CryptoSlate
DeFi's total losses fell roughly 80% in two years, from a $2.62B peak in 2022 to $534M in 2024, and the median loss per incident dropped from $6M to $1.5M over the same period. Bridges, which accounted for 73% of 2022's losses, now make up just 3%. Flash-loan attacks collapsed from 54% of 2020 losses to under 1% in 2025, and private-key compromises fell from 28.7% to 8.1%. The remaining 89.1% of 2025 losses came from protocol logic exploits — bespoke code-level bugs that don't fit a reusable defense pattern.
Why it matters
The category of attack that defined DeFi's early years — bridges, flash-loans, oracle manipulation, key compromises — has been engineered out with standardized answers: time-weighted average prices, Chainlink oracle integrations, reentrancy guards, decentralized validator sets, and native cross-chain messaging. Each of those was a recognizable pattern, and the industry built a known defense. What's left is harder: protocol logic bugs emerge from the particular math, access controls, and composability choices of a single codebase, and each instance is its own puzzle.
Multi-chain deployment is what turns one bespoke bug into a systemic event. Major protocols now run identical code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet and Sonic, so a flaw embedded in the shared logic drains all of them simultaneously. Balancer's V2 Composable Stable Pools lost roughly $128M in under 30 minutes across six chains in November 2024 after an arithmetic precision flaw in the pools' invariant math nudged token balances onto a rounding boundary; eleven audits had failed to catch it.
Market impact
The report's loss-to-TVL figures put the safest major ecosystems at Ethereum 0.42%, Solana 0.42% and BNB Chain 0.33% — scale and security moving in the same direction rather than trading off. The Balancer cascade is doing the heavy lifting on the 2025 loss totals for Polygon, OP Mainnet, Base and Sonic, because the methodology attributes the full multi-chain loss to every affected network.
Frequently asked questions
-
How much have DeFi losses fallen since 2022?
Industry-wide DeFi losses peaked at $2.62B in 2022 and fell roughly 80% to $534M in 2024, with median loss per incident dropping from $6M in 2022 to $1.5M in 2025.
-
Why are bridges and flash-loan attacks no longer the main risk?
Each category was a recognizable attack pattern, and the industry built standardized defenses — Chainlink oracles, time-weighted average prices, reentrancy guards, decentralized validator sets, and native cross-chain messaging. Their share of annual losses has collapsed as a result.
-
What category of attack now drives most DeFi losses?
Protocol logic exploits — bespoke code-level bugs in a single application's math, access controls, or composability. They accounted for 89.1% of DeFi losses in 2025 and are harder to defend against systematically because each instance is its own puzzle.
-
How does multi-chain deployment change the blast radius of a bug?
Major protocols run identical code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet and Sonic, so a single flaw drains all of them simultaneously. Balancer lost roughly $128M in under 30 minutes across six chains from one arithmetic precision flaw.
-
Which ecosystems had the best loss-to-TVL ratio in 2025?
Ethereum 0.42%, Solana 0.42% and BNB Chain 0.33% — the three largest DeFi ecosystems by TVL — suggesting scale and security have been improving together rather than trading off.
CoinTelegraph
CoinDesk
Crypto News
TheBlock
Crypto Rank News
WuBlockchain