Since April, a series of cryptocurrency security incidents have occurred, involving top-notch AI technology and North Korean hackers. DeFi faces its most dangerous period.

April 29 — April 2026 is shaping up to be the crypto industry’s worst month for losses since the $1.4 billion Bybit hack in February 2025. Data from DeFiLlama shows that as of April 18, 12 security incidents in just 18 days have resulted in over $606 million in losses—3.7 times the total losses reported in the first quarter of 2026. On April 1, Solana-based perpetual contract protocol Drift Protocol suffered a $285 million attack. The attacker infiltrated the team via social engineering starting in fall 2025, building trust with security council members over months to get them to pre-sign seemingly harmless transactions. They then executed two transactions (one second apart) to transfer permissions and drain liquidity. On April 18, the LayerZero cross-chain bridge for Ethereum liquidity rehypothecation protocol KelpDAO was breached, with 116,500 rsETH tokens (worth ~$292 million) stolen. The attacker—linked to the North Korean Lazarus Group’s TraderTraitor subunit—deposited the stolen funds into lending platforms like Aave, borrowing ~$190 million in real assets. This led to Aave facing over $123 million in defaults, and the DeFi ecosystem’s Total Value Locked (TVL) plummeted by more than $13 billion within 48 hours. Additionally, several smaller protocols faced security incidents in late April. While the losses were not large, industry confidence in DeFi security has taken a significant hit. For one, North Korean hackers have shifted from “technical challenges” to “human penetration.” The attack chain began with a fake Zoom meeting link, and AI is now actively deployed in social engineering tactics. For another, top AI models—led by Anthropic’s new Mythos model—have emerged as a game-changing variable tilting the offense-defense balance. The model’s enhanced general code reasoning capabilities let it autonomously find thousands of zero-day vulnerabilities (including a 27-year-old crash bug in OpenBSD) and chain multiple low-level flaws into complete attack chains. A more urgent risk is that much of the current DeFi ecosystem’s code was deployed before modern code reasoning models existed. Attackers can now use AI tools to systematically scan historical legacy configuration flaws at low cost, while defense-side AI auditing tools are not yet fully integrated. This “attackers leading with AI, defenders playing catch-up” gap is the most dangerous window right now.