What does “3 basis points” mean for DeFi lending users?

Three basis points means users lost roughly 0.03% of funds locked in DeFi lending markets to hacks over the past year. In practical terms, the analysis estimated losses of about $3 for every $10,000 deposited across major EVM and Solana lending protocols.

How much money was lost in DeFi lending hacks over the past year?

The report calculated non-bridge lending exploit losses at about $30.9 million against an average $99.6 billion in total value locked (TVL). That makes realised losses relatively small compared with the amount of capital deployed in DeFi lending markets.

Why did the report exclude bridge hacks from the analysis?

Bridge exploits were excluded because bridge hacks historically account for a disproportionate share of DeFi losses and can distort risk calculations for lending protocols. The study focused specifically on lending markets to isolate risks tied directly to borrowing and lending activity.

Is DeFi lending becoming safer for crypto users?

The data suggests DeFi lending security has improved compared with the scale of capital now locked in protocols. However, the report also warned that tail-risk events still exist, meaning large hacks remain possible even if average realised losses are relatively low.

Which DeFi protocols were mentioned as major lending markets?

Aave and Morpho were highlighted as continuing to attract a large share of new lending capital. These protocols are among the biggest players in decentralised borrowing and lending across Ethereum-based ecosystems.

What role did recoveries play in reducing DeFi hack losses?

Recoveries significantly reduced net losses because some hacked funds were later returned or recovered. The report estimated recoveries reduced lending-related exploit losses by roughly 20%, with Euler Finance cited as a major example after its attacker returned stolen assets in 2023.

Why are bridge hacks considered more dangerous than lending exploits?

Cross-chain bridges often hold large pools of assets and rely on more complex infrastructure connecting multiple blockchains. That complexity creates larger attack surfaces, which is why bridge hacks have historically caused outsized losses compared with many lending protocol exploits.

Does this report mean DeFi lending is now low risk?

Not necessarily. The figures reflect realised historical losses over a specific 12-month period, not guaranteed future outcomes. Smart contract bugs, governance failures, oracle issues and market stress events can still create significant risks for lenders.

Image for illustrative purposes only. Not a real photo.

DeFi lending hack losses fall to 3 basis points

Written by Jon CuthbertPublished May 17, 2026, 11:54 PM

Users lending funds through DeFi borrowing markets on EVM chains and Solana lost roughly $3 for every $10,000 deposited over the past 12 months, according to analysis compiled from DefiLlama data.

Keyring Network founder Alex McFarlane calculated that non-bridge lending exploits totalled $30.9 million against an average $99.6 billion in total value locked, putting realised hack losses at about 3 basis points net of recoveries.

“The key question for hack/crime risk is: how large are realised exploit losses relative to the amount of capital using the market?”

McFarlane wrote, adding that:

“The probability was approximately equal to the rate of Americans that die by slipping and falling over.”

The research excluded bridge exploits, oracle failures and protocol-specific bugs, focusing instead on lending market incidents across major DeFi ecosystems to measure realised losses relative to deployed capital.

DefiLlama data shows broader DeFi gross hack losses reached $7.75 billion historically, although excluding bridge exploits lowers the figure to $4.52 billion, highlighting how bridge attacks disproportionately skew industry-wide security statistics.

Recoveries also reduced net losses materially, with capped recoveries across all DefiLlama-tracked DeFi exploits reaching roughly 8% of gross losses, while lending-specific recoveries on EVM and Solana climbed to about 20%.

Euler Finance became one of the sector’s highest-profile recovery cases after an attacker returned all stolen assets following the protocol’s 2023 flash loan exploit, while lending protocols including Aave and Morpho continue attracting the bulk of new DeFi lending capital.

At the time of reporting, Solana price was $84.41.