Why DeFi keeps losing millions to exploits

It was one of the worst years on record Decentralized finance Breakthroughs, we’re barely halfway there.

In the first five months of 2026, more than $840 million Lost to DeFi hacks – over $600 million was stolen in April alone, led by two of the biggest attacks this year: KelpDAO exploit worth $292 million and $285 million drift protocol breach.

The losses continued until May Thorshin Trading halted after security researchers reported a suspected cross-chain exploit affecting more than $10 million.

Trusted folders, Echo protocol, Financing step, It will be true, Solution Laboratories, Volo protocol, RIAA Finance, Real Ethereum Bridgeand many others are making a casualty list that sounds like a stress test of every trust assumption that DeFi relies on, according to Devilama data.

Experts Decryption We generally agreed on the diagnosis that recent DeFi hacks expose structural weaknesses across them Bridges and management systems, while advances in artificial intelligence may help attackers find vulnerabilities faster.

Natalie Newson is a senior blockchain investigator at the Web3 security platform certecHe said Decryption Although April was unusually severe for cryptocurrency attacks, the broader trend remains more stable and below the peak number of incidents seen in 2023.

“April 2026 was a bad month for cryptocurrency exploits, and there were only three days without an exploit in which at least $10,000 was stolen,” she said.

“However, when we look at the broader picture, the number of incidents (excluding phishing) has arguably been fairly steady and remains below the peak in 2023,” Newson noted, adding how April’s severity was driven by 14 exploits whose losses exceeded $1 million, second only to September 2025’s 16.

North Korea factor

Ari Redbord, Global Head of Policy and Government Affairs at TRM LaboratoriesHe said Decryption This increase is due to a single state actor, which has gone from a marginal player to a specific threat within five years.

“The dominant driver is North Korea, and this campaign is becoming more intense, not broader,” Redbord said, noting that actors linked to North Korea It has been calculated For 76% of global cryptocurrency hack losses in the first four months of 2026, up from 64% in 2025 and less than 10% in 2020.

He added, “North Korea not only uses technology to attack space, but also uses sophisticated and well-planned social engineering.”

The largest DeFi hack of the year so far hit KelpDAO on April 18, when attackers drained approximately 116,500 rsETH, worth approximately $292 million, from a cross-chain bridge.

LayerZero, whose messaging infrastructure supports the bridge, said in its latest report Post-mortem report The attack began on March 6, when social engineering was performed by the developer, and session keys were harvested.

The cross-chain messaging protocol said the attack was attributed by Mandiant, CrowdStrike and independent researchers to DPRK threat actor TraderTraitor, also known as UNC4899.

Redbord added that the structural reason why DeFi continues to absorb hits is because of where the money is and how it moves.

“The complexity across the DeFi chain makes it a target-rich environment — bridges consistently produce the largest losses in a single incident, and failure modes are repeated with amazing consistency because the underlying problem is architectural,” he noted.

Repetitive patterns

Raz Neff, co-founder and CTO of security platform OnChain SiegeHe said Decryption Three technical patterns continue to emerge across the year’s largest incidents: privileged access control failures, malicious proxy upgrades where attackers swap execution contracts with backdoor versions, and cross-chain message verification gaps.

Regarding privileged access, Neff said the company is monitoring “anomalous ‘granted role’ events and unauthorized privilege escalation,” with incidents such as Exploiting the echo protocol Tracing back to compromised or misconfigured management keys.

“Attackers are either social engineering their way into private keys or exploiting poorly designed multi-signature thresholds,” he added.

He pointed to failures involving privileged access controls, malicious proxy upgrades and cross-chain verification systems, saying the recent attacks expose deeper vulnerabilities in the assumptions that connect increasingly complex infrastructure.

“The common thread is not complexity per se,” Neff said. “Each layer of abstraction (agents, moderator roles, on-chain messages) makes trust assumptions that attackers systematically check.”

Impact of artificial intelligence

Neff said AI is increasingly transforming vulnerability detection, though he cautioned that its impact is often misunderstood.

He said current models were becoming increasingly effective at identifying widely known vulnerabilities and were “automating what skilled auditors do,” while warning that “the real concern is not AI replacing human attackers” but AI “amplifying attackers” by handling reconnaissance and freeing them to focus on more sophisticated techniques.

“The good news is that defenders can use the same tools,” Neff added. “AI-assisted monitoring and simulation has become essential for security teams trying to keep up with advances.”

In the case of the increase in DeFi hacks, Newson pointed to a similar trend, saying: “One factor that is likely to be a contributor, though not the only factor, is advances in artificial intelligence.”

She added that CertiK has seen a rise in exploitation of outdated and unverified contracts, making “the logical assumption that AI helps find vulnerabilities.”

Likewise, Redbord said, “bad actors are deploying AI at scale” via reconnaissance, social engineering, and exploit design, adding that the sophistication seen in attacks like Drift appears “compatible with AI-assisted workflows.”

TRM analysts believe North Korean operators are increasingly incorporating AI tools into their operations, saying: “The solution is to deploy AI on defense with the same aggression that adversaries deploy on offense.

Above the code

Redbord said DeFi hacks are a “solvable problem,” but said the industry needs to be more honest about where the failures actually occur.

He noted that “audits protect against software bugs” but not against sophisticated social engineering campaigns like Drift, where North Korean agents are said to He spent months cultivating accessibility Before the violation.

The expert added: “The successful model is immediate coordination between the public and private sectors.”

Newson said 2026 could represent an “evolutionary turning point,” saying the industry is learning that cybersecurity is an “integrated problem” that includes “artificial intelligence, the Democratic People’s Republic of Korea, or infrastructure and personnel.”

“It doesn’t matter how perfect your on-chain mathematics is if your off-chain human processes are at risk,” she said, noting that the industry is increasingly turning toward “practical, architectural solutions” to address infrastructure and social engineering risks.

Striking confidence

The damage to trust in DeFi is difficult to measure but easy to observe.

The Kelp DAO exploit sparked a wave of withdrawals worth $6.2 billion from… ghost Alone, he accepted the relief effort led by Aave CEO Stani Kuleshov, which he called “Davie United“, raised 132,650 ETH worth approximately $303 million to support bad debts.

The coordinated response shows that the industry is able to mobilize. It also shows how much capital is needed to cover a single bridge hole.

Newson said the repercussions depend entirely on those affected.

“Industry veterans may view the past six weeks as par for the course – simply the next evolutionary norm and a tough experience to learn from,” she said.

She noted that the impact of repeated exploits looks very different for new market participants, warning that for users who lose significant funds, the fallout is not a “learning experience” but raises “existential questions” about the “long-term viability and safety of cryptocurrencies,” as technical fixes often arrive too late to undo the damage.