Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
AAVE 
ETH Destructive setbacks: challenging year for the DeFi industry
The decentralized finance (DeFi) sector has experienced a severe year in 2026, with a staggering number of security breaches and cumulative losses of nearly US$942 million. A total of 121 vulnerability incidents were recorded throughout the year, exposing deep-rooted vulnerabilities in the DeFi protocol. As market participation declines, industry risk management responses have become the focus.
Which quarter suffered the most?
The second quarter of 2026 was the worst period for economic losses in the DeFi sector. CryptoRank data shows that approximately $775 million was stolen in 85 separate attacks during the quarter alone, accounting for more than 80% of total losses for the year. Despite the frequency of incidents, only two major vulnerabilities were the main sources of losses: Drift Protocol and KelpDAO.
What caused the critical vulnerabilities in Drift Protocol and KelpDAO?
According to CryptoRank\'s analysis, Drift Protocol suffered a carefully planned social engineering attack and approximately $285 million was illegally obtained. TRM Labs traced the attack to a North Korean hacker group. Under the guise of regular transactions, the group manipulated Drift Security Council members to grant additional powers.
The notorious Lazarus hacker group then used a vulnerability in KelpDAO\'s LayerZero bridging protocol to steal approximately $290 million in rsETH. In this attack, hackers took control of the verifier infrastructure and forged cross-chain messages to minte tokens on Ethereum without having to destroy corresponding assets on Unichain.
These attacks combined with market downturns resulted in a significant decline in the total locked position value (TVL) on the DeFi platform. Especially after the KelpDAO incident, trust has continued to deteriorate, and agreements like Aave have experienced massive capital outflows, highlighting the fragility of confidence in the DeFi sector.
Annual TVL plummeted from $115.3 billion in January to just over $70 billion at the end of June. In the 24 hours after the KelpDAO incident, Aave\'s TVL plummeted from $26.4 billion to $14.3 billion.
Despite the chaos, some blockchain platforms are still growing against the trend. Tron and Hyperliquid both recorded TVL growth in 2026, in sharp contrast to the declines in Plasma and Arbitrum. This divergence suggests that as the DeFi landscape continues to evolve, the trend of fragmentation between different blockchain ecosystems is intensifying.
