Since 2016, DeFi projects and crypto exchanges have lost over $14.27B to hacks and exploits. This figure is conservative — it does not account for individual wallet hacks or the secondary damage caused by an erosion of trust and liquidity across the ecosystem.

2022 remains the single costliest year on record at $2.77B, narrowly ahead of 2021's $2.66B. 2026 has logged 164 separate incidents through early August, more than any full prior year (2025's 97 is the next-highest). Some of that is likely better detection and tracking rather than a stark increase in attacks, though anecdotally, the pace has felt faster in recent years too with talks of AI being major contributing factors.

2023 and 2024 saw a decline in hacks amid the post-FTX bear market, before a sharp uptick in 2025 as crypto recovered, driven in large part by the infamous $1.4B North Korea-linked hack of crypto exchange Bybit.

2026 Hacks In a Nutshell

In 2026, April alone accounted for $644.9M, more than half of everything lost to hacks in the first seven months of the year, and it happened almost consecutively one after the other. Drift Trade was hit first on April 1 ($295M), then Kelp followed just over two weeks later on April 18 ($293M). Though hit by separate hacking groups, both exploiters were allegedly linked to North Korean state hackers.

Of these two hacks, the Kelp exploit caused structural damage throughout DeFi. Attackers found a weakness in Kelp's LayerZero bridge, minted roughly $293M of unbacked rsETH out of thin air, and dumped it straight into Aave as collateral to borrow real assets. Aave's TVL fell from $25.93B on April 17 to $21.80B just two days later, and the damage didn't stop there. By July 21, Aave's TVL had continued sliding to $14.40B, a 44.5% decline from its pre-hack level, part of a broader wipeout of trust across DeFi lending that has yet to reverse.

What Happens to Governance Tokens Post-Hack?

Hacks create a second category of financial damage that falls on the holders of the affected protocol's governance token, who lose money on the market's reaction even if they had no direct exposure to the exploit itself. Step Finance is the worst-case example: its exploit left the protocol insolvent, Step Finance has since shut down entirely, and STEP is down 99.4%.

Drift* and Resolv are still operating, but their tokens haven't recovered either: DRIFT is down 80.2% since its April 1 exploit, and RESOLV is down 71.7% since March. BONK, the most recent hack on this list (July 6), shows that market reaction can be costlier than the exploit itself: BonkDAO's treasury was drained of $21.3M through a malicious governance vote, yet BONK's token lost $138.65M in market capitalization since.

Note: Drift has renamed to Velocity and has not yet relaunched their platform. It remains to be seen if the platform can bounce back from their massive hack

Methodology

Yearly totals (2016-2026) combine the DeFiWatch REKT Database (2018-2022) with DeFiLlama's hack tracker (2023-2026, snapshot taken August 5, 2026); 2026 figures are year-to-date through August 3-5, 2026, and not a complete-year total. 

Monthly 2026 breakdowns are sourced entirely from the DeFiLlama snapshot; a second Verus-Ethereum Bridge incident in July ($7.53 million) has been folded into that month's "Others" total rather than shown separately, since May's Verus-Ethereum Bridge incident is the one specifically named in this analysis.

Governance token market cap figures use CoinGecko daily price and market cap data, with a pre-hack baseline calculated as the 7-day average market cap ending the day before each hack, compared against the most recent available data (August 4, 2026). Hacked protocols without an independently-tradeable governance token of their own (including exchanges, bridges without native tokens, and hardware wallets) are excluded from the token-level analysis (chart 3). KernelDAO's KERNEL was used in place of rsETH for the Kelp exploit specifically because this analysis measures governance-token market impact, not TVL or redemption flows.

If you cite these insights, we would appreciate a link credit to this article on CoinGecko, which allows us to keep supplying you with useful data-led content.

Related reading: Which Was the Worst Year for Crypto Hacks and Exploits?

This study is for illustrative and informational purposes only, and is not financial advice.

Appendix: Raw Data

The number of hacking incidents pre 2020 is marked as n/a as a reliable count of incidents cannot be established.