April 2026 saw a significant surge in crypto security breaches, making it the worst month on record since the large-scale Bybit hack in February 2025. Security firms CertiK and PeckShield reported a combined total of over $600 million lost across nearly 30 incidents. The majority of these losses stemmed from two major attacks. First, the Drift Protocol lost $285 million after a six-month social engineering campaign by North Korean hackers culminated in a swift exploit. Seventeen days later, Kelp DAO was hacked for $292 million when attackers bypassed the smart contract by overwhelming the system with traffic, forcing it to switch to a compromised backup and creating fake tokens. Multiple security experts, including TRM Labs and Elliptic, have linked both attacks to the Lazarus Group, a hacking organization associated with North Korea.