DeFi Hacks & Security Incidents — Risks, Exploits and Loss Analysis

As the decentralized finance (DeFi) ecosystem matures, one critical question continues to loom over institutional and retail participants alike: Just how insecure is DeFi? To answer this, we set out to quantify the true cost of DeFi exploits and compare it against the traditional finance (TradFi) banking system. By looking at the percentage of total value locked (TVL) lost to hacks year-over-year, we aimed to contextualize DeFi's risk landscape. However, comparing the bleeding edge of open finance to the heavily fortified walls of traditional banking proved to be as complex as the protocols themselves.

Here is a breakdown of our methodology, the challenges of comparing "apples to apples," and what the data tells us about the true risk premium of participating in DeFi.

Defining the Scope: What Constitutes a "DeFi Hack"?

DeFi is built on public blockchains, making it incredibly convenient to find "on-chain" data. Every transaction, exploit, and drained wallet is permanently recorded. However, the abundance of data creates a categorization problem: where do we draw the line between a broad crypto hack and a specific DeFi exploit?

For this analysis, we chose to be strict. We wanted to isolate the systemic risks of decentralized financial protocols themselves.

• What we excluded: We filtered out broad crypto hacks (such as the infamous 2016 TheDAO event), bridge exploits, centralized exchange (CEX) compromises, wallet drains, and financial losses stemming from user misuse (e.g., phishing).
• What we included: Only direct exploits of DeFi protocols.

Drawing this line isn't always uncontroversial. For instance, when analyzing the recent Drift protocol incident, Aave founder Stani Kulechov argued it shouldn't be categorized as a strictly "DeFi" hack. Despite this, we chose to include it in our dataset to maintain a conservative estimate of protocol risk. This constantly raises a methodological question for the industry: Should bridge hacks or user misuse be factored into the overall "DeFi risk profile," or do they belong in a separate security category? For now, we are keeping them separate to isolate protocol-level insecurity.

The Complexity of Calculating Lost Capital

Even when a hack is perfectly categorized, calculating the precise financial impact is notoriously difficult. On-chain theft is rarely a simple subtraction problem:

1. Partial Recoveries and Whitehats: In many cases, a portion of the stolen funds is returned to victims, either through negotiations with the hacker or via whitehat interventions. For example, during the 1inch Hack in March 2025, an exploiter drained approximately $5 million due to a vulnerability in outdated Fusion v1 smart contracts. Following negotiations, most of the funds were returned, with the hacker keeping a portion as a "white hat" bounty.
2. Insurance and Reimbursements: Sometimes deposits are insured, or the development teams step in to reimburse their users from treasury funds.
3. Delayed Restitutions: In rare instances, funds are returned or unlocked long after the initial exploit, shifting the historical data.
4. Interconnected Contagion: Because DeFi protocols are highly composable (the "money legos" effect), calculating the full downstream collateral damage of a single exploit can be staggering.
5. Gross vs. Net Losses: We did not analyze how much money was ultimately saved, returned, or repaid — we only used the headline values of the hacks. Real net losses may therefore be lower than the figures shown here.

Despite these variables, we aggregated data from open sources and established a year-by-year overview of assets lost in DeFi from 2020 to 2026. If you notice any discrepancies in our public data, we encourage you to contact us so we can refine our models.

The 2008 Outlier and the TradFi Average

To put traditional bank failures into perspective, consider the 2008 financial crisis. Our data shows that the collapse involved $373.6 billion of banking assets out of a $13.90 trillion system — about 2.7%. Most of those retail deposits were insured, but the true cost was felt indirectly through job losses, inflation, and taxpayer-funded bailouts.

When we zoom out, 2008 was a massive outlier. Based on FDIC's annual data, the long-run average of TradFi failures is much lower:

• From 2001 to 2025, the average annual share of system assets held by failing institutions is roughly 0.31%.
• The median annual share is a microscopic 0.02%, heavily weighted by years where no banks failed at all.
• The 2008 crisis (2.7%) was roughly 8.8x higher than the 2001–2025 average.

A crucial wording distinction: This 0.31% metric does not mean 0.31% of banking assets were destroyed or stolen every year. It means that 0.31% of system assets were held by institutions that went insolvent. Thanks to the FDIC, insured depositors were made whole. In DeFi, an exploit usually means the capital is mathematically gone.

Read the full story →