DeFi's Brutal 2026: Over $840M Lost to Hacks as Kelp DAO and Drift Top the List
— By Whatsertrade in Crypto markets
2026 is among the worst years on record for DeFi security, with more than $840 million lost to hacks and over 40 protocols shutting down, led by the Kelp DAO and Drift exploits.
2026 is shaping up as one of the worst years on record for DeFi security, with more than $840 million lost to hacks and exploits and over 40 protocols shutting down, according to data compiled by altfins and CryptoTimes.
April was the worst month
April 2026 alone saw losses of roughly $606 million to $651 million across about 28 to 30 separate exploits, making it the most-hacked month in crypto history by incident count, per TheStreet and CryptoTimes.
The biggest hits: Kelp DAO and Drift
Two protocols accounted for nearly 88% of April's losses. Kelp DAO lost about $292 million on April 18; its rsETH cross-chain setup used a single-verifier (single-DVN) configuration that created a single point of failure. Drift Protocol on Solana lost about $285 million on April 1, and the root cause was not a smart-contract bug but a targeted social-engineering attack, according to analysis from Travers Smith.
What it means for users
The pattern is clear: exploits increasingly target configuration and human factors, not just code. Before interacting with any token or protocol, check its on-chain safety. DEXTools' Token Safety Checker flags honeypots, taxes, mint functions and contract verification, and the New Token Risk Index shows how many freshly launched tokens have negligible liquidity. This article is for information only and is not financial advice.