DeFi Security in 2026: Safer at the Core, Riskier at the Edges

In spring 2026, a single month produced a record 28 DeFi exploits along with the largest single crypto hack of the year. 

A DeFi exploit is the abuse of a smart contract vulnerability in a decentralized finance protocol, that is, in the smart contracts that automatically execute financial services such as lending, trading, or staking on a blockchain. These protocols sometimes manage assets in the hundreds of millions.

At face value, the conclusion seems clear: DeFi security is deteriorating. However, a closer look at the numbers reveals two categories of attack whose trends are moving in opposite directions. One includes the year's largest single exploit. The other has become materially less damaging over time. 

Although more dangerous around the edges, DeFi has actually become safer at the core. For financial service providers, the two categories carry separate due diligence requirements, and recent events demonstrated exactly why.

DeFi applications are governed by smart contracts: published code that determines how a lending pool, exchange, or yield product operates. Exploiting one means finding a flaw in that code, much like finding a loophole in the terms of a financial contract. 

This category of smart contract security failure has become measurably less severe: average losses per incident fell from roughly $156 million in the 2020–2022 period to approximately $14 million since 2023, suggesting core protocol security has improved as attackers shifted toward smaller, more peripheral targets. 

The rising number of DeFi hacks is better interpreted as a measure of reach than depth. More contracts are deployed across DeFi than at any prior point, more integrations have accumulated technical debt from previous growth phases, and AI-assisted tools have lowered the cost of scanning code for smart contract vulnerabilities. The attack surface has widened as the damage when protocol exploits succeed has contracted.

At the other end of the spectrum lies the successful attack on Kelp DAO: as an outlier to the upside, it shows the flip side. The $292 million loss, one of the largest single crypto exploits of 2026 so far, was not a protocol attack. It was a cross-chain bridge hack — a breach of the infrastructure that moves assets between blockchains: the verification layer that confirms cross-chain transactions, analogous to the messaging infrastructure connecting financial institutions. 

That crypto bridge infrastructure relied on a single verification node to approve these transactions. Attackers attributed to North Korea's Lazarus Group compromised that node through social engineering, then used it to forge a valid-looking instruction that released $292 million in rsETH, a token representing staked Ether, without any real backing. No smart contract audit of Kelp's DeFi protocol would have identified the vulnerability, because it did not exist in the contract code.

What followed the Kelp DAO exploit illustrates why cross-chain bridge failures carry a more systemic risk profile than protocol exploits — and why DeFi lending risk extends beyond the platforms where assets are deposited. 

The attacker deposited the forged tokens into Aave, DeFi's largest lending platform, as collateral, then borrowed approximately $190 million in real assets against them. When the forgery became apparent, Aave and two other major lending platforms froze their markets to prevent bad debt from accumulating. 

Roughly $13 billion in assets exited DeFi platforms over the following 48 hours, as an infrastructure failure at one protocol became a market-wide liquidity event within a day. The defining characteristic of composability risk — sometimes described as DeFi contagion — is the capacity for a failure in one part of the system to propagate through the financial connections around it.

The core/edge distinction has direct practical implications for financial service providers with DeFi exposure or clients holding DeFi assets. 

A smart contract audit, the standard due diligence tool for assessing DeFi security, would not have caught the Kelp DAO vulnerability. Exposure to a well-audited DeFi protocol and exposure to an asset whose backing depends on cross-chain bridge infrastructure are separate risk questions with separate failure modes.  

Any comprehensive DeFi risk assessment now needs to treat bridge risk, governance risk, and composability risk as independent dimensions of a DeFi position; not as subcategories of smart contract risk, but as distinct layers that standard DeFi audit processes do not fully reach. For institutions evaluating crypto counterparty risk, the scope of assessment must extend beyond the application layer.

Still, the same AI tooling that has lowered the cost of finding protocol weaknesses is available to defenders, giving blockchain security teams faster paths to identify and patch smart contract vulnerabilities than at any earlier point in DeFi's history. 

The research team at Bitcoin Suisse expects the improvement trend at the protocol level to continue. The catch-up work that remains is concentrated at the infrastructure layer, at the edges rather than the core. For financial service providers, the useful question about DeFi security has shifted: not whether DeFi is safe, but which layer would be affected, and what a failure at that layer actually sets in motion. 

Source: Bitcoin Suisse. Data: DefiLlama. Data as of April 30, 2026. 

The original analysis is available in the Bitcoin Suisse Industry Rollup — May 2026.