Cost of a Crypto Hack: The Bill Beyond the Stolen Funds
Quick answer. Beyond the theft, a hack costs the token, the deposits, lenders' bad debt, bounties and remediation. In Guardian's check of $10M+ DeFi hacks since 2024, the median token fell 34% in 30 days and median TVL fell 71%.
Video transcript
Headlines report the amount stolen. Boards pay a larger bill, from token falls to fleeing deposits and bad debt.
Start with the theft. Immunefi found an average of 24.5 million dollars across 191 hacks in 2024 and 2025, but a median of 2.2 million.
Some money comes back. Hacken found 33 percent of third quarter 2026 losses were returned or reversed. Operators covered 410 million more, but covered is not recovered.
The token reprices. In Guardian's check of DeFi hacks of ten million dollars or more since 2024, the median token fell 34 percent in 30 days, while ETH rose 6 percent.
Deposits leave too. Across 18 hacked protocols, median total value locked fell 71 percent in 30 days, a figure that includes the stolen funds.
Other lines follow. LlamaRisk estimated 123.7 to 230.1 million dollars of Aave bad debt. Add bounties, remediation, and sometimes the business itself, as DMM Bitcoin announced it would shut down.
Speed is the gap. Guardian's detection study found the money was usually gone by the median pause, 88 minutes in.
Guardian's Managed Security watches contracts on every block for privileged calls, upgrades and large fund movements. When something fires, a Guardian engineer responds.
Count every line, not only the theft. Read the full study, or talk to Guardian at guardian.security and stop the bill before it starts.
Headlines report the amount stolen. Boards pay a larger bill.
The token reprices, depositors leave, lenders that took the token as collateral book bad debt, and the team spends months on recovery.
We measured the parts that can be measured, using DefiLlama's public data and published figures. We added nothing we could not source.
Direct Losses and What Comes Back
- Average theft: $24.5M across 191 hacks in 2024 and 2025, according to Immunefi.
- Median theft: $2.2M in the same study. The average is 11.1 times the median.
Some of the stolen money comes back. Hacken's split of Q3 2026 shows how much, as reported by Cointelegraph.
| Q3 2026 outcome | Amount | Main cases |
|---|---|---|
| Returned or reversed | $387M (33%) | Liquid Network, Tectonic |
| Covered by operators | $410M | Bitget's user protection fund |
| Neither returned nor covered | $384M (32%) | Remaining loss |
| Gross losses | $1.18B | 107 incidents |
"Covered" is not recovered. Bitget's fund absorbed $387M, so the loss moved from users to the operator.
- Liquid Network: self-described white hats returned $272M, about 85% of the stolen value.
- Tectonic: a Cronos rollback reversed about $111.2M of $120.4M in affected borrowing.
- Cetus: Sui validators froze $162M of $223M, according to Rekt.
- Binance: about 42% of the $6.36B was frozen by 00:30 UTC on October 30, according to TRM Labs.
Token Price Impact
We priced the protocol's own token the day before each large DeFi hack, then 7 and 30 days after. ETH over the same days is the market benchmark.
- 7 days: the median token fell 22% while ETH rose 1%. 21 of 22 tokens were down.
- 30 days: the median token fell 34% while ETH rose 6%. 18 of 21 were down.
- Worse than the market: 18 of 21 tokens trailed ETH at 30 days, and 6 lost half or more.
| Protocol | Hack | Token, 30 days | ETH, 30 days |
|---|---|---|---|
| Cetus | May 2025 | -55% | -5% |
| Drift | Apr 2026 | -35% | +11% |
| Balancer | Nov 2025 | -31% | -23% |
| Humanity | Jun 2026 | -89% | +13% |
| Step Finance | Jan 2026 | -97% | -31% |
| GMX | Jul 2025 | +5% | +54% |
The damage lasts. Immunefi's study of 82 hacked tokens found a median fall of about 10% in two days and 61% after six months.
At six months, 56.5% of those tokens were down more than half, and 83.9% were in what Immunefi calls sustained price suppression.
Deposits Leave
Total value locked (TVL) is the deposit base. After a hack, it drains.
| Protocol | TVL day before | 2 days after | 30 days after |
|---|---|---|---|
| Drift | $307M | -97% | -98% |
| Balancer V2 | $441M | -60% | -62% |
| Cetus | $238M | -85% | -70% |
| GMX V1 | $56M | -75% | -82% |
| Radiant V2 | $75M | -68% | -93% |
| Aave V3, after Kelp DAO | $25.67B | -32% | -47% |
Across 18 hacked protocols, median TVL fell 44% in two days and 71% in 30 days. 12 of the 18 lost half or more by day 30.
TVL includes the stolen funds and moves with token prices, so it overstates deposits withdrawn. Over the same two days, ETH moved 5% or less in 15 of the 18 cases.
The Aave line shows contagion. Kelp DAO's rsETH was collateral on Aave, and Aave V3's TVL fell $8.13B in two days while ETH fell 4%.
Bad Debt, Bounties and Remediation
Bad debt at lenders
LlamaRisk's incident report on the Aave forum estimated $123.7M to $230.1M in Aave bad debt from the rsETH exploit, depending on how losses were shared.
The same report put the Aave DAO treasury at $181M.
Bounties and response
- GMX V1: the attacker returned funds and kept a $5M bounty, according to DefiLlama.
- Bybit: launched a $140M recovery bounty program, about 10% of the stolen funds, according to Rekt.
- SEAL Safe Harbor: white hat bounties set at 10% of recovered assets, capped at $1M.
- Resolv: Mandiant and ZeroShadow ran the investigation, according to Rekt. The cost was not published.
Remediation and closure
- Coinbase (May 2025): preliminarily estimated $180M to $400M for remediation and voluntary customer reimbursements. A threat actor had paid support contractors or employees for customer data.
- DMM Bitcoin (2024): raised about ¥55B ($365.1M) in June after losing 4,502.9 BTC.
- DMM Bitcoin, six months later: it announced it would shut down and move accounts to SBI VC Trade.
We found few published legal or forensic costs. Immunefi says a hack burns at least three months of organizational effort on response and remediation.
What Prevention Has to Beat
A board weighing security spend should count every line, not only the theft.
- Direct theft, net of what is returned or frozen.
- Losses the company covers from its own balance sheet.
- Token value lost: a median 34% in our 30-day check.
- Deposits lost: a median 71% of TVL in 30 days.
- Bad debt in protocols that accepted your token.
- Bounties, forensics, legal and customer remediation.
- Months of team time, and sometimes the business itself.
Speed is the gap. Our study of how fast crypto hacks are detected found the money was usually gone by the median pause, 88 minutes in.
A rehearsed incident response plan shortens it.
How We Counted
- Sample: DeFi protocol hacks of $10M or more in DefiLlama's data, January 2024 to October 2, 2026. 36 incidents.
- Tokens: each protocol's own token, mapped by hand. 22 had price data in DefiLlama's coins API, 21 at 30 days.
- Prices: DefiLlama's daily price at 00:00 UTC on the day before the hack, and 7 and 30 days after the hack date. ETH on the same dates is the benchmark.
- TVL: DefiLlama's daily protocol TVL on the day before, and 2 and 30 days after, for 18 protocols with at least $1M before the hack.
- Medians are of simple percentage changes across protocols. Anyone can rebuild them from DefiLlama's public APIs.
- Attacker minting: at PlayDapp, Gala, Humanity and Truebit the attacker minted tokens, which deepens those falls.
- Other costs are as published by the team, a regulator filing or a research firm.
For the year's headline totals, see our crypto hack statistics.
How Guardian Helps
Managed Security is built to stop the losses that start this bill.
Guardian monitors contracts on every block for privileged calls, upgrades and large fund movements. When something fires, a Guardian engineer responds.
Frequently Asked Questions
What does a crypto hack cost beyond the stolen funds?
Usually the token and the deposits. In Guardian's check of $10M+ DeFi hacks since 2024, the median token fell 34% in 30 days and median TVL fell 71%. Lenders' bad debt, bounties, remediation and team time come on top.
What is the average loss in a crypto hack?
Immunefi's study of 191 hacks in 2024 and 2025 found an average theft of $24.5 million and a median of $2.2 million. A few very large hacks pull the average to 11.1 times the median.
How much stolen crypto is recovered?
It varies widely. Hacken found 33% of Q3 2026 losses were returned or reversed, operators covered $410 million more, and 32% was neither. TRM Labs reported about 42% of the Binance theft frozen by early October 30 (UTC).
Do token prices recover after a hack?
Rarely within months. Immunefi found a median decline of 61% six months after a hack, with 83.9% of tokens in sustained price suppression. In Guardian's 30-day check, 18 of 21 tokens were below their pre-hack price.
Sources
- DefiLlama: Hacks dataset API (pulled November 4, 2026)
- DefiLlama: API documentation for the coins price and protocol TVL endpoints (queried November 4, 2026)
- Immunefi: What an Onchain Hack Actually Costs, 2024 to 2025 Update (March 25, 2026)
- Cointelegraph: Bitget, Liquid Exploits Push Q3 Crypto Hacks Toward $1.2B, citing Hacken (October 15, 2026)
- TRM Labs: North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026 (October 30, 2026)
- Rekt: Cetus, Rekt (May 2025)
- Rekt: Tectonic, Rekt (August 2026)
- Aave governance forum: rsETH Incident Report by LlamaRisk (April 20, 2026)
- Rekt: Bybit, Rekt (February 22, 2025)
- Security Alliance (SEAL): Safe Harbor (accessed November 4, 2026)
- Rekt: Resolv Labs, Rekt (April 7, 2026)
- Coinbase: Form 8-K filed with the SEC (May 15, 2025)
- The Block: DMM Bitcoin to Shut Down, Transfer Assets to SBI Group Unit (December 1, 2024)
Stop the bill before it starts
Guardian watches your contracts on every block, and an engineer responds when something fires.