DeFi Lending Hacks Now Cost Users Just $3 for Every $10,000 Locked

Lenders parking funds in DeFi borrowing markets on Ethereum Virtual Machine (EVM) chains and Solana lost roughly $3 for every $10,000 deposited over the past 12 months, putting realized hack losses at 3 basis points of Total Value Locked (TVL).

That loss rate sits close to the annual rate at which Americans die from slip-and-fall accidents. Keyring Network founder Alex McFarlane derived the figure from DefiLlama records on May 17, isolating lending markets and stripping out bridge incidents.

Lending Hack Losses Stay Small Against TVL

The research measures trailing 12-month non-bridge lending exploits at $30.9 million gross against $99.6 billion in average TVL. The reading came in at 3.1 basis points gross and 3 basis points net after recoveries, pulled through May 16.

For an individual lender, the math implies that spreading $10,000 across the largest EVM and Solana lending markets carried an annualized hack-loss expectation of about $3 over the past year.

The figure excludes bridge risk, oracle failures, and bugs specific to any single protocol, and it assumes the deposit did not land inside a market that suffered a tail event.

DefiLlama records gross hack losses of $7.75 billion across the broader DeFi category over its full history. Excluding bridge incidents drops that figure to $4.52 billion, showing how one category distorts the picture for the rest of DeFi.

Crypto hackers pulled $606 million in April, the worst month since Bybit’s 2025 breach, with Kelp DAO and Drift hacks driving 95% of that month’s total losses.

“The key question for hack/crime risk is: how large are realized exploit losses relative to the amount of capital using the market? The probability of 3 in 10000 is approximately equal to the rate of Americans that die by slipping and falling over. On that basis, DeFi borrowing and lending look pretty good, despite the fear factor,” wrote McFarlane.

Follow us on X to get the latest news as it happens

Diversification and Recoveries Reshape the Risk

Hack sizes skew heavily, with a handful of mega-events driving most of the cumulative damage and the bulk of incidents staying small. On a logarithmic scale, the data approximates a lognormal distribution.

Most exploits hit one component inside a market rather than draining an entire protocol, and larger markets absorb a smaller percentage hit when an incident does occur.

That pattern strengthens the case for spreading capital across DeFi lending protocols rather than concentrating it in one venue.

Recoveries also reduce the headline figure. Across all DefiLlama-tracked DeFi protocol losses, capped recoveries amount to about 8% of gross damage.

For EVM and Solana lending excluding bridges, the rate climbs to roughly 20%. Euler Finance produced the standout case, with the attacker returning all stolen funds after the 2023 flash loan exploit.

Design Philosophy Shapes the Next Cycle

Builders are pushing toward leaner code as a security strategy. Morpho contributor Merlin Egalite argued that minimalism is the dividing line between safe and unsafe lending markets.

The $3 per $10,000 reading is realized history, not a guarantee. The data argues against alarmism without dismissing tail risk.

Aave and Morpho continue to absorb the bulk of new lending capital, and 2026 has already seen heavy single events, including the KelpDAO incident in April.

Losses now sit within a measurable range that lenders, insurers, and allocators can actually price.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights