Decentralized finance has become much more secure over the past six years. A new look at protocol losses from 2020 to 2025 puts a large number behind this claim.
Industry-wide DeFi losses peaked at $2.62 billion in 2022 and fell about 80% to $534 million in 2024. Bridge hacks that once made headlines worth billions of dollars now represent a tiny share of annual totals. Today’s typical exploit does about a quarter as much damage as at the top.
Losses decreased despite more channels and users
The encouraging side of this data is that low-cost, repeatable attacks have mostly been designed to disappear. Total losses fell by 80% in two years, even as DeFi’s TVL continued to climb. The median loss per incident fell from $6 million in 2022 to $1.5 million in 2025, a drop of 75%.
The number of unique incidents increased to 83 in 2025. More and more hacks are occurring while each one does much less damage. This is roughly what a mature security field should look like.
Bridges were the defining vulnerability in 2021 and 2022. In this second year alone, nine bridge operations resulted in losses of $1.9 billion. The Ronin Bridge alone was a loss of $624 million. Bridge hacks accounted for 73% of all DeFi losses that year. By 2025, the bridge’s share had collapsed to 3%. Improved verification mechanisms, decentralized validator sets, and a move toward native cross-chain messaging have helped reduce this category.
Flash loan attacks followed the same path. They accounted for 54% of all losses in 2020. In 2025, they accounted for less than 1%. Protocols have adopted defenses tailored to this attack: time-weighted average prices, Chainlink oracle integrations, re-entry guards, and designs that assume an attacker can manipulate prices within a single atomic transaction.
Private key compromises have seen a similar decline. They fell from 28.7% of losses in 2022 to 8.1% in 2025. Each of these categories declined because the industry recognized a repeatable pattern and developed standardized responses.
What’s Left is Harder to Defend
The closing of generic attacks has left behind a much more difficult category. In 2025, 89.1% of DeFi losses came from protocol logic exploits. These are code-level flaws specific to how an application was designed. A bridge hack involves recognizable trust assumptions. A flash loan attack is part of a known family of techniques. Both can be defended with reusable models.
A protocol logic bug is specific in nature. Particular choices emerge regarding mathematics, access controls or the composability of a single code base. It is difficult to defend against it systematically because each case constitutes its own puzzle.
Multi-chain deployment turns bugs into crises
Multi-chain deployment turns one of these tailor-made bugs into a full-blown crisis. Major protocols often deploy the same code on Ethereum, Base, Arbitrum, Polygon, OP Mainnet and Sonic. A single breach can drain funds from all networks running it at the same time.
We saw this in November 2024, when Balancer’s Composable Stable Pools V2 were drained of approximately $128 million in less than half an hour on six blockchains simultaneously. According to Check Point Research, the attacker exploited an arithmetic precision flaw in pool invariant calculations. They pushed token balances to a rounding limit, then chained batch trades until these small mistakes turned into a complete leak.
Contracts with the same vulnerability have been deployed on Ethereum, Arbitrum, Base, Polygon, Sonic and OP Mainnet. The exploit hit them all at once, because the flaw was embedded in the code itself and that code had been copied everywhere. Eleven separate audits failed to detect it.
ImmuneFi’s report draws a direct line from the ~$611 million Poly Network exploit in 2021 to Balancer in 2025. Poly Network was a failure at the point of connection between the systems. Balancer was the same logic failing identically across networks sharing code, signer paths, and verification assumptions.
The security measure has changed
Once a chain becomes part of the default deployment map of major protocols, it absorbs the risk surface of everything it hosts. The report attributes all losses resulting from a multi-chain exploit to each affected chain. Participants from all six networks were exposed to the full impact.
The 2025 hack numbers for Polygon, OP Mainnet, Base and Sonic are heavily influenced by the Balancer cascade. The report eliminates centralized exchange failures entirely. The year’s largest theft, the $1.5 billion Bybit hack that the FBI attributed to North Korea, is seen as a failure of custody rather than protocol.
Based on losses per TVL, the safest level among major ecosystems was Ethereum at around 0.42%, Solana at 0.42%, and BNB Chain at 0.33%. These three largest DeFi ecosystems suggest that scale and security have improved together.
A loss can now occur in an application that includes a flaw imported from elsewhere. The convenience that makes multi-chain applications attractive is what makes this error go from a local error to a shared error. Crypto created separate chains in part to avoid relying on a single system. Running the same handful of popular protocols in each of them rebuilt the focus these chains were meant to escape.
The next big incident might seem small when it happens, a simple logical bug in a widely deployed protocol. Its true size will only be revealed when people realize that the same vulnerable code was present on half a dozen networks all the time.
