North Korean Hackers Trigger $13 Billion Exodus from DeFi Protocols

The decentralized finance (DeFi) sector faced a severe security crisis in April, with protocols losing more than $606 million to exploits and hacks during the first 24 days of the month. This represents the most significant period of theft since the $1.4 billion Bybit breach in February 2025. The losses were primarily driven by two major attacks targeting ecosystem projects on the Solana and Ethereum networks. Intelligence suggests these operations were orchestrated by the North Korean-linked Lazarus Group, utilizing months of social engineering and shaping operations rather than technical code vulnerabilities to infiltrate the systems. The fallout triggered a massive flight of capital as investors sought safety. Aave saw more than $8.4 billion in deposits exit within 48 hours of the attack. Across the broader DeFi landscape, the total value locked (TVL) plummeted by over $13 billion, with Ethereum alone experiencing outflows of $1.6 billion on April 24. Despite the capital flight from DeFi applications, the underlying blockchain infrastructures of Ethereum and Solana were not compromised at the chain level. Market analysts suggest that while the loss of trust in third-party protocols is substantial, the core assets may remain viable long-term investments as the sector adapts its security frameworks and users shift toward cold storage solutions.