DeFi Exploit Losses Drop 74% Since 2022 Peak, But Unverified Smart Contracts Emerge as New Attack Vector

DeFi exploit losses have fallen 74% from their 2022 peak, as attacks on bridges and via flash-loans have been largely mitigated. However, new threats are emerging, with 89% of 2025 losses coming from protocol-specific logic flaws. Attackers are using AI to target unverified smart contracts, stealing $36.7 million in six months, while multi-chain deployments create systemic risks, exemplified by the $128 million Balancer hack across six blockchains.

DeFi exploit losses decline

• ▪DeFi protocol losses from exploits fell 74% from a peak of $2.62 billion in 2022 to $680.3 million in 2025
• ▪The median loss per DeFi exploit declined 75%, from $6 million in 2022 to $1.5 million in 2025
• ▪The number of unique exploit incidents rose to 83 in 2025, indicating more hacks are occurring but each one causes less damage

Multi-chain deployment vulnerability

• ▪Major protocols often deploy the same code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet, and Sonic, creating shared systemic risk
• ▪A single flaw in code deployed across multiple blockchains can be exploited to drain funds from all networks simultaneously

Balancer V2 exploit

• ▪The Balancer attacker exploited an arithmetic precision flaw in the pools' code that eleven separate audits had failed to detect
• ▪In November 2024, an attacker drained roughly $128 million from Balancer's V2 Composable Stable Pools across six blockchains simultaneously

Bridge attack decline

• ▪In 2022 alone, nine bridge exploits resulted in $1.9 billion in losses, with the Ronin Bridge hack accounting for $624 million
• ▪Losses from bridge exploits collapsed from 73% of all DeFi losses in 2022 to just 3% in 2025

Flash-loan attack decline

• ▪Protocols have adopted specific defenses against flash-loan attacks, including time-weighted average prices and reentrancy guards
• ▪Flash-loan attacks, which represented 54% of all DeFi losses in 2020, fell to less than 1% of total losses by 2025

Protocol logic exploits dominance

• ▪The protocols exploited via unverified contracts were Truebit ($26.2M loss), Trusted Volumes, Aperture Finance, and Ekubo
• ▪AI-powered tools and decompilation software are making it easier for attackers to reverse-engineer and find flaws in unverified smart contracts
• ▪Attackers stole at least $36.7 million from four protocols over six months by exploiting unverified smart contracts whose code was not public
• ▪In 2025, 89.1% of DeFi losses came from protocol logic exploits, which are code-level flaws specific to an application's design