April was truly a dark month for the DeFi ecosystem, with losses from hacker attacks exceeding $600 million in just 18 days. Watching this series of events unfold, I realized that the risks in DeFi are far more complex than we thought.
Let's start with Drift Protocol. On April 1st, this leading perpetual contract trading platform on Solana was looted of $285 million in just 12 minutes. Many initially thought it was an April Fools' joke, but it turned out to be a real financial disaster. The most terrifying part is that the hackers spent half a year conducting social engineering infiltration, impersonating identities, meeting offline, and implanting malicious software on developer devices, ultimately successfully deceiving the team’s trust. This tells us a harsh truth: even the strongest smart contract audits cannot prevent human error. The hackers exploited management permissions and pre-signed transactions to drain multiple vaults, stealing USDC, WETH, and JLP.
Worse still, 12 days later, Hyperbridge cross-chain protocol was attacked again, with a loss of $2.5 million. The hackers exploited vulnerabilities in Merkle proof verification to artificially mint 1 billion virtual DOT tokens. This was just the prelude. The real storm came on April 18th, when the Kelp DAO cross-chain bridge was hacked, resulting in nearly $300 million in losses, far exceeding expectations.
The attacker exploited vulnerabilities in the LayerZero V2 cross-chain bridge, combined with RPC node infiltration and DDoS attacks, tricking the protocol into issuing 116.5k rsETH tokens worth $292 million. These un-backed tokens were used as collateral and deposited into Aave and Compound, borrowing $236 million in mainstream assets. Meanwhile, the ENS gateway was also hijacked via DNS hijacking. This series of events shows that hacker threats are not only from on-chain code but also from infrastructure vulnerabilities.
The most terrifying chain reaction occurred at Aave. Kelp DAO’s rsETH was heavily used in leveraged lending strategies, with users depositing LRT, borrowing ETH, and repeatedly exchanging for more LRT. When rsETH depreciated, this leverage behavior collapsed instantly. Aave faced bad debt estimates between $124 million and $230 million, with the utilization rates of USDT, USDC, and WETH soaring to 100%. Over 116.5k in funds fled Aave within 48 hours, and the entire DeFi market’s TVL evaporated by $13 billion.
I noticed an interesting phenomenon: when Aave’s USDC annual yield dropped to 2.61%, below the traditional broker’s 3.14%, everyone started fleeing. This reflects a shift in market sentiment, with the appeal of bearing smart contract risks significantly diminishing.
In response to this crisis, DeFi began making compromises. The Arbitrum security council froze 30.7k ETH from the attacker. Tether also cooperated with law enforcement to freeze $344 million USDT on the Tron chain. Aave successfully raised $243 million to cover the losses. While these actions were effective, they also sparked discussions about the ideals of decentralization versus reality.
From this disaster, the future direction of DeFi is clear: developers are shifting toward MPC wallets, ZK technology-driven cross-chain bridges, and more defensive verification systems. The dark April reminds us that pursuing high yields must be balanced with risk management. Security, decentralization, and usability need to evolve in tandem, or innovative achievements will face severe challenges. After this storm, my understanding of DeFi has deepened further.