Oracle provider Pragma rated six price feeds as critical risk on September 18 following a $3.5 million exploit on Starknet's lending protocol. The assessment revealed a gap between oracle valuations and the liquidity lenders need to sell collateral.
Nostra Finance, a lending protocol on Starknet Layer 2, paused its money market after an attacker exploited a manipulated price feed for its NSTR token to steal $3.5 million. The exploit is notable as NSTR's entire market cap is under $600,000.
Chainflip protocol plans to restart operations by converting Tron liquidity provider balances into separate on-chain claims after a $736,000 exploit. The protocol has committed to making providers whole but has not disclosed repayment timing or funding source.
DeFi insurance protocol Cozy Finance was exploited for approximately $170,000 on the Optimism network, with the attacker draining funds and bridging them out within 13 minutes. Blockchain security firm Blockaid flagged the attack early Monday, marking the second time Cozy Finance has been compromised.
Cryptocurrency platform Rocket has halted all deposits, withdrawals, and trading after an attacker exploited a dormant perpetual market to manipulate prices and withdraw approximately $287,000 in positive profit and loss from the platform's Bridge.
Curve DAO approved funding for yRisk to manage risk for crvUSD and Llamalend with 125,000 frxUSD and 568,181 CRV tokens on Sept. 2. yRisk is operated by two developers from Yearn and Resupply, the latter of which suffered a $9.6 million exploit in 2025.
Balancer issued a warning on Aug. 31 for liquidity providers to withdraw from its deprecated V1 pools after a fixed-point rounding flaw led to approximately $234,000 being drained. The deprecated pools are non-pausable, leaving withdrawal as the only protection.
The Cronos blockchain, linked to Crypto.com, suspended operations on August 30, 2026, following an exploit of Tectonic, its largest DeFi lending protocol. The attack, which began with a 100x pump of the TONIC token, resulted in approximately $75 million in losses.
The Cronos blockchain halted block production on Sunday after an attacker exploited Tectonic, its largest lending protocol, by artificially inflating the TONIC token price roughly 100-fold and using it as collateral to borrow approximately $75 million in assets. Validators paused the network, stranding most of the stolen funds.
DeFi lending protocol Moonwell suffered an $8.7 million exploit after an attacker manipulated the price of MAMO token to borrow real assets against inflated collateral, prompting the protocol to set borrow caps to 1 wei across Base markets.
The Sandbox contained a vulnerability in its SAND cross-chain bridge on Base and BNB Smart Chain after an attacker minted approximately 500 million unbacked tokens. The project stated the impact was under $1 million, though the full extent of damage remains unclear.
Summer Finance (Summer.fi) suffered a $6 million exploit on July 6, with attackers draining funds from its USDC vault through a flash loan attack. The vault's advertised yield briefly spiked past 2 million percent before the breach.
DeFi lending protocol Edel Finance halted its version-one protocol after an attacker exploited the wrapping mechanism for tokenized Alphabet stock, artificially inflating collateral values by 7,700% and extracting $403,000. The team stated no depositors would bear losses.
Attackers exploited unverified smart contracts to drain $36.7 million from DeFi protocols across at least four incidents between January and May 2026, with the largest attack targeting Truebit in January.
DeFi protocol losses from exploits fell from $2.62 billion in 2022 to $680.3 million in 2025, according to Immunefi, even as Chainalysis reports attackers are increasingly targeting unverified smart contracts, which accounted for $36.7 million in losses across four exploits in the past six months.
Aave published an official postmortem tracing a $230 million exploit to a LayerZero bridge verification failure and announced a sweeping overhaul of its asset-listing standards as DeFi risks shift beyond smart contract bugs.
The BY token project suffered an $88,400 loss through a Binance Smart Chain exploit targeting vulnerable contract logic, occurring during what security firm CertiK identified as the worst month for DeFi exploits in four years with attacks on 27 out of 30 days in April 2026.
Echo Protocol suffered a bridge exploit where an attacker minted 1,000 eBTC (worth approximately $76.64 million) on Monad using a compromised admin key, then used the fake eBTC to borrow real crypto assets. The protocol suspended all cross-chain transactions.
Following a $292 million KelpDAO exploit, crypto projects with over $3 billion in total value locked migrated their cross-chain infrastructure from LayerZero to Chainlink's CCIP. Solv Protocol moved $700 million in tokenized Bitcoin infrastructure as part of the migration.
Aave LLC filed an emergency motion in U.S. federal court to lift a restraining order freezing approximately $73 million in Ether recovered after the Kelp DAO exploit, as a law firm attempts to seize the funds claiming links to North Korean hackers.
A coalition of DeFi protocols including Aave, Compound, and others unveiled a detailed technical plan to eliminate bad debt and restore full backing for exploited rsETH tokens following the $290 million Kelp DAO hack, with pledges totaling over $300 million in recovery funds.
Consensys and founder Joseph Lubin contributed 30,000 ETH to the DeFi United initiative aimed at recovering losses from the Kelp DAO exploit. The industry-wide effort has now raised over $300 million worth of Ethereum from multiple protocols and entities.
Aave governance proposed contributing 25,000 ETH to the DeFi United coalition working to cover losses from the $292 million Kelp DAO exploit. Multiple protocols and individuals have collectively pledged enough to cover the shortfall, with Mantle proposing a 30,000 ETH loan.
JPMorgan analysts reported that persistent hacks, including the $290 million KelpDAO exploit, and flat ETH-denominated growth are pushing investors toward Tether's USDT as users move funds out of DeFi during stress periods.
The Arbitrum Security Council froze $71 million worth of ETH stolen in the $292 million Kelp DAO exploit, with funds only movable through further governance action. Kelp DAO and LayerZero continue to dispute responsibility for the bridge vulnerability.
A coalition of DeFi protocols deployed a joint emergency mechanism to help Aave ETH lenders and loopers exit positions after the Kelp DAO bridge exploit created systemic risk across lending markets. The response demonstrates DeFi's architectural openness can produce rapid crisis solutions.
DeFi protocol Rhea Finance on NEAR was exploited for $18.4 million through deliberately constructed swap routes and fake token contracts, with losses more than doubling initial estimates of $7.6 million.
