DeFi Exploit Losses Drop 74% Since 2022 Peak, But Unverified Smart Contracts Emerge as New Attack Vector

Jun 3, 2026

DeFi exploit losses have fallen 74% from their 2022 peak, as attacks on bridges and via flash-loans have been largely mitigated. However, new threats are emerging, with 89% of 2025 losses coming from protocol-specific logic flaws. Attackers are using AI to target unverified smart contracts, stealing $36.7 million in six months, while multi-chain deployments create systemic risks, exemplified by the $128 million Balancer hack across six blockchains.

DeFi exploit losses decline

▪DeFi protocol losses from exploits fell 74% from a peak of $2.62 billion in 2022 to $680.3 million in 2025.
▪The median loss per DeFi exploit declined 75%, from $6 million in 2022 to $1.5 million in 2025.
▪The number of unique exploit incidents rose to 83 in 2025, indicating more hacks are occurring but each one causes less damage.

Multi-chain deployment vulnerability

▪Major protocols often deploy the same code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet, and Sonic, creating shared systemic risk.
▪A single flaw in code deployed across multiple blockchains can be exploited to drain funds from all networks simultaneously.

Balancer V2 exploit

▪The Balancer attacker exploited an arithmetic precision flaw in the pools' code that eleven separate audits had failed to detect.
▪In November 2024, an attacker drained roughly $128 million from Balancer's V2 Composable Stable Pools across six blockchains simultaneously.

Bridge attack decline

▪In 2022 alone, nine bridge exploits resulted in $1.9 billion in losses, with the Ronin Bridge hack accounting for $624 million.
▪Losses from bridge exploits collapsed from 73% of all DeFi losses in 2022 to just 3% in 2025.

Flash-loan attack decline

▪Protocols have adopted specific defenses against flash-loan attacks, including time-weighted average prices and reentrancy guards.
▪Flash-loan attacks, which represented 54% of all DeFi losses in 2020, fell to less than 1% of total losses by 2025.

Protocol logic exploits dominance

▪The protocols exploited via unverified contracts were Truebit ($26.2M loss), Trusted Volumes, Aperture Finance, and Ekubo.
▪AI-powered tools and decompilation software are making it easier for attackers to reverse-engineer and find flaws in unverified smart contracts.
▪Attackers stole at least $36.7 million from four protocols over six months by exploiting unverified smart contracts whose code was not public.
▪In 2025, 89.1% of DeFi losses came from protocol logic exploits, which are code-level flaws specific to an application's design.