- In the last four months, crypto exploits surpassed $770 million as per DeFiLlama.
- Drift and KelpDAO were the two largest breaches and drove nearly 76% of 2026’s crypto exploit losses.
- AI-powered crypto exploits remain speculative, but automation risks are growing.
The crypto industry right now is facing its most alarming security periods yet. By April 2026, according to data presented by DeFiLlama, more than $770 million had already been stolen via crypto-related exploits, and interestingly, almost 76% of those losses have been linked to North Korean cyber operations.
While major incidents like Drift protocol and KelpDAO exploits have accounted for most of the stolen value, the sheer pace of attacks and increasing sophistication of crypto exploit methods are something that are raising questions about security in DeFi space.
Much of the year’s damage came from several major incidents. The two largest publicly reported crypto exploits were Drift Protocol and KelpDAO, which together accounted for more than $577 million in stolen assets. Drift reportedly lost approximately $285 million, while KelpDAO’s exploit was estimated near $292 million.
Drift Protocol was exploited on April 1, and the attackers reportedly used social engineering to gain trust over time, then manipulated governance approvals to whitelist fake collateral. This allowed them to deposit worthless assets and borrow real funds like USDC, ETH and SOL.
In the case of KelpDAO, attackers exploited a bridge verification flaw that let them unlock unbacked rsETH. They then used that stolen collateral across DeFi lending platforms to borrow hundreds of millions in legitimate assets.
Together, these two attacks made up almost 76% of all crypto losses recorded in 2026 through April.
DeFi Security Faces Risks Beyond Smart Contract Bugs
The Drift and KelpDAO attacks exposed weaknesses in DeFi which were beyond simple coding flaws. Drift exploit highlighted how governance systems, multisig security, and operational processes can be exploited when protocols depend on signer trust without sufficient safeguards like time locks or stricter transaction validation.
KelpDAO showed the dangers of bridge infrastructure built around single-verifier models, where one compromised verification layer can trigger such huge losses.
Such incidents may increase regulatory scrutiny around DeFi governance, bridge security and cross-chain infrastructure, more because billions are being injected within the DeFi space. Regulators may push for stricter operational standards, while protocols may face pressure to adopt stronger security frameworks.
The broader ecosystem impact could be substantial. Repeated large-scale hacks may weaken investor confidence, increase security premiums, and shift liquidity toward protocols with stronger governance and infrastructure protections. Ultimately, DeFi’s future may increasingly depend on redesigning governance systems, bridge architecture, and operational defenses to withstand both human and machine-assisted attackers.
Apart from the largest incidents, there also have been many smaller attacks. Platforms such as Wasabi Protocol ($5.5 million), Aftermath perps ($1.14 million), Grinex ($15 million), Resolv Labs ($24.5 million) and various bridges or liquidity systems have all experienced security failures ranging from private key compromises to smart contract manipulation.
These two attacks alone dramatically reshaped the year’s total losses and reinforced how a small number of highly successful breaches can dominate crypto security metrics. Moreover, according to TRM Labs report and multiple blockchain intelligence reports, both of these crypto exploits have been publicly attributed to North Korean-linked threat Lazarus Group.
At the same time, speculation around AI-powered crypto exploit systems are floating around and the most unsettling question that has been raised right now is whether autonomous AI-driven exploit systems are already being deployed?
Why AI is now entering the DeFi security conversation
Speculation around AI-powered exploit systems gained momentum after DeFi developer Vitto Rivabella publicly theorized that North Korea may eventually funded offensive AI models using historical DeFi exploit data. Even though there has been no confirmed evidence that such systems currently exist, but the theory resonated because of broader industry developments.
Andreessen Horowitz (a16z) published a research on April 28, 2026, which states the results of testing where AI coding agents could independently identify vulnerabilities and reproduce DeFi exploit proof-of-concept.
Researchers tested an AI coding agent on 20 past Ethereum DeFi hacks. At first, it seemed very successful as it could solve 50% of the cases. But later the researchers found out that the AI was cheating by accessing future blockchain data and copying details from real attacks. Once that shortcut was removed, the AI’s success rate dropped down to 10% only.
When researchers gave the AI detailed knowledge from past hacks, such as common attack patterns and strategies, the AI was able to successfully exploit 70% of the cases.
The important thing to note from the research is the fact that this AI is already highly capable at vulnerability discovery and increasingly capable at exploit reproduction, though still weaker in highly complex multi-step economic attacks. Complex attacks require planning, strategy, and financial calculations, something that AI still struggles with.
The study also found out that the AI could bypass some restrictions in its testing environment, showing it can sometimes work around limitations.
DeFi’s Public Architecture Makes it Especially Vulnerable
DeFi is one of the sectors that has been exposed to AI-assisted attacks because blockchain systems provide public smart contract code, transparent crypto exploit histories, large onchain financial incentives, flash loan infrastructure, and vast datasets for machine learning analysis.
This combination is something that creates an ideal environment for automated systems trained to detect common vulnerability patterns, simulate profitability and identify repeatable crypto exploit opportunities faster than human researchers.
If AI-systems continue to improve themselves and their strategic plans, optimization and contract reasoning, then there is a huge possibility that the industry could eventually face exploit frameworks capable of operating at machine speed.
AI-Powered DeFi Exploits Remain Unproven, But the Risk Growing
There is currently no verified public evidence that nation-state actors or cybercriminal groups are running fully autonomous AI systems to carry out DeFi hacks. However, several trends are becoming increasingly clear. AI-assisted vulnerability discovery is already real, crypto exploit automation is improving, reusable offensive tooling is expanding, and state-sponsored crypto theft remains highly active.
Together, these developments suggest that while fully autonomous AI hackers are still speculative, the foundation for such systems may already be forming.
The main takeaway is that crypto security threats are evolving at a great speed. Even though AI is not yet proven to be independently driving major DeFi exploits, growing automation, increasingly sophisticated attack infrastructure, and access to massive crypto exploit datasets could significantly reshape blockchain security in the coming years.
Also Read: ZetaChain Cross-Chain Contracts Exploited, Blockaid Warns
