An attacker stole 116,500 rsETH (<button class="define-target" id="restaking">restaked</button> ether) from a blockchain bridge run by Kelp DAO. Based on prices at the time of the theft, the stolen tokens would be worth around $292&nbsp;million&nbsp;— however, the attacker is likely to face challenges selling a quantity of tokens that amounts to 18% of rsETH's circulating supply.<p>When tokens are bridged from one chain to another, the tokens on the original chain are locked in the bridge smart contract while the token is used on the other chain, preventing its owner from double-spending the asset. With 116,500 locked rsETH now stolen, those using the token on other blockchains are now holding possibly unbacked tokens.</p><p>The rush for holders to offload their dubiously backed tokens is likely to worsen contagion throughout defi protocols, where those platforms could be left holding the bag. Some platforms, including Aave, Lido Finance, and Ethena, have paused markets involving rsETH to try to protect themselves.</p><p>This hack has set the new record for the largest defi hack in 2026, following the $285&nbsp;million <a href="https://www.web3isgoinggreat.com/?id=drift-exploit" target="_blank">Drift exploit</a> on April 1.</p>

"2026's biggest crypto exploit: $292 million gets drained from Kelp DAO with wrapped ether stranded across 20 chains"

Kelp DAO hack

Kelp DAO bridge hacked for $292&nbsp;million

The Solana-based Drift <button class="define-target" id="defi">defi</button> <button class="define-target" id="perps">perpetual futures</button> exchange was exploited for $285&nbsp;million. The project alerted the community on social media, writing: "Drift Protocol is experiencing an active attack. ... This is not an April Fools joke."<p>The project later described the exploit as "a novel attack involving durable nonces, resulting in a rapid takeover of Drift's Security Council administrative powers." Once the attacker had access to admin capabilities, they quickly eliminated risk management limits on the protocol and drained huge quantities of tokens, which they swapped to USDC and then ETH. The attack was attributed to extremely sophisticated social engineering, likely by North Korean hackers.</p><p>Some have criticized USDC's issuer, Circle, for not <button class="define-target" id="freezing">freezing</button> the stolen funds during the six hours they were held in USDC. Unlike ETH, USDC is controlled by a centralized company that can, and regularly does, freeze assets determined to have been stolen or connected to illicit activity.</p><p>The theft is among the largest in defi history.</p>

"Drift says $280M exploit tied to 'sophisticated' admin takeover; ZachXBT criticizes Circle over USDC handling"

Drift exploit

Drift exploited for $285&nbsp;million

Rhea Finance's lending product was exploited for around $18.4&nbsp;million after an attacker took advantage of a bug in the platform's <button class="define-target" id="slippage">slippage</button> protection feature. The stolen assets affected both platform and user funds.<p>Some of the stolen tokens were returned by the attacker to the protocol, and around $4.35&nbsp;million USDT were frozen by its issuer, Tether. Altogether, around $10&nbsp;million was recovered, leaving $8.4&nbsp;million outstanding.</p>

Rhea Finance exploit

Rhea Finance exploited for $18.4&nbsp;million, some recovered

The Russian cryptocurrency exchange Grinex has halted trading after disclosing a hack of more than 1&nbsp;billion rubles (more than $13&nbsp;million). The exchange has claimed on Telegram that the hack was perpetrated by "foreign special services" they allege were trying to harm Russian financial independence.<p>According to blockchain intelligence firms TRM Labs and Chainalysis, Grinex is a rebranded version of the Garantex cryptocurrency exchange that was <a href="https://www.citationneeded.news/issue-79/#in-the-courts" target="_blank">shut down and sanctioned</a> in March 2025. Two of its operators were subsequently criminally charged in the US.</p>

"Russian Crypto Exchange Grinex Halts Trading, Alleging $13M Exploit by 'Western Special Services'"

"Sanctioned Russian Exchange Garantex Suspected of Rebrand as Grinex"

Grinex hack

Russian Grinex exchange halts trading after $13&nbsp;million+ exploit

After a fake version of the Ledger cryptocurrency wallet app made it onto the normally highly curated Apple App store, customers lost $9.5&nbsp;million dollars to the malicious product. Believing it was a genuine Ledger product, people entered their <button class="define-target" id="seed-phrase">seed phrases</button> into the app, then discovered their wallets were immediately drained.<p>One victim, a musician who goes by G. Love, wrote: "I lost my retirement fund in a hack/Scam when I switched my Ledger over to my new computer and by accident downloaded a malicious ledger app from the Apple store. All my BTC gone in an instant." According to him, he lost 5.9&nbsp;BTC (~$445,000).</p><p>Crypto sleuth zachxbt traced some of the stolen funds through Kucoin, a Chinese cryptocurrency exchange that was <a href="https://www.web3isgoinggreat.com/?id=kucoin-pleads-guilty" target="_blank">recently fined and forced to exit US markets</a> over licensing and anti-money laundering failures. "The three largest victims lost seven figures each," he wrote.</p><p>Apple removed the malicious app from their App Store on April 13, six days after it had been added.</p>


"A fake Ledger app on the Apple App Store drained $9.5 million in crypto"

Fake Ledger app

Users lose $9.5&nbsp;million to fake Ledger wallet app on the Apple App Store

Bitcoin ATM operator Bitcoin Depot has disclosed a March&nbsp;23 hack in which attackers stole 50.903&nbsp;BTC (~$3.67&nbsp;million) from company wallets. According to the company's disclosure with the SEC, the exploiters gained access to the company's IT systems and wallet credentials, allowing them to steal the assets.<p>Bitcoin Depot is the largest operator of crypto ATMs globally and in the United States, with approximately 8,700 kiosks in the US and 9,200 worldwide.</p>

 filed by Bitcoin Depot Inc. on April 6, 2026

Bitcoin Depot hack

Bitcoin Depot hacked for $3.67&nbsp;million

On April Fools' Day, the Hyperbridge blockchain <button class="define-target" id="bridge">bridge</button> project posted a tweet claiming that the North Korean Lazarus hacking group had drained $37&nbsp;million from the project. A linked blog post contained a Rickroll GIF and an explanation of "Why Hyperbridge can't be hacked".<p>The following day, a Hyperbridge developer posted a screenshot of a blockchain transaction, writing "Lmao the uniBTC exploiter is testing Hyperbridge. I hope you have a quantum computer bro". Another commenter replied, "Rule #1 dont actively provoke attackers".</p><p>About two weeks later, an attacker was able to forge a transaction to change the admin rights for the Polkadot/Ethereum bridge contract, allowing them to mint 1&nbsp;billion DOT tokens. They were able to cash out about $2,500,000 due to limited liquidity.</p><p>The April Fools' posts have since been deleted.</p>

"Hyperbridge exploited less than two weeks after April Fools’ day hack prank"

Hyperbridge exploit

Hyperbridge exploited two weeks after April Fools' hack joke

Users who visited the website for the CoW Swap DEX aggregator on April 14 were unknowingly redirected to a malicious website that drained their crypto wallets. An attacker was able to socially engineer CoW Swap's domain registrar, allowing them to redirect visitors to a malicious site for a period of several hours. CoW Swap has estimated that people who used the service during that time lost around $1.2&nbsp;million.

Event	Date	Amount More info	Recovered More info
Kelp DAO hack	April 18, 2026	$292,000,000
Drift exploit	April 1, 2026	$285,000,000
Rhea Finance exploit	April 16, 2026	$18,400,000	$10,000,000
Grinex hack	April 16, 2026	$13,000,000
Fake Ledger app	April 13, 2026	$9,500,000
Bitcoin Depot hack	April 6, 2026	$3,665,000
Hyperbridge exploit	April 13, 2026	$2,500,000
CoW Swap DNS hijacking	April 14, 2026	$1,200,000