On April 1, 2026, at 16:05:18 UTC, an attacker submitted a transaction to Drift Protocol. One second later, another transaction approved it. Twelve minutes later, $285.00 million vanished. Seventeen days later, a compromised validator on the KelpDAO cross-chain bridge single-handedly minted $292.00 million in unbacked tokens and triggered an outflow of approximately $8.50 billion from Aave within 48 hours, with another $4.50 billion flowing out of other DeFi protocols. Twelve days after that, an attacker holding the stolen deployer private key siphoned off $4.50 million from Wasabi Protocol across four chains.

None of these incidents were due to the exploitation of smart contract vulnerabilities. For the better part of a decade, DeFi has been convinced that security is a code problem. Audits, formal verification, bug bounties—the entire industry has self-organized around the premise that as long as the smart contract logic is sound, the protocol is secure. Math is law. April 2026 was the month this premise collapsed in the public eye.

Over $625.00 million was stolen in a single month across approximately 30 incidents—according to DefiLlama, this is the worst month for crypto hacks in history by number of incidents—and every major loss traced back to admin private keys, cross-chain bridge validators, oracle blind spots, or social engineering attacks, all operational underbellies that audits were never designed to cover. This article is about that migration. We will dissect the three major April hacks into three faces of the same underlying failure, recap how a protocol’s misconfigured cross-chain bridge triggered a $13.20 billion outflow from a protocol 25x its size, and frankly examine what DeFi actually is now—open infrastructure with trusted operational leverage, even if the marketing doesn’t say so. The problem isn’t the math. The problem is the “mental model” around the math. The math isn’t broken. What’s broken is the mental model layered on top of the math, and the cost of this misalignment is forcing the industry to re-examine what “decentralization” really means.

I. The Mental Model Gap

For most of DeFi’s history, the prevailing security culture has been Solidity-based. Audits review contract logic. Bug bounties pay for re-entrancy, integer overflows, and access modifier errors. Formal verification proves invariants for on-chain code. The implicit assumption is that everything outside the contract—multi-sigs, deployer private keys, cross-chain bridge validators, Relayer infrastructure, team communication channels—is either out of scope or someone else’s problem. This assumption only holds when attackers are exploiting Solidity vulnerabilities.

The April 2026 hacks share a structural characteristic that audit reports cannot describe: the smart contracts themselves were not vulnerable. According to independent on-chain researchers, Drift’s code was audited by Trail of Bits in 2022 and by ClawSecure in February 2026, both of which passed. Neither audit covered Drift’s multi-sig configuration, durable nonce handling logic, or the social engineering attack surface around its Security Council. KelpDAO’s LayerZero adapter was standard OFT template code, and the contract itself had no issues. The error was in the deployment configuration, which is typically outside the scope of a standard Solidity audit. Wasabi’s Vault contract was designed to be upgradeable; the design itself was the vulnerability. What collapsed in April wasn’t the math, but the operational underbelly on which the math ran.

II. Three Autopsies: Three Faces of the Same Failure

The three major hacks of April 2026—Drift, KelpDAO, Wasabi—represent three distinct “non-code failures.” Together, they cover most of the new attack surface and share the same structural characteristic: in each incident, one or two compromised individuals or pieces of infrastructure had a domino effect on the entire protocol.

Drift: Human Multi-Sig ($285.00 million)

The Drift hack was an intelligence operation, not an exploit. The attackers were attributed by TRM Labs, Elliptic, and Drift itself with the assistance of SEAL 911 to the Lazarus Group of North Korea, specifically the UNC4736 sub-group, which Mandiant had previously linked to the Radiant Capital attack in October 2024. The attackers spent about half a year planning the operation. Social engineering began at industry conferences in the fall of 2025, while on-chain preparation began three weeks before the incident.

On March 26, Drift made a decision that proved disastrous in hindsight: migrating to a brand new 2-of-5 Security Council multi-sig with zero timelock. This migration eliminated the delay window that might have detected or intervened in the attack. On April 1, UTC 16:05:18, the attackers submitted the first pre-signed durable nonce transaction—a proposal to transfer admin control to address H7PiGqqUaanBovwKgEtreJbKmQe6dbq6VTrw6guy7ZgL. One second later, at UTC 16:05:19, the second pre-signed transaction approved and executed it. The attackers took over Drift.

KelpDAO: Single Validator ($292.00 million)

Seventeen days later, on April 18, the same type of threat actor profile produced a structurally completely different attack. KelpDAO is a liquidity re-staking protocol that issues rsETH—a token representing user deposits routed through EigenLayer to earn additional yield. By April 2026, rsETH had a TVL of over $1.00 billion and was deployed on over 20 chains via LayerZero’s OFT standard. The contract wasn’t the problem. The configuration was. KelpDAO’s cross-chain bridge ran on a 1-of-1 DVN—that is, with only one validator. One node was enough to approve a cross-chain message. “Decentralization” is a word, not an architecture.

Wasabi: Admin Private Key ($4.50 million)

The Wasabi hack on April 30 was an order of magnitude smaller than the other two, and therefore the most embarrassing. It was a “boring hack.” A deployer EOA held the ADMIN_ROLE in Wasabi’s perpetual contract manager deployed on the Ethereum, Base, Blast, and Bera chains. There was no multi-sig. The contract framework originally supported timelock, but the configuration value was zero. The attacker got hold of that private key and swept away the collateral and pool balances.

III. Asymmetric Dominoes

The KelpDAO incident is significant beyond its dollar amount because of what happened afterward—this was the first true stress test of DeFi composability under operational failure—and also the most telling example to date of how absurdly asymmetric the “math of contagion” can be. To put the scale in perspective: KelpDAO’s rsETH TVL was approximately $1.00 billion at the time of the incident; Aave’s AUM across all chains exceeded $25.00 billion. A protocol roughly 4% the size of Aave, with just one incident, drained $8.45 billion from Aave alone in 48 hours.

IV. The Truth of OpenFi

We’ve circled back to a conversation the industry has been avoiding. Let’s call it OpenFi: permissionless to enter, auditable on-chain, but operationally reliant on trusted third parties at the critical nodes where the original decentralization argument said intermediaries should be removed. By this definition, most of what is marketed as DeFi today is OpenFi. A Security Council with the power to transfer admin control. A cross-chain bridge with only 1-of-1 validators. A deployer EOA with cross-chain ADMIN_ROLE. Each is a patched “privileged seam” in an otherwise seamless system.

V. The Two-Sided Coin of Centralization

The core trade-off of OpenFi became glaringly obvious in the Arbitrum freeze incident. Three days after the KelpDAO vulnerability was exploited, Arbitrum’s Security Council voted to freeze 30,766 ETH—approximately $71.00 million—that the attacker had already transferred to Arbitrum One. The freeze was coordinated with law enforcement and, by most standards, was a good outcome: stolen funds were prevented from being laundered, the attacker’s downstream channels were shut down, and some user losses may even be recovered. But note what made this freeze possible: Arbitrum has a Security Council with the power to “reach into the chain and transfer funds.” This is not a feature of decentralized infrastructure. It is a centralized kill switch that exists by design.

VI. What Happens Next

The habit of industry cycles is to forget. Each four-year cycle reinvents the very institutions DeFi was supposed to replace, gets burned, briefly remembers why the principles existed, and then forgets again. Nothing that happened in April was unprecedented. It is the predictable end state of an industry that trades principles for convenience without naming the trade-off. Three decisions now face the industry, none of which can be postponed any longer: centralization, security, and capital allocation.

April 2026 was not a security crisis. It was the moment the industry’s mental model completely broke down, and the moment those protocols that can survive began to be distinguished from those that cannot.

[IOSG]