Over the past 12 months, lenders in DeFi borrowing markets on EVM chains and Solana experienced realized hack losses of approximately $3 for every $10,000 deposited, equating to 3 basis points of Total Value Locked (TVL). Keyring Network founder Alex McFarlane derived this figure from DefiLlama data on May 17, isolating lending markets and excluding bridge incidents. The trailing 12-month non-bridge lending exploits totaled $30.9 million gross against $99.6 billion average TVL, resulting in 3.1 basis points gross and 3 basis points net after recoveries. This loss rate is comparable to the annual U.S. death rate from slip-and-fall accidents. However, the data excludes bridge risk, oracle failures, and protocol-specific bugs, and assumes deposits were not in a market that suffered a tail event. Historically, DefiLlama records $7.75 billion in gross hack losses across DeFi, but excluding bridge incidents reduces that to $4.52 billion. In April, hackers stole $606 million, the worst month since Bybit's 2025 breach, with Kelp DAO and Drift hacks accounting for 95% of losses. Diversification and recoveries reshape risk: most exploits target components rather than entire protocols, and recoveries average 8% gross for all DeFi, rising to 20% for EVM/Solana lending excluding bridges. Builders advocate for minimalist design to reduce attack surface, as exemplified by Morpho's approach. While the $3 per $10,000 reading is realized history, it argues against alarmism without dismissing tail risk.

Key facts

• Realized hack losses: $3 per $10,000 deposited in DeFi lending over 12 months.
• 3 basis points of TVL, comparable to U.S. slip-and-fall death rate.
• Excludes bridge attacks, oracle failures, and protocol-specific bugs.
• Recoveries average 20% for EVM/Solana lending excluding bridges.
• Builders advocate minimalist design to reduce attack surface.

KeyAudit data perspective