Crypto hacks hit record high in April 2026 — $1.8B drained

April set a new monthly record for stolen crypto. The DeFi side took 71% of it. Bridge exploits are back as the dominant attack class.

April 2026 set a new monthly record for stolen crypto: $1.8B drained across 47 incidents. DeFi protocols took 71% of the total; CEXes took 29%, mostly via social-engineering compromises rather than smart-contract bugs.

Bridge exploits are back as the dominant attack class. Three bridge incidents totaled $920M of the April loss; all three involved cross-chain message-verifier flaws that were known and disclosed but not patched in production. The audit-to-deploy gap is the structural problem.