Study: DeFi lending hacks cost ~$3 per $10,000 over year

Keyring Network founder Alex McFarlane calculated losses using DefiLlama records pulled May 16–17 and found that non-bridge lending exploits on Ethereum Virtual Machine chains and Solana totaled $30.9 million over the trailing 12 months against $99.6 billion in average total value locked. That works out to about 3.1 basis points gross and roughly 3 basis points net after recoveries. Spreading $10,000 across the largest lending markets on those chains produced an annualized hack-loss expectation of about $3 over the period studied.

The analysis isolates lending exploits and excludes bridge incidents, oracle failures and bugs confined to a single protocol. It assumes funds were not placed into a market that experienced an extreme tail event. The figures reflect realized losses over the trailing 12 months and are not a forecast.

DefiLlama’s full-history records show $7.75 billion in gross DeFi hack losses; removing bridge-related incidents reduces that cumulative figure to $4.52 billion. April recorded $606 million stolen, the largest month since a 2025 breach, with Kelp DAO and Drift accounting for roughly 95% of that month’s losses.

Recoveries narrowed headline losses. Across protocols tracked by DefiLlama, capped recoveries represent about 8% of gross damage. For EVM and Solana lending markets excluding bridges, the recovery rate is closer to 20%. Euler Finance is a notable example: after a 2023 flash-loan exploit the attacker returned all stolen funds.

Most exploits compromise a single component within a market rather than empty an entire protocol. Larger markets typically suffer smaller percentage losses when hit. Loss sizes are skewed, with a small number of large events accounting for most cumulative damage; on a logarithmic scale the distribution approximates a lognormal pattern.

Developers are reducing code complexity to limit attack surface. Morpho contributor Merlin Egalite wrote that minimal protocol design differentiates safer lending markets from riskier ones.

McFarlane wrote: “The probability of 3 in 10000 is approximately equal to the rate of Americans that die by slipping and falling over. On that basis, DeFi borrowing and lending look pretty good, despite the fear factor.” He added that the $3-per-$10,000 figure represents realized history and does not project future losses.