Latest Hack Pushes April Crypto Losses Over $600M

Just days after the Kelp DAO bridge was hit with a massive $293 million exploit, yet another protocol has been hacked.

While the amount stolen was comparatively small — just $3.5 million — there have been more than a dozen reported hacks/exploits this month alone. And it pushed the amount stolen over $600 million, with another eight days to go.

Decentralized finance (DeFi) protocol Volo said on April 22 that three of its vaults had been robbed, but that another $28 million in other vaults is safe. All funds have been frozen until Volo figures out what happened and how to prevent a recurrence.

“We want to be clear,” Volo said in the X post announcing the theft. “Volo is prepared to absorb this loss.”

Since then, it announced that it blocked $500,000 and has frozen another $1.5 million worth of stolen tokens. “These funds are no longer under hacker control,” Volo added.

Crypto analytics website DeFiLlama said that $16.5 billion has been stolen in hacks and exploits over the past decade.

An industry of clowns?

April began on a low note, with the April 1 hack of DeFi perpetuals exchange Drift Protocol, which lost $285 million to an exploit attack. Other notable heists include the Grinex exchange, which lost about $13 million, and Rhea Protocol, which lost more than $7 million.

“Are we an industry of clowns?” asked Michael Egorov, founder of major decentralized exchange Curve Finance, in an X post talking about the many single points of failure — protocols in which just one aspect must be compromised — baked into the crypto sector right now.

That’s what happened to Kelp DAO, which relied on a single messaging system as a “source of truth” to bridge tokens to and from other protocols. When this was compromised, a hacker was able to mint 116,500 restaked ether tokens worth $293 million and used them as collateral for loans, which will not be paid back.

The fallout from that hack rippled through the DeFi sector as the primary lending protocol used, Aave, saw a bank-run style series of withdrawals that forced it to freeze operations. Its bad debt could approach $230 million.