April 2026 brought Bitcoin's first significant recovery after a prolonged decline, but it also highlighted serious security risks in crypto infrastructure. Two major exploits hit Drift Protocol and KelpDAO, triggering questions about the responsibilities of stablecoin issuers and service providers. Meanwhile, an investigation into a counterfeit Ledger Nano S+ showed that crypto users can be exposed to risk before they even connect a wallet to the blockchain.

Bitcoin ended April almost 12% higher

According to historical BTC/USDT data from Binance, Bitcoin rose from approximately $68,284 at the start of April to $76,347 at the April 30 close. That represented an 11.81% monthly gain, with an intramonth peak near $79,486. The 14% figure in some early commentary therefore did not match the final calendar-month return.

The rebound encouraged speculation about renewed retail interest, but price performance alone does not establish that the market had entered a full FOMO phase. Historical Crypto Fear & Greed data placed April's average near 23, still a low reading despite improving sentiment toward month-end. Expectations of a breakout above $90,000 remained forecasts; Bitcoin did not reach that level during April.

Historical May seasonality offers no guarantee of further gains. Average returns change with the selected sample and methodology, and one strong month after a sell-off does not by itself confirm the start of a sustained bull market.

Drift Protocol lost an estimated $280–285 million after months of preparation

On April 1, Solana-based decentralized exchange Drift Protocol lost approximately $285 million in assets. According to a Chainalysis review of the exploit, the attackers obtained administrative powers using pre-signed transactions built around Solana's durable nonce mechanism. They then used an artificially valued collateral token to withdraw real assets from the protocol.

Drift's investigation described a much longer operation than a typical smart-contract exploit. In reporting published on April 5, the suspected attackers had posed as a quantitative trading firm for about six months, met contributors in person and placed more than $1 million of their own capital into an ecosystem vault. Those steps helped establish the appearance of a legitimate partnership.

Drift and security investigators linked the operation with actors believed to have ties to North Korea. As described at the time, this was an investigative attribution, not a final judicial determination of the perpetrators' identity.

KelpDAO lost approximately $292 million through a cross-chain bridge

On April 18, attackers released 116,500 rsETH from KelpDAO's infrastructure, worth approximately $292 million at prevailing prices. According to LayerZero's preliminary statement, the incident involved manipulated data supplied to the cross-chain message verification system and a configuration relying on a single verifier, known as a 1-of-1 DVN setup.

A forged message caused the bridge to release tokens without a corresponding confirmed token burn on the source chain. An April 20 report by Aave service providers documented how the assets moved into lending protocols and affected collateral-backed positions. KelpDAO paused parts of its infrastructure, while related markets restricted activity to reduce further risk.

The two exploits had different mechanisms. Drift involved the compromise of administrative authority; KelpDAO involved a weakness in cross-chain verification. Both exposed the risks of placing critical functions in the hands of infrastructure components that may fail outside a protocol's core smart contracts.

Why Circle faced criticism after the Drift exploit

Following the attack, on-chain investigator ZachXBT alleged that roughly $232 million in USDC moved from Solana to Ethereum through Circle's Cross-Chain Transfer Protocol in more than 100 transfers over approximately six hours. He criticized Circle for not freezing the funds. That accusation did not, by itself, establish that the issuer was under a legal obligation to freeze the specific addresses immediately.

Circle CEO Jeremy Allaire defended the company's approach, saying asset freezes should follow requests from law enforcement authorities or courts. In his view, allowing private firms to decide unilaterally when to freeze customer assets without proper legal grounds raises serious concerns.

In mid-April, affected investors filed a class-action lawsuit against Circle, alleging that its failure to intervene allowed the stolen USDC to move. Filing a claim does not establish legal liability: the issuer's obligations and potential responsibility remain questions for the courts.

Tether proposed a Drift recovery package

On April 16, Tether announced a joint user recovery plan with Drift. The proposal included up to $127.5 million from Tether and another $20 million from other partners, for a combined potential total of $147.5 million. This was roughly half the estimated loss, but a proposed funding framework should not be confused with individual compensation already paid out.

In Drift's official recovery update, the package formed part of a broader effort to restore user funds and relaunch the protocol. Detailed payment conditions and final distribution had not yet been established. It would therefore be premature to say that Tether had already reimbursed half of all losses.

Counterfeit Ledger Nano S+: what researchers found

In mid-April, a security researcher published an analysis of a counterfeit Ledger Nano S+ on Reddit, purchased through a Chinese marketplace. The device contained an ESP32-S3 microcontroller instead of the expected security hardware, and locally stored generated recovery phrases and PINs in plain text. The seller also offered a modified app impersonating Ledger Live, creating a route for sensitive-data theft.

In a follow-up clarification, the researcher confirmed that the genuine Ledger Live application from the official website rejected the counterfeit during its Genuine Check. This is an important distinction: the case did not demonstrate that the fake device could bypass Ledger's actual cryptographic authenticity test. A single investigated product also does not establish that an entire marketplace's inventory was counterfeit.

How to reduce the risk of hardware wallet fraud

Ledger recommends buying directly or through authorized resellers and running Genuine Check using the official Ledger Wallet app (formerly Ledger Live), obtained from ledger.com. Do not use a device that fails the check or asks for a recovery phrase to be entered into an app, website or support chat. A genuine Ledger never requires users to type their 24 recovery words on a computer.

The authenticity check verifies the identity of the device's secure element, but it cannot detect every conceivable physical modification to genuine hardware. The retailer's reliability therefore remains a meaningful additional layer of protection.

What these events mean for affiliates and crypto payments

For affiliate networks, media buyers and payment providers, April's main lesson concerned operational security. Choosing a wallet or settlement infrastructure requires more than comparing fees and liquidity: teams also need to understand emergency freezing procedures, protocol audits, key storage and employee access controls. A Bitcoin rally cannot offset funds lost through a compromised device or an exploited service.

April 2026 brought Bitcoin's first significant recovery after a prolonged decline, but it also highlighted serious security risks in crypto infrastructure. Two major exploits hit Drift Protocol and KelpDAO, triggering questions about the responsibilities of stablecoin issuers and service providers. Meanwhile, an investigation into a counterfeit Ledger Nano S+ showed that crypto users can be exposed to risk before they even connect a wallet to the blockchain.

Bitcoin ended April almost 12% higher

According to historical BTC/USDT data from Binance, Bitcoin rose from approximately $68,284 at the start of April to $76,347 at the April 30 close. That represented an 11.81% monthly gain, with an intramonth peak near $79,486. The 14% figure in some early commentary therefore did not match the final calendar-month return.

The rebound encouraged speculation about renewed retail interest, but price performance alone does not establish that the market had entered a full FOMO phase. Historical Crypto Fear & Greed data placed April's average near 23, still a low reading despite improving sentiment toward month-end. Expectations of a breakout above $90,000 remained forecasts; Bitcoin did not reach that level during April.

Historical May seasonality offers no guarantee of further gains. Average returns change with the selected sample and methodology, and one strong month after a sell-off does not by itself confirm the start of a sustained bull market.

Drift Protocol lost an estimated $280–285 million after months of preparation

On April 1, Solana-based decentralized exchange Drift Protocol lost approximately $285 million in assets. According to a Chainalysis review of the exploit, the attackers obtained administrative powers using pre-signed transactions built around Solana's durable nonce mechanism. They then used an artificially valued collateral token to withdraw real assets from the protocol.

Drift's investigation described a much longer operation than a typical smart-contract exploit. In reporting published on April 5, the suspected attackers had posed as a quantitative trading firm for about six months, met contributors in person and placed more than $1 million of their own capital into an ecosystem vault. Those steps helped establish the appearance of a legitimate partnership.

Drift and security investigators linked the operation with actors believed to have ties to North Korea. As described at the time, this was an investigative attribution, not a final judicial determination of the perpetrators' identity.

KelpDAO lost approximately $292 million through a cross-chain bridge

On April 18, attackers released 116,500 rsETH from KelpDAO's infrastructure, worth approximately $292 million at prevailing prices. According to LayerZero's preliminary statement, the incident involved manipulated data supplied to the cross-chain message verification system and a configuration relying on a single verifier, known as a 1-of-1 DVN setup.

A forged message caused the bridge to release tokens without a corresponding confirmed token burn on the source chain. An April 20 report by Aave service providers documented how the assets moved into lending protocols and affected collateral-backed positions. KelpDAO paused parts of its infrastructure, while related markets restricted activity to reduce further risk.

The two exploits had different mechanisms. Drift involved the compromise of administrative authority; KelpDAO involved a weakness in cross-chain verification. Both exposed the risks of placing critical functions in the hands of infrastructure components that may fail outside a protocol's core smart contracts.

Why Circle faced criticism after the Drift exploit

Following the attack, on-chain investigator ZachXBT alleged that roughly $232 million in USDC moved from Solana to Ethereum through Circle's Cross-Chain Transfer Protocol in more than 100 transfers over approximately six hours. He criticized Circle for not freezing the funds. That accusation did not, by itself, establish that the issuer was under a legal obligation to freeze the specific addresses immediately.

Circle CEO Jeremy Allaire defended the company's approach, saying asset freezes should follow requests from law enforcement authorities or courts. In his view, allowing private firms to decide unilaterally when to freeze customer assets without proper legal grounds raises serious concerns.

In mid-April, affected investors filed a class-action lawsuit against Circle, alleging that its failure to intervene allowed the stolen USDC to move. Filing a claim does not establish legal liability: the issuer's obligations and potential responsibility remain questions for the courts.

Tether proposed a Drift recovery package

On April 16, Tether announced a joint user recovery plan with Drift. The proposal included up to $127.5 million from Tether and another $20 million from other partners, for a combined potential total of $147.5 million. This was roughly half the estimated loss, but a proposed funding framework should not be confused with individual compensation already paid out.

In Drift's official recovery update, the package formed part of a broader effort to restore user funds and relaunch the protocol. Detailed payment conditions and final distribution had not yet been established. It would therefore be premature to say that Tether had already reimbursed half of all losses.

Counterfeit Ledger Nano S+: what researchers found

In mid-April, a security researcher published an analysis of a counterfeit Ledger Nano S+ on Reddit, purchased through a Chinese marketplace. The device contained an ESP32-S3 microcontroller instead of the expected security hardware, and locally stored generated recovery phrases and PINs in plain text. The seller also offered a modified app impersonating Ledger Live, creating a route for sensitive-data theft.

In a follow-up clarification, the researcher confirmed that the genuine Ledger Live application from the official website rejected the counterfeit during its Genuine Check. This is an important distinction: the case did not demonstrate that the fake device could bypass Ledger's actual cryptographic authenticity test. A single investigated product also does not establish that an entire marketplace's inventory was counterfeit.

How to reduce the risk of hardware wallet fraud

Ledger recommends buying directly or through authorized resellers and running Genuine Check using the official Ledger Wallet app (formerly Ledger Live), obtained from ledger.com. Do not use a device that fails the check or asks for a recovery phrase to be entered into an app, website or support chat. A genuine Ledger never requires users to type their 24 recovery words on a computer.

The authenticity check verifies the identity of the device's secure element, but it cannot detect every conceivable physical modification to genuine hardware. The retailer's reliability therefore remains a meaningful additional layer of protection.

What these events mean for affiliates and crypto payments

For affiliate networks, media buyers and payment providers, April's main lesson concerned operational security. Choosing a wallet or settlement infrastructure requires more than comparing fees and liquidity: teams also need to understand emergency freezing procedures, protocol audits, key storage and employee access controls. A Bitcoin rally cannot offset funds lost through a compromised device or an exploited service.

April 2026 brought Bitcoin's first significant recovery after a prolonged decline, but it also highlighted serious security risks in crypto infrastructure. Two major exploits hit Drift Protocol and KelpDAO, triggering questions about the responsibilities of stablecoin issuers and service providers. Meanwhile, an investigation into a counterfeit Ledger Nano S+ showed that crypto users can be exposed to risk before they even connect a wallet to the blockchain.

Bitcoin ended April almost 12% higher

According to historical BTC/USDT data from Binance, Bitcoin rose from approximately $68,284 at the start of April to $76,347 at the April 30 close. That represented an 11.81% monthly gain, with an intramonth peak near $79,486. The 14% figure in some early commentary therefore did not match the final calendar-month return.

The rebound encouraged speculation about renewed retail interest, but price performance alone does not establish that the market had entered a full FOMO phase. Historical Crypto Fear & Greed data placed April's average near 23, still a low reading despite improving sentiment toward month-end. Expectations of a breakout above $90,000 remained forecasts; Bitcoin did not reach that level during April.

Historical May seasonality offers no guarantee of further gains. Average returns change with the selected sample and methodology, and one strong month after a sell-off does not by itself confirm the start of a sustained bull market.

Drift Protocol lost an estimated $280–285 million after months of preparation

On April 1, Solana-based decentralized exchange Drift Protocol lost approximately $285 million in assets. According to a Chainalysis review of the exploit, the attackers obtained administrative powers using pre-signed transactions built around Solana's durable nonce mechanism. They then used an artificially valued collateral token to withdraw real assets from the protocol.

Drift's investigation described a much longer operation than a typical smart-contract exploit. In reporting published on April 5, the suspected attackers had posed as a quantitative trading firm for about six months, met contributors in person and placed more than $1 million of their own capital into an ecosystem vault. Those steps helped establish the appearance of a legitimate partnership.

Drift and security investigators linked the operation with actors believed to have ties to North Korea. As described at the time, this was an investigative attribution, not a final judicial determination of the perpetrators' identity.

KelpDAO lost approximately $292 million through a cross-chain bridge

On April 18, attackers released 116,500 rsETH from KelpDAO's infrastructure, worth approximately $292 million at prevailing prices. According to LayerZero's preliminary statement, the incident involved manipulated data supplied to the cross-chain message verification system and a configuration relying on a single verifier, known as a 1-of-1 DVN setup.

A forged message caused the bridge to release tokens without a corresponding confirmed token burn on the source chain. An April 20 report by Aave service providers documented how the assets moved into lending protocols and affected collateral-backed positions. KelpDAO paused parts of its infrastructure, while related markets restricted activity to reduce further risk.

The two exploits had different mechanisms. Drift involved the compromise of administrative authority; KelpDAO involved a weakness in cross-chain verification. Both exposed the risks of placing critical functions in the hands of infrastructure components that may fail outside a protocol's core smart contracts.

Why Circle faced criticism after the Drift exploit

Following the attack, on-chain investigator ZachXBT alleged that roughly $232 million in USDC moved from Solana to Ethereum through Circle's Cross-Chain Transfer Protocol in more than 100 transfers over approximately six hours. He criticized Circle for not freezing the funds. That accusation did not, by itself, establish that the issuer was under a legal obligation to freeze the specific addresses immediately.

Circle CEO Jeremy Allaire defended the company's approach, saying asset freezes should follow requests from law enforcement authorities or courts. In his view, allowing private firms to decide unilaterally when to freeze customer assets without proper legal grounds raises serious concerns.

In mid-April, affected investors filed a class-action lawsuit against Circle, alleging that its failure to intervene allowed the stolen USDC to move. Filing a claim does not establish legal liability: the issuer's obligations and potential responsibility remain questions for the courts.

Tether proposed a Drift recovery package

On April 16, Tether announced a joint user recovery plan with Drift. The proposal included up to $127.5 million from Tether and another $20 million from other partners, for a combined potential total of $147.5 million. This was roughly half the estimated loss, but a proposed funding framework should not be confused with individual compensation already paid out.

In Drift's official recovery update, the package formed part of a broader effort to restore user funds and relaunch the protocol. Detailed payment conditions and final distribution had not yet been established. It would therefore be premature to say that Tether had already reimbursed half of all losses.

Counterfeit Ledger Nano S+: what researchers found

In mid-April, a security researcher published an analysis of a counterfeit Ledger Nano S+ on Reddit, purchased through a Chinese marketplace. The device contained an ESP32-S3 microcontroller instead of the expected security hardware, and locally stored generated recovery phrases and PINs in plain text. The seller also offered a modified app impersonating Ledger Live, creating a route for sensitive-data theft.

In a follow-up clarification, the researcher confirmed that the genuine Ledger Live application from the official website rejected the counterfeit during its Genuine Check. This is an important distinction: the case did not demonstrate that the fake device could bypass Ledger's actual cryptographic authenticity test. A single investigated product also does not establish that an entire marketplace's inventory was counterfeit.

How to reduce the risk of hardware wallet fraud

Ledger recommends buying directly or through authorized resellers and running Genuine Check using the official Ledger Wallet app (formerly Ledger Live), obtained from ledger.com. Do not use a device that fails the check or asks for a recovery phrase to be entered into an app, website or support chat. A genuine Ledger never requires users to type their 24 recovery words on a computer.

The authenticity check verifies the identity of the device's secure element, but it cannot detect every conceivable physical modification to genuine hardware. The retailer's reliability therefore remains a meaningful additional layer of protection.

What these events mean for affiliates and crypto payments

For affiliate networks, media buyers and payment providers, April's main lesson concerned operational security. Choosing a wallet or settlement infrastructure requires more than comparing fees and liquidity: teams also need to understand emergency freezing procedures, protocol audits, key storage and employee access controls. A Bitcoin rally cannot offset funds lost through a compromised device or an exploited service.

April 2026 brought Bitcoin's first significant recovery after a prolonged decline, but it also highlighted serious security risks in crypto infrastructure. Two major exploits hit Drift Protocol and KelpDAO, triggering questions about the responsibilities of stablecoin issuers and service providers. Meanwhile, an investigation into a counterfeit Ledger Nano S+ showed that crypto users can be exposed to risk before they even connect a wallet to the blockchain.

Bitcoin ended April almost 12% higher

According to historical BTC/USDT data from Binance, Bitcoin rose from approximately $68,284 at the start of April to $76,347 at the April 30 close. That represented an 11.81% monthly gain, with an intramonth peak near $79,486. The 14% figure in some early commentary therefore did not match the final calendar-month return.

The rebound encouraged speculation about renewed retail interest, but price performance alone does not establish that the market had entered a full FOMO phase. Historical Crypto Fear & Greed data placed April's average near 23, still a low reading despite improving sentiment toward month-end. Expectations of a breakout above $90,000 remained forecasts; Bitcoin did not reach that level during April.

Historical May seasonality offers no guarantee of further gains. Average returns change with the selected sample and methodology, and one strong month after a sell-off does not by itself confirm the start of a sustained bull market.

Drift Protocol lost an estimated $280–285 million after months of preparation

On April 1, Solana-based decentralized exchange Drift Protocol lost approximately $285 million in assets. According to a Chainalysis review of the exploit, the attackers obtained administrative powers using pre-signed transactions built around Solana's durable nonce mechanism. They then used an artificially valued collateral token to withdraw real assets from the protocol.

Drift's investigation described a much longer operation than a typical smart-contract exploit. In reporting published on April 5, the suspected attackers had posed as a quantitative trading firm for about six months, met contributors in person and placed more than $1 million of their own capital into an ecosystem vault. Those steps helped establish the appearance of a legitimate partnership.

Drift and security investigators linked the operation with actors believed to have ties to North Korea. As described at the time, this was an investigative attribution, not a final judicial determination of the perpetrators' identity.

KelpDAO lost approximately $292 million through a cross-chain bridge

On April 18, attackers released 116,500 rsETH from KelpDAO's infrastructure, worth approximately $292 million at prevailing prices. According to LayerZero's preliminary statement, the incident involved manipulated data supplied to the cross-chain message verification system and a configuration relying on a single verifier, known as a 1-of-1 DVN setup.

A forged message caused the bridge to release tokens without a corresponding confirmed token burn on the source chain. An April 20 report by Aave service providers documented how the assets moved into lending protocols and affected collateral-backed positions. KelpDAO paused parts of its infrastructure, while related markets restricted activity to reduce further risk.

The two exploits had different mechanisms. Drift involved the compromise of administrative authority; KelpDAO involved a weakness in cross-chain verification. Both exposed the risks of placing critical functions in the hands of infrastructure components that may fail outside a protocol's core smart contracts.

Why Circle faced criticism after the Drift exploit

Following the attack, on-chain investigator ZachXBT alleged that roughly $232 million in USDC moved from Solana to Ethereum through Circle's Cross-Chain Transfer Protocol in more than 100 transfers over approximately six hours. He criticized Circle for not freezing the funds. That accusation did not, by itself, establish that the issuer was under a legal obligation to freeze the specific addresses immediately.

Circle CEO Jeremy Allaire defended the company's approach, saying asset freezes should follow requests from law enforcement authorities or courts. In his view, allowing private firms to decide unilaterally when to freeze customer assets without proper legal grounds raises serious concerns.

In mid-April, affected investors filed a class-action lawsuit against Circle, alleging that its failure to intervene allowed the stolen USDC to move. Filing a claim does not establish legal liability: the issuer's obligations and potential responsibility remain questions for the courts.

Tether proposed a Drift recovery package

On April 16, Tether announced a joint user recovery plan with Drift. The proposal included up to $127.5 million from Tether and another $20 million from other partners, for a combined potential total of $147.5 million. This was roughly half the estimated loss, but a proposed funding framework should not be confused with individual compensation already paid out.

In Drift's official recovery update, the package formed part of a broader effort to restore user funds and relaunch the protocol. Detailed payment conditions and final distribution had not yet been established. It would therefore be premature to say that Tether had already reimbursed half of all losses.

Counterfeit Ledger Nano S+: what researchers found

In mid-April, a security researcher published an analysis of a counterfeit Ledger Nano S+ on Reddit, purchased through a Chinese marketplace. The device contained an ESP32-S3 microcontroller instead of the expected security hardware, and locally stored generated recovery phrases and PINs in plain text. The seller also offered a modified app impersonating Ledger Live, creating a route for sensitive-data theft.

In a follow-up clarification, the researcher confirmed that the genuine Ledger Live application from the official website rejected the counterfeit during its Genuine Check. This is an important distinction: the case did not demonstrate that the fake device could bypass Ledger's actual cryptographic authenticity test. A single investigated product also does not establish that an entire marketplace's inventory was counterfeit.

How to reduce the risk of hardware wallet fraud

Ledger recommends buying directly or through authorized resellers and running Genuine Check using the official Ledger Wallet app (formerly Ledger Live), obtained from ledger.com. Do not use a device that fails the check or asks for a recovery phrase to be entered into an app, website or support chat. A genuine Ledger never requires users to type their 24 recovery words on a computer.

The authenticity check verifies the identity of the device's secure element, but it cannot detect every conceivable physical modification to genuine hardware. The retailer's reliability therefore remains a meaningful additional layer of protection.

What these events mean for affiliates and crypto payments

For affiliate networks, media buyers and payment providers, April's main lesson concerned operational security. Choosing a wallet or settlement infrastructure requires more than comparing fees and liquidity: teams also need to understand emergency freezing procedures, protocol audits, key storage and employee access controls. A Bitcoin rally cannot offset funds lost through a compromised device or an exploited service.