DeFi Sector Under Siege: 12 Entities Compromised in Two-Week Attack Wave

The decentralized finance (DeFi) ecosystem is currently weathering a concentrated wave of security breaches, with at least 12 entities compromised since the start of April. This escalation in activity follows the April 1 exploit of the Drift Protocol, which resulted in a loss of approximately $280 million. Analysts suspect that North Korean-affiliated actors utilized a combination of social engineering and AI tools to infiltrate the protocol. Recent attacks have continued to hit the sector, with Rhea Finance and the Russia-linked Grinex exchange losing a combined $21 million over a 48-hour period. Rhea Finance reported a $7.6 million loss stemming from a pool manipulation attack on its Margin Trading feature, which misled the oracle and validation layers. Meanwhile, Grinex has suspended all operations following a $13.7 million theft, attributing the breach to 'unfriendly states.' Other platforms affected this month include the Binance Smart Chain TMM/USDT liquidity pool, which lost $1.67 million, as well as Aethir ($423,000), Dango ($410,000), and Silo Finance ($392,000). These incidents highlight a persistent vulnerability in smart contract configurations and oracle dependencies. The current volatility in security follows a challenging first quarter of 2026, during which data from DefiLlama indicates that over $168.6 million was stolen from 34 different DeFi protocols. The industry is now grappling with the reality that advancing AI models, such as those from Anthropic, could lower the barrier for attackers to execute complex exploits.