properly priced," one analyst wrote.
That's the honest state of things. The technology is powerful. The security model isn't mature enough for the capital it's trying to hold. Both things are true simultaneously.
#CryptoHacks #DeFiSecurity #LazarusGroup #KelpDAO #CryptoSecurity

April 23, 2026
The numbers are in. They are catastrophic.
Crypto protocols have lost over $606 million to hacks and exploits in just the first 18 days of April 2026 making it the single worst month for theft in the industry since the $1.4 billion Bybit breach in February 2025.
Two attacks. Two names. Both point to the same culprit.

🔴 WHAT HAPPENED
The $285 million Drift Protocol attack on April 1st, and the $292 million KelpDAO breach on April 18th both later attributed to North Korea’s Lazarus Group together represent roughly 95% of April’s losses.
This wasn’t random. This was surgical.
Following the KelpDAO exploit alone, DeFi’s total value locked fell over 7% in 24 hours. Aave dropped from $26.4 billion to near $17.9 billion. Billions. Gone. Overnight.

🔥 WHY IT MATTERS
This isn’t just a bad month. The entire first quarter of 2026 saw just $165.5 million in losses. April’s total arrived in under three weeks making the month 3.7× larger than all of Q1 combined.
The pace is accelerating dangerously. DeFi recorded 47 separate incidents in the first 4.5 months of 2026, compared with 28 over the same period in 2025 a 68% year-over-year increase in attack frequency.

📉 MARKET REACTION
Panic. Institutional players are not waiting around. Institutional players responded with emergency rate limits and frozen bridge flows, while Jefferies warned the string of hacks could temporarily slow Wall Street’s appetite for DeFi tokenization projects.
$BTC is holding. Alts are bleeding. Risk-off mode is fully activated.

⚠️ MOST PEOPLE ARE MISSING THIS DETAIL…
Everyone is focused on the dollar amounts. But the real story is HOW they’re getting in.
April’s exploits cut across smart contract vulnerabilities, infrastructure attacks, AND social engineering campaigns including AI-driven attacks on wallets. The old playbook of “just get your code audited” is dead.
Lazarus Group is now deploying AI to target individuals. Your wallet. Your team. Your infra.
As one analyst put it bluntly: “DeFi remains a niche market until risk can be properly priced and right now, we’re far from it.”

🔮 WHAT HAPPENS NEXT
If even one more mid-size exploit hits before April 30th, the month’s total could approach $700 million.
The Clarity Act which could bring regulatory structure to protect DeFi looks like a lost cause for April, with a potential Senate committee hearing pushed into May at the earliest.
Meanwhile, the attackers are not slowing down.

The question isn’t whether your protocol will be targeted.
It’s whether you’ll still be solvent when it is. 🔒

#defi #KelpDAO #LazarusGroup #CryptoSecurity #BinanceSquare

🙄Hack A group of DPRK #hackers #LazarusGroup hacked a cold wallet on the exchange for 400k $ETH ($1.5 billion dollars)
Now they have more ether than Vitaliy Buterin, the creator of the token himself
😀The channels are already screaming that North Korea has announced a strategic reserve of ether😂

#BybitHack #BybitWalletHack