Summer Finance (Summer.fi) suffered a $6 million exploit on July 6, with attackers draining funds from its USDC vault through a flash loan attack. The vault's advertised yield briefly spiked past 2 million percent before the breach.
DeFi lending protocol Edel Finance halted its version-one protocol after an attacker exploited the wrapping mechanism for tokenized Alphabet stock, artificially inflating collateral values by 7,700% and extracting $403,000. The team stated no depositors would bear losses.
Attackers exploited unverified smart contracts to drain $36.7 million from DeFi protocols across at least four incidents between January and May 2026, with the largest attack targeting Truebit in January.
DeFi protocol losses from exploits fell from $2.62 billion in 2022 to $680.3 million in 2025, according to Immunefi, even as Chainalysis reports attackers are increasingly targeting unverified smart contracts, which accounted for $36.7 million in losses across four exploits in the past six months.
Aave published an official postmortem tracing a $230 million exploit to a LayerZero bridge verification failure and announced a sweeping overhaul of its asset-listing standards as DeFi risks shift beyond smart contract bugs.
The BY token project suffered an $88,400 loss through a Binance Smart Chain exploit targeting vulnerable contract logic, occurring during what security firm CertiK identified as the worst month for DeFi exploits in four years with attacks on 27 out of 30 days in April 2026.
Echo Protocol suffered a bridge exploit where an attacker minted 1,000 eBTC (worth approximately $76.64 million) on Monad using a compromised admin key, then used the fake eBTC to borrow real crypto assets. The protocol suspended all cross-chain transactions.
Following a $292 million KelpDAO exploit, crypto projects with over $3 billion in total value locked migrated their cross-chain infrastructure from LayerZero to Chainlink's CCIP. Solv Protocol moved $700 million in tokenized Bitcoin infrastructure as part of the migration.
Aave LLC filed an emergency motion in U.S. federal court to lift a restraining order freezing approximately $73 million in Ether recovered after the Kelp DAO exploit, as a law firm attempts to seize the funds claiming links to North Korean hackers.
A coalition of DeFi protocols including Aave, Compound, and others unveiled a detailed technical plan to eliminate bad debt and restore full backing for exploited rsETH tokens following the $290 million Kelp DAO hack, with pledges totaling over $300 million in recovery funds.
Consensys and founder Joseph Lubin contributed 30,000 ETH to the DeFi United initiative aimed at recovering losses from the Kelp DAO exploit. The industry-wide effort has now raised over $300 million worth of Ethereum from multiple protocols and entities.
Aave governance proposed contributing 25,000 ETH to the DeFi United coalition working to cover losses from the $292 million Kelp DAO exploit. Multiple protocols and individuals have collectively pledged enough to cover the shortfall, with Mantle proposing a 30,000 ETH loan.
JPMorgan analysts reported that persistent hacks, including the $290 million KelpDAO exploit, and flat ETH-denominated growth are pushing investors toward Tether's USDT as users move funds out of DeFi during stress periods.
The Arbitrum Security Council froze $71 million worth of ETH stolen in the $292 million Kelp DAO exploit, with funds only movable through further governance action. Kelp DAO and LayerZero continue to dispute responsibility for the bridge vulnerability.
A coalition of DeFi protocols deployed a joint emergency mechanism to help Aave ETH lenders and loopers exit positions after the Kelp DAO bridge exploit created systemic risk across lending markets. The response demonstrates DeFi's architectural openness can produce rapid crisis solutions.
DeFi protocol Rhea Finance on NEAR was exploited for $18.4 million through deliberately constructed swap routes and fake token contracts, with losses more than doubling initial estimates of $7.6 million.
