In just over two weeks following the $280 million Drift Protocol exploit on April 1, at least 12 crypto protocols and businesses have fallen victim to attacks. The affected platforms include CoW Swap, Hyperbridge, Bybit, Dango, Silo Finance, Aethir, MONA, Zerion, Rhea Finance, and the Grinex exchange. Notably, Rhea Finance and Grinex together suffered approximately $21 million in the most recent breaches.
The Drift Protocol exploit, suspected to involve North Korean-affiliated actors, marked the beginning of a month characterized by frequent and diverse crypto-targeted breaches. Rhea Finance reported a $7.6 million loss due to a vulnerability in its Margin Trading feature, where an attacker manipulated pools and misled the protocol's oracle. Meanwhile, the Russia-linked Grinex exchange lost $13.7 million and attributed the incident to "unfriendly states."
Earlier in April, Dango lost $410,000 from a smart contract bug, Silo Finance lost $392,000 due to a misconfigured oracle exploit, and Aethir lost $423,000 in an access control exploit. Both the Drift Protocol and Zerion exploits involved AI-assisted social engineering by DPRK-affiliated groups to extract credentials and funds.
According to reports, malicious actors stole more than $168.6 million from 34 DeFi protocols across the first quarter of 2026. The recent wave of attacks highlights the ongoing challenges in crypto security and the need for robust protective measures.