Back Bitget

DeFi Under Attack: Purrlend Loses $1,5 Million in Dual-Network Exploit

Bitget • April 26, 2026

The Purrlend decentralized lending protocol, built on HyperEVM, was hit by a vulnerability exploit that simultaneously affected two networks — HyperEVM and MegaETH — resulting in estimated losses of US$1,5 million.

The incident was initially reported by Kirby Ong, founder of HypurrCollective, who ed the community suspicious activity in the protocol's contracts.

Assets were drained from both networks in a coordinated manner. Approximately US$1,2 million left HyperEVM, while roughly US$325 was withdrawn from MegaETH.

Among the stolen tokens are nearly US$450 in USDC, US$214 in USDT0, and approximately US$195 in USDH. The attacker also took smaller amounts of encapsulated Bitcoin and native ecosystem tokens such as wstHYPE, kHYPE, WHYPE, and UETH.

Purrlend confirmed that it had identified irregular activity in the protocol and suspended operations while the team conducts internal investigations into the matter.

The attack on Purrlend adds to a series of incidents that have marked April as one of the most damaging months for the DeFi sector in 2025.

In just 18 days, more than $600 million was stolen from different protocols — a volume that puts April on track to surpass the impact of the $1,4 billion security breach suffered by Bybit in February of the same year.

A large portion of the losses is concentrated in attacks on KelpDAO and Drift Protocol, which together account for an estimated US$577 million in damages.

These episodes place decentralized finance under intense scrutiny, raising debates the security standards of protocols operating on -generation EVM networks.

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

JASMY Nears Decision Point as Triangle Tightens — 30% Upside in Sight?

Crypto Sector Remains Steady as Market Cap Hits $2.59T Amid Neutral Sentiment

Mike Novogratz says US CLARITY Act could pass in May

AVAX drops to $9.41 amid market fears and weak volume

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Purrlend Exploit: $1.5 Million Lost in Dual-Network Attack On April 25, 2026, the decentralized lending protocol Purrlend experienced a coordinated exploit affecting both HyperEVM and MegaETH networks, resulting in losses estimated at $1.5 million. The attack was first reported by Kirby Ong, founder of HypurrCollective, who noted suspicious activity in the protocol's contracts. Approximately $1.2 million was drained from HyperEVM, while MegaETH suffered losses of around $325,000. The stolen assets included significant amounts of USDC, USDT0, USDH, and various ecosystem tokens. Following the incident, Purrlend has paused all operations to investigate the breach. This incident is part of a troubling trend in April 2026, where over $600 million has been stolen from various DeFi protocols, raising concerns about security standards in the sector. The specific attack vector used in this exploit has not yet been disclosed, and users are advised to exercise caution across all connected platforms. 3 sources 65

Extracted Entities

Companies (6)

Bybit Drift Protocol HyperEVM KelpDAO MegaETH Purrlend