On Saturday 18 April 2026, a forged cross-chain message released 116,500 rsETH, a restaked ether token, from a bridge contract on Ethereum to an attacker. That bridge route had a single verifier. The attacker deposited 89,567 of those tokens on Aave and borrowed 82,650 WETH against them, leaving a hole that an incident report co-written by Aave’s service providers modelled at 124 to 230 million dollars. Aave’s code never failed: “Aave’s smart contracts were not compromised at any point during this event“, the report says.
One event, and at least four kinds of DeFi risks in it: a bridge that accepted a false message, a token worth less than its price feed said, a lender exposed to someone else’s failure, and depositors tied to a verifier they had never looked up. A reader who asks only “was it audited?” would have seen none of that coming.
Seven families of risk make up the map below, each with a dated case and what you can check before depositing. The lesson on how to build and track a DeFi portfolio sorted positions into risk tiers; this one opens those tiers up.
Is DeFi safe? An honest answer before the map
No, not in the sense a bank deposit is safe. DeFi has no deposit guarantee, no one who can reverse a transaction on your behalf and no help desk with a duty to answer. It is also not a casino: large protocols have run for years, and losses cluster around identifiable weaknesses, many of which can be checked in advance. Part of the risk can be reduced. Part of it cannot.
The useful question about DeFi risks is therefore narrower: which way can this particular position fail, and would I notice beforehand? Scams are their own subject: a rug pull, where the team itself takes the money, is a deliberate fraud that the rest of this map does not describe, and our guide to avoiding crypto scams covers it.
What the loss figures say, and what they leave out
The public hacks dataset of DefiLlama, read on 1 November 2026, is the most detailed free count. The table below keeps DeFi targets only (protocols, chains, liquidity pools, tokens and a few smaller categories) and excludes centralised exchanges, individual wallets and unclassified entries. That sorting is ours, not DefiLlama’s, and the dataset is revised over time. Amounts are valued at the time of the event and do not subtract funds later returned.
| Year | DeFi losses (million dollars) | DeFi incidents | Of which bridge hacks (million dollars) |
|---|---|---|---|
| 2021 | 2,468 | 118 | 656 |
| 2022 | 2,884 | 168 | 1,906 |
| 2023 | 848 | 165 | 301 |
| 2024 | 814 | 195 | 37 |
| 2025 | 768 | 129 | 38 |
| 2026 (to 1 November) | 1,676 | 296 | 753 |
The bridge column counts every hack DefiLlama flags as a bridge hack. Only in 2021 does a part of it, about 8 million dollars, fall outside our DeFi filter.
Losses fell by more than two thirds from the 2022 peak and stayed near 800 million dollars for three years. Then 2026 broke the pattern, with ten months already at more than twice the 2025 figure. Four events make up most of it: Liquid Network (320 million), Drift (295 million), Kelp (293 million) and Tectonic (124 million). Bridges, which looked like an old problem in 2024 and 2025, are back at 753 million.
These are gross amounts, and Tectonic shows how far gross can sit from final. The Cronos post-mortem reported by The Block counts 120.4 million dollars borrowed on 30 August 2026, then a rollback of the whole chain that discarded 1 hour 54 minutes of history. About 9.19 million dollars had already left Cronos and stayed unrecovered.
For scale, 1.7 billion dollars is about 2 percent of the 85.1 billion dollars of total value locked that DefiLlama showed on 1 November 2026. That is our own arithmetic, and a rough one, since staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">TVL moves daily and losses fall on a few pools, never evenly. On a losing position the rate is close to 100 percent, or nothing.
Other counts use other scopes, so they should never be added together. Chainalysis counted over 3.4 billion dollars stolen across all of crypto from January to early December 2025, exchanges included, with Bybit alone at 1.5 billion and North Korean groups at no less than 2.02 billion. It also observed that hack losses have stayed well below their old level even as DeFi TVL recovered.
Those tables understate DeFi risks in one respect. They record thefts. A stablecoin that loses its peg, a fund manager who loses money off-chain or a rule that changes do not appear, and those are three of the seven families below.
Contract risk: the code does what it says, not what you assumed
A smart contract executes its rules with no exceptions. If a rule is wrong, the wrong result is final. This is the risk people think of first, and its shape has changed.
Reentrancy and access control, the older bugs
Reentrancy, in which a contract is called back before it has updated its balance, is the classic: The DAO fell to it in 2016. By value it is now minor. DefiLlama lists four reentrancy incidents in 2025 for 44.6 million dollars, most of that GMX V1 on 9 July 2025 (42 million, of which DefiLlama shows 40 million returned after a bounty deal), and two in 2026 for almost nothing. Access control errors, where a function that should be restricted can be called by the wrong party, remain common.
Rounding and accounting errors, the modern bug
On 3 November 2025, at about 07:40 UTC, Composable Stable Pools of Balancer V2 were attacked. OpenZeppelin puts the loss at more than 120 million dollars across Balancer and its forks; DefiLlama records 128 million for Balancer V2. The cause fits in a sentence: a scaling function always rounded down, whichever way a swap ran. In ordinary use the difference is dust. The attacker pushed pools down to very low balances and repeated many small swaps until the dust became real money.
OpenZeppelin had reviewed earlier versions of Balancer V2 in 2021, and it says the vulnerable code arrived after its audit: “OpenZeppelin’s prior audits did not cover any of those pools presenting this attack vector”. An audit describes one version of the code on one date. It says nothing about what was added next. DefiLlama files this case under token and share accounting, with Cetus on Sui in the same family: about 223 million dollars lost to an overflow bug on 22 May 2025, of which 162 million was frozen on the network.
Oracles and flash loans in one paragraph
Many protocols depend on a price from outside the contract. How oracles are built and attacked has its own lesson; the short version is that a contract reading a thin market can be fed a false price. A flash loan lets anyone borrow huge sums for one transaction, which makes such attacks cheap. DefiLlama’s oracle category shows many incidents with small sums: 18 for 33 million dollars in 2025 and 42 for 75 million so far in 2026. Tectonic falls near the line. DefiLlama files it as a donation attack, while The Block’s account starts with the attacker driving up the thinly traded TONIC token that served as collateral.
What you can check
Compare the audit’s commit and scope with the code actually deployed, look at how long that code has held real money without incident, see whether it can be upgraded and by whom, and check for a live bug bounty. Reading an audit report gets a full lesson later in this path.
Economic risk: when the collateral is not worth what it says
Here nothing is hacked. The contracts run as designed and the numbers they rely on turn out to be wrong.
Depeg and bad debt: Aave after Kelp
The rsETH episode is the clearest recent case. The service providers’ incident report of 20 April 2026 set out two scenarios. If losses were shared evenly across all rsETH, the token would be worth about 15 percent less and Aave would carry about 123.7 million dollars of bad debt. If they fell only on the rsETH held on layer 2 networks, the figure would be about 230.1 million, with no effect on Ethereum Core but a 71 percent WETH shortfall on Mantle. The depositor’s loss therefore hung on a decision made by another team about another token.
The funding plan shows how far the problem spread. A proposal posted on the Aave forum on 24 April put the shortfall behind rsETH at about 120,015 ETH after Kelp’s freeze, and a residual gap of about 75,081 ETH once expected recoveries were counted. To close it, the plan named donations (14,570 ETH at that point), a credit line of up to 30,000 ETH from Mantle and a request for 25,000 ETH from the Aave treasury. The same text warned that its central-case numbers “are not guaranteed” and that the path to making users whole was “not risk-free”. By 12 May, The Block reported, the “DeFi United” effort had raised over 300 million dollars in ETH and Kelp expected to reopen withdrawals. Rescue by peers happened here. Nothing obliged anyone to provide it.
Stream Finance and xUSD, November 2025
Late on 3 November 2025, Stream Finance said an external fund manager had reported a loss of about 93 million dollars, and it suspended deposits and withdrawals. xUSD, its yield token, fell to about 26 cents within a day, down 77 percent according to Decrypt. The research group Yields and More identified nearly 285 million dollars of direct debt exposure across lenders. An Arbitrum forum assessment of 7 November described a run on redemptions, about 15 million dollars of bad xUSD debt on Silo and lending markets where borrowed amounts exceeded the value of the xUSD collateral. Stream hired the law firm Perkins Coie; the reports we read do not establish how the loss occurred.
A token named like a dollar and priced like a dollar had an off-chain fund behind it. The lesson for a depositor is to ask what backs the token, how fast it can be redeemed, and how much of a market rests on one issuer.
Liquidation spirals and funding
Falling collateral triggers forced sales, which push prices lower and trigger more sales. How liquidations work and how cascades form is covered in detail, including Black Thursday and October 2025. Funding is the quieter cousin: strategies that earn perpetual funding rates lose that income, or start paying, when the rate turns negative.
You can check what backs a token, how concentrated its collateral is, what caps a market applies and what reserves stand in front of depositors.
Governance risk: whoever holds the votes or the keys holds the treasury
A protocol that can be changed can be changed badly. Governance tokens and capture explains the politics. The three cases here cost real money.
Voting power bought for a moment: Beanstalk, 2022
On 17 April 2022 an attacker borrowed about a billion dollars in stablecoins through flash loans, gained voting power and passed a malicious proposal through an emergency function with more than 78 percent of the vote, above the two-thirds threshold. CertiK put the loss at about 182 million dollars, and the attacker’s take at about 76 million in its summary. Voting power could be borrowed and used inside one transaction, so the attacker never had to own a stake.
A low quorum and no delay: BonkDAO, July 2026
The recent case needed no flash loan. According to Halborn, a proposal filed on 30 June 2026 and presented as a reward for voters contained a clause sending 4.43 trillion BONK from the treasury to the attacker. Quorum was about 1 percent of supply. The attacker spent about 4.4 million dollars on tokens to reach it, controlled about 99.9 percent of votes cast, with only six other wallets taking part, and the transfer ran as soon as voting closed because no timelock existed. DefiLlama dates it 6 July and values it at 20 million dollars.
Keys and admin power: Drift, April 2026
One of the three largest DeFi losses of 2026 involved no contract bug. On 1 April 2026 the Solana perpetuals exchange Drift lost at least 270 million dollars by an early CoinDesk count, and 295 million by DefiLlama’s. Drift’s Security Council, a multisig, needed two approvals out of five. Solana’s durable nonces let a signed transaction stay valid until someone submits it, and the attacker had collected two pre-signed approvals, which Drift called “unauthorized or misrepresented transaction approvals”. About a minute after a legitimate test withdrawal, the attacker submitted them.
An incident report by Nexus Mutual adds that a council migration on 27 March left a zero-timelock configuration, which removed the delay in which anyone could have reacted. Drift said on 3 June that Mandiant “conclusively attributed the attack to UNC6862, a North Korean threat group“. No audit of the code would have shown any of this.
Before depositing, find out who can upgrade the contracts, what the multisig threshold is, how long admin actions wait, whether an emergency path skips that wait, how low quorum is and how concentrated the token is.
Bridge risk: a message that lies
Bridges and cross-chain liquidity have their own lesson. For this map, one idea is enough: a token on a second chain is a claim, and its value depends on whoever verifies that the matching asset is locked on the first chain. If that verification lies, unbacked tokens appear, and they look identical to real ones.
Kelp is the case. LayerZero said on 19 April 2026 that Kelp’s setup used “a 1-of-1 DVN setup, with LayerZero Labs as the sole verifier“, and that attackers compromised two RPC nodes its verifier relied on, then used a denial-of-service attack to force it onto them. It called the Lazarus Group the likely culprit, attribution that remains unproven in court, and said it had recommended several verifiers. Kelp replied on 20 April that the setup reflected LayerZero’s documented default configuration, one LayerZero had confirmed as appropriate. LayerZero told CoinDesk that Kelp “deployed multiDVN and then manually downgraded to a 1/1”. On 8 May LayerZero conceded “We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions“, while keeping its view that developers answer for their own security settings. Who bears the blame stays disputed. A depositor in an Aave WETH market carried that setting without ever having chosen it.
Bridge risk also covers the software under a federation. On 6 September 2026 at 13:53 UTC, an attacker exploited a bug in the Liquid sidechain, which a federation runs. The assessment published by Blockstream describes a cache of verified proofs whose key was built without separators between fields, so a crafted transaction matched an earlier entry and skipped the real check. About 4,000 L-BTC came into being with no bitcoin behind them, and the federation released 3,996 BTC from a reserve of about 4,205. The attacker returned 3,400 BTC the next day. “Approximately 602 BTC remain outstanding”, Blockstream wrote in that assessment. DefiLlama values the event at 320 million dollars.
The classics in DefiLlama’s table are of the same family: Ronin (23 March 2022, 624 million dollars, validator keys), Binance Bridge (6 October 2022, 570 million, a proof verifier bug), Wormhole (2 February 2022, 326 million, a flaw in signature verification; Jump Crypto replaced the 120,000 ETH) and Nomad (1 August 2022, 190 million, forged proofs). The stories belong to a later lesson on hacks.
You can check how many independent verifiers a bridge uses, who runs them, whether the wrapped asset’s reserve is public, and how much of your position depends on that single token.
Counterparty risk: who is really on the other side
DeFi is sold as removing the middleman. Often it only moves that person out of sight: to the vault that takes the other side of a trade, the fund that runs a strategy or the legal entity that holds a real-world asset.
Perpetual liquidity vaults: Hyperliquid and JELLY
On 26 March 2025, a large short on the JELLYJELLY token was liquidated onto the HLP vault of Hyperliquid as the price rose, leaving depositors facing a potential loss of about 12 million dollars. Validators voted to delist the contract and settled it at 0.0095 dollars, the price at which the short had opened. HLP ended about 700,000 dollars up, and the Hyper Foundation said it would reimburse most users, excluding flagged addresses. HYPE fell as much as 22 percent that day. Depositors escaped the loss because validators overrode the market, and that decision was the controversy. If you hold a vault share, you are the counterparty of its worst trade, and the rules can change while you are in it.
Real-world assets and off-chain managers
A tokenised treasury fund does not hold its assets on-chain. Your token is a claim on an issuer or a special purpose vehicle, and through it on a custodian and on a set of redemption terms. Issuers such as Securitize and Ondo Finance sit at that point in the chain, and their terms set who may redeem, and when. A smart contract cannot enforce any of that if the legal entity fails or refuses. Stream, above, is the off-chain manager version of the same risk.
Check who holds the assets, under which jurisdiction, what the redemption terms and notice periods are, and who runs the strategy behind a yield.
User risk: you can sign away what no hacker could reach
Self-custody moves the last line of defence to your own screen.
Signature phishing comes first. A drainer site asks you to approve a transaction that hands over your tokens. Scam Sniffer counted 83.85 million dollars lost in 2025, down 83 percent from 494 million in 2024, across 106,106 victims, or about 790 dollars each by our arithmetic. It tracks phishing-site drainers on EVM chains and leaves out other methods. Attackers also began exploiting EIP-7702 account features soon after Ethereum’s Pectra upgrade.
Unlimited approvals are the second. Many apps ask to spend any amount of a token, forever, because it saves a transaction later. The approval outlives your visit. If that contract is later exploited, or the approval went to a malicious one, the tokens can leave your wallet without any new signature. Limiting and revoking approvals belongs to the security routine lesson later in this path.
Address poisoning is the third. On 3 May 2024 a holder sent 1,155 WBTC, about 68 million dollars, to a look-alike address. The attacker had copied the first and last six characters of the real address and planted a fake transaction in the victim’s history, trusting that nobody reads the middle of a 42-character string. On 10 May the attacker sent back about 22,960 ETH, worth 65.7 million dollars and over 96 percent of the original dollar value, according to Cointelegraph. That was the result of negotiation, and nobody should plan on it.
Size does not protect anyone. DefiLlama classes the theft from the exchange Bybit on 21 February 2025 as signer phishing: professional signers approved a transaction that was not the one they believed they were approving. Chainalysis puts personal wallet compromises at 713 million dollars in 2025, 20 percent of the value stolen, against about 1.5 billion and 44 percent in 2024. Fewer dollars, but it counted 158,000 theft incidents and at least 80,000 victims.
The checks are dull and they work: read what the wallet says you are signing, compare whole addresses, never copy one from your history, send a small test first and review your approvals.
Regulatory risk: the law moves, and protection never followed you here
The safety nets of ordinary finance do not apply. The FDIC states that deposit insurance does not apply to crypto assets. Asked whether SIPC protects non-security crypto assets held at a member broker-dealer, SEC staff answer “No”. SIPC cover attaches to securities entrusted to a member broker-dealer, which a position in a DeFi contract is not. In the United Kingdom, the FCA’s statement says cryptoassets “are not FSCS protected“.
Rules also change, and the EU is the live example. Recital 22 of MiCA says services provided in a “fully decentralised manner without any intermediary” should fall outside its scope, and the EBA and ESMA noted in January 2025 that the regulation does not say how to read “fully decentralised”. In its response to the Commission of 30 September 2026, ESMA warned of “decentralisation washing”, said the exemption “should be as narrow as possible” and proposed a regulated “gatekeeper” service for firms that give clients access to DeFi. That is a proposal, not law. If adopted, it would bear on which firms can offer you access to DeFi and what they must disclose.
Sanctions can move in both directions. The US Treasury sanctioned Tornado Cash in August 2022, and on 21 March 2025 it said it had “exercised our discretion to remove the economic sanctions“. Courts can also reach funds: The Block reported in May 2026 that the ether frozen after the Kelp theft could go to Aave but could not be sold or moved without court approval, because of a restraining order sought by plaintiffs holding terrorism judgments against North Korea. A later lesson in this path covers MiCA, the SEC, the CFTC and US court cases in detail.
Check where a front end operates, whether any authorised entity stands behind what you are using, and how your tax authority treats the operation. Unclear status is a risk in itself.
DeFi risks in one table
| Risk | What breaks | Dated example | What you can check |
|---|---|---|---|
| Contract | A rule in the code is wrong or incomplete | Balancer V2, 3 November 2025: over 120 million dollars | Audit scope against deployed code, age of the code, bug bounty |
| Economic | Collateral or a stablecoin is worth less than assumed | Aave after Kelp, April 2026: 123.7 to 230.1 million dollars modelled; xUSD, November 2025 | What backs the token, concentration, caps, reserves |
| Governance and keys | A vote or a small group of signers moves the funds | Drift, 1 April 2026: 270 to 295 million dollars; BonkDAO, July 2026: 20 million | Upgrade rights, multisig threshold, timelock, quorum, emergency paths |
| Bridge | The message that mints or releases funds is false | Kelp, 18 April 2026: about 293 million dollars; Liquid, 6 September 2026: 320 million | Number and independence of verifiers, public reserves |
| Counterparty | The party behind the product fails or changes the rules | Hyperliquid HLP, 26 March 2025: 12 million dollars at risk; Stream, November 2025: 93 million | Who holds the assets, custody, redemption terms |
| User | You approve or send the wrong thing | Address poisoning, 3 May 2024: 68 million dollars; signature phishing in 2025: 83.85 million | What you sign, full addresses, approvals |
| Regulatory | The rules change, or protection never applied | ESMA proposal, 30 September 2026; Tornado Cash sanctions, 2022 to 2025 | Where the front end operates, authorised entities, tax treatment |
How the risks stack: a fictional position, labelled as an example
Take a fictional position, for illustration only and not as a suggestion. Someone deposits 10,000 dollars of a yield-bearing stablecoin in a lending vault on a layer 2 network. The vault lends against a restaked ether token bridged from Ethereum, and a curator picks its markets.
- The vault, the lending market and the stablecoin each have their own code, which is three sets of contract risk.
- The stablecoin’s peg and the restaked token’s backing are economic risks, and so is any oracle that prices them.
- The curator, plus each protocol’s admins and token holders, can change parameters, which is governance risk several times over.
- The bridged token depends on a verifier set the depositor has probably never looked up.
- Whoever runs the stablecoin’s strategy and holds its reserves is a counterparty.
- The depositor signed approvals on a front end, which is user risk.
- The front end, the issuer and the curator each sit under some legal system that can change.
All of that has to hold at the same time, and any single failure can reach the 10,000 dollars. The rsETH case played out this way in April 2026, when depositors in WETH markets were exposed to a bridge setting on another team’s token.
The same list can be drawn for any real position, next to the risk tiers of the portfolio lesson. The next lesson goes deeper on a risk that sits between code and markets: MEV, and how to protect a trade from it.
