April's record 29 DeFi hacks cost $635 million. Almost none of it was the code.
The count says code bugs caused 83% of April's incidents. The dollars disagree, and the gap reveals where DeFi's actual security problem lives.
CryptoVibe Desk · defi · security · exploits
- →Per DL News, April 2026 set a record 29 crypto exploits with $635 million in reported losses, driven almost entirely by Drift's reported $285 million loss and Kelp DAO's roughly $292 million bridge exploit.
- →Code bugs caused 83% of April's incidents by count but only around 6.6% of losses; the record dollar damage came from compromised privileged access, bridge verification failure, and human-controlled trust boundaries that current audit scopes don't cover.
- →Watch whether major DeFi security firms publish methodologies that formally separate trust-surface risk from code-surface risk, treating admin key custody and bridge verifier sets as explicit audit categories rather than operational footnotes.
- Bridge verifier → The mechanism that confirms a message sent from one blockchain is legitimate before triggering an action on another chain, often controlled by a small set of operators whose compromise can drain funds on both sides regardless of how secure the contracts are.
- Admin key → A private cryptographic key held by a protocol team or multisig that grants privileged control over a smart contract, such as the ability to pause withdrawals, upgrade code, or change protocol parameters.
- Restaking → Depositing already-staked ETH or liquid staking tokens into additional protocols to earn extra yield, so the same underlying stake simultaneously secures multiple systems.
- Multisig → A wallet configuration that requires multiple private key holders to co-sign before any transaction executes, used by protocols to distribute admin control and reduce single-point-of-failure risk.
April 2026's 29 crypto exploits, the highest monthly count in DefiLlama's dataset per DL News, broke down this way: 24 incidents were code bugs; five were something else. The code bugs reportedly cost around $42 million in total. The five others reportedly cost roughly $593 million.
That inversion is the story, not the record count.
The two largest incidents account for almost all of the damage. Drift, a Solana-based perpetuals exchange, reportedly lost approximately $285 million in an attack that TRM Labs attributes to North Korean state-linked hackers. Kelp DAO, an Ethereum restaking protocol, reportedly lost roughly $292 million, equivalent to 116,500 rsETH, in a bridge exploit analyzed by Chainalysis. Combined, that's over $577 million, around 91% of April's total reported losses.
In engineering terms, this is the difference between a wide bug surface and a deep trust boundary failure.
Code bugs are bugs. They're exploitable because the code does something unintended, usually an edge case the developers didn't catch. They concentrate in smaller protocols with thinner security budgets. The losses are real, but they're bounded by the TVL in the affected contracts.
What took down Drift and Kelp DAO is a different failure class. The attack surface that produced over 90% of April's dollar losses isn't primarily contract code. It's the privileged-access layer around the contracts: admin key configurations, bridge operator sets, upgrade authority wallets, and the humans who control them. These are the trusted execution boundaries of DeFi, and they mostly sit outside the scope of what auditors review.
Bridge verifiers are the clearest example of how this gap works. A bridge exploit isn't usually a bug in the vault contract. It's a compromise of the verification mechanism that confirms a cross-chain message is legitimate before acting on it at the destination. A formally verified, triple-audited token contract on both sides of the bridge doesn't protect you if the verification layer can be spoofed or the operator set has a single weak link. The audit covers the application; the attack hits the trust infrastructure around it.
The supply chain attack is the right analogy. You harden the application, then someone compromises the build pipeline. The contract is clean; the keys to the upgrade proxy aren't.
Ronin in 2022 is the canonical version: audited contracts, a nine-of-nine validator multisig, Axie Infinity holding five of the nine keys. Not a code bug. A trust concentration problem dressed up as a decentralized system.
April's record incident count, dominated by small code-bug events across the long tail, creates statistical noise around where the actual money moved. The "24 of 29 were code bugs" figure is accurate and almost entirely misleading about the real risk surface.
The problem is structural. A standard smart-contract audit reviews the logic of the contracts in scope. Bridge verifier set composition, admin key custody arrangements, upgrade authority configuration, multisig threshold rationale: these are operational parameters by default, not audit categories. They appear in a footnote if they appear at all.
What engineers should actually be watching heading into Q3: whether any of the major DeFi security firms publish a methodology that formally separates trust-surface audit scope from code-surface audit scope, with bridge verifier configurations and admin key custody as named deliverables. Right now those live in the same document, or not at all. April just put a dollar figure on the cost of that gap.
The leading DeFi audit firms have treated bridge verifier sets and admin key custody as operational footnotes, not audit scope. That exclusion is the through-line in over 90% of April's dollar losses. They are not auditing DeFi's actual attack surface, and Drift and Kelp DAO's combined reported $577 million is now the cost of that choice on the record.
A leading DeFi security firm, Trail of Bits, OpenZeppelin, or Spearbit, publishing a formal methodology that treats trust-surface risk, covering bridge verifier set composition and admin key custody, as a distinct audit scope from code-surface risk, within the next two quarters.
Primary links and supporting reads used by the desk for this story.
Forward this.
