Hack-to-TVL Ratio: Is DeFi Getting Safer?
Quick answer. By losses per dollar locked, DeFi got safer from 2022 to 2025: the hack-to-TVL ratio fell from 3.28% to 0.63%. 2026 broke the trend at 1.38% through November 5, more than double 2025's 0.61% for the same months.
Video transcript
By losses per dollar locked, DeFi got safer from 2022 to 2025. Then 2026 broke the trend.
Hack totals alone can't show this, since more money locked can mean bigger losses. So Guardian divides DeFi hack losses by average TVL, using DefiLlama data.
From 2022 to 2025 the ratio fell every year, from 3.28 percent to 0.63 percent, an 81 percent drop. Losses stayed low while TVL recovered.
2026 reversed part of that. Through November 5, the ratio is 1.38 percent, more than double 2025's rate for the same months.
Bridge hacks explain much of the swing: 67 percent of DeFi losses in 2022, 5 percent in 2025, 34 percent in 2026. So do single incidents. Drift and Kelp DAO are nearly half of 2026's losses.
Falling token prices raise the ratio with no change in security. Exchanges are left out, though they took 78 percent of 2026 losses. And half of DeFi hacks since 2024 hit unlisted protocols.
The ratio shows what happened, not why. And a sector rate is a base rate, not a protocol rating.
Guardian's risk ratings underwrite each position on evidence: the deployed code, who controls it and what it depends on. Its score, from 0 to 100, moves when the protocol changes.
Read the full article for the method and its limits, or talk to Guardian about the protocols you hold.
Hack totals alone cannot say whether DeFi is getting safer. A year with more money in DeFi can expect larger losses.
So we divide each year's DeFi hack losses by the average value locked in DeFi that year. The result is a loss rate that can be compared across years.
Every ratio here is Guardian's computation from DefiLlama's public data, read November 6, 2026. Anyone can rebuild it from DefiLlama's API.
How the Ratio Works
The hack-to-TVL ratio is DeFi hack losses in a period, divided by average DeFi TVL over the same period.
- Losses: incidents DefiLlama labels "DeFi Protocol," summed by calendar year in UTC.
- TVL: the average of DefiLlama's daily total DeFi TVL across all chains.
- 2026: January 1 to November 5, the latest hack entry. It is not annualized.
DefiLlama's API documentation says this TVL series "excludes liquid staking and double counted tvl."
We use the average, not the year-end figure, because TVL moves a lot within a year. In 2022 it fell from $163.2 billion to $38.3 billion.
Divided by year-end TVL, 2022's ratio would be 7.46% instead of 3.28%.
The Ratio by Year
| Year | DeFi hack losses | Average DeFi TVL | Hack-to-TVL ratio | Without largest hack |
|---|---|---|---|---|
| 2020 | $157M (30) | $4.77B | 3.30% | 2.77% |
| 2021 | $2.47B (116) | $98.22B | 2.51% | 1.89% |
| 2022 | $2.85B (141) | $86.93B | 3.28% | 2.56% |
| 2023 | $818M (148) | $44.48B | 1.84% | 1.40% |
| 2024 | $796M (160) | $85.80B | 0.93% | 0.59% |
| 2025 | $757M (119) | $119.50B | 0.63% | 0.45% |
| 2026 to Nov 5 | $1.19B (236) | $85.97B | 1.38% | 1.04% |
Incident counts are in brackets. Losses are gross, before any recovery.
The last column drops each year's largest DeFi incident. From 2021 on, those were Poly Network, Ronin Bridge, Euler, PlayDapp, Cetus and Drift.
The ratio fell every year from 2022 to 2025, by 81% in all. Losses fell 71% in 2023 and kept edging down while TVL recovered.
Chainalysis saw the same pattern in its December 2025 report. In 2024 and 2025, it wrote, "TVL recovered while hack losses remained suppressed."
2026 reversed part of the decline. DeFi losses reached $1.19 billion, the most since 2022, while average TVL fell back to about 2024's level.
2026 so far, like for like
Because 2026 is a partial year, here is the same window, January 1 to November 5, in every year.
| Year | Ratio, Jan 1 to Nov 5 |
|---|---|
| 2021 | 2.44% |
| 2022 | 2.94% |
| 2023 | 1.31% |
| 2024 | 0.93% |
| 2025 | 0.61% |
| 2026 | 1.38% |
On this view, 2026 is 2.3 times 2025 and slightly above 2023.
Two incidents carry nearly half of it. Drift ($295 million) and Kelp DAO ($293 million) are 49.5% of 2026's DeFi losses.
Bridges and Big Incidents
Two things drive most of the swings: bridge hacks and single large incidents.
Bridges
Incidents DefiLlama flags as bridge hacks were 67% of DeFi losses in 2022 and 37% in 2023. They fell to 5% in 2024 and 2025, then rose to 34% in 2026.
Take bridges out and the 2022 to 2025 decline is smaller: from 1.09% to 0.60%. 2026 so far stands at 0.92%.
Our ranking of the biggest bridge hacks shows how concentrated those losses are.
Single incidents
- Each year's largest DeFi hack was 16% to 36% of that year's DeFi losses.
- Without it, the decline still holds: 2.56% in 2022 to 0.45% in 2025.
- Frequency moved the other way in 2026: 236 DeFi incidents to November 5, against 119 in all of 2025.
- The median 2026 DeFi incident was $410,000, the lowest of any year from 2020 on.
More small incidents may reflect wider coverage as much as more attacks. The data cannot separate the two.
Limits of the Metric
- Prices move TVL. When token prices fall, TVL falls and the ratio rises with no change in security.
- What counts as DeFi. Only DefiLlama's "DeFi Protocol" label. Liquid Network ($320 million) is labeled a chain and left out.
- Exchanges are out. They took 78% of all 2026 losses in DefiLlama's data, but their funds are not DeFi TVL.
- Unlisted protocols. Half of DeFi hacks since 2024 hit protocols missing from DefiLlama's listing, so their deposits are not in TVL.
- Gross losses. Returned and frozen funds are not subtracted.
- Missing amounts. 38 DeFi entries have no amount and count as zero.
- Early years. TVL averaged $0.02 billion in 2018 and $0.44 billion in 2019, too little for a meaningful ratio.
- 2020 swings. TVL grew from $0.6 billion to $15.1 billion that year, so its ratio depends heavily on the method.
The unlisted share comes from our report on audited vs unaudited exploits.
Other trackers count losses differently, so their totals would give other ratios. See why crypto hack reports disagree, and our crypto hack statistics for totals.
Reading the Numbers
The ratio shows losses per dollar locked fell sharply from 2022 to 2025, then rose in 2026. It does not show why.
Chainalysis offers two possible explanations for the earlier pattern. Protocols "may be implementing more effective security measures," or "attacker attention may be shifting to alternative targets."
Exchange hacks did rise from 44% of all DefiLlama losses in 2024 to 70% in 2025 and 78% in 2026.
But one theft each year makes up most of those exchange losses: Bybit in 2025, and Binance on October 29, 2026.
A sector rate is a base rate, not a rating. One protocol's risk depends on its own code, keys, verifiers and dependencies.
How Guardian Helps Allocators
Guardian's risk ratings for capital allocators underwrite a position on evidence: the deployed code, who controls it and what it depends on.
Each position gets a score from 0 to 100, with every input visible underneath it.
The score moves when the protocol changes, such as a new implementation, signer set or oracle source.
For protocol teams, Managed Security monitors contracts on every block and reviews every multisig transaction before it is signed.
Frequently Asked Questions
Is DeFi getting safer?
By losses per dollar locked, it did from 2022 to 2025: the ratio fell from 3.28% to 0.63% of average TVL. In 2026 it rose to 1.38% through November 5, more than double 2025's rate for the same months.
What percentage of DeFi TVL is hacked each year?
Between 0.63% and 3.30% a year from 2020 to 2025, in Guardian's count of DefiLlama data. The highs were 2020 and 2022, and the low was 2025. 2026 stands at 1.38% through November 5.
Why use average TVL instead of year-end TVL?
TVL moves a lot within a year. In 2022 it fell from $163.2 billion to $38.3 billion, so dividing by year-end TVL would put 2022's ratio at 7.46% instead of 3.28%.
Does the ratio include exchange hacks?
No. It counts only incidents DefiLlama labels DeFi Protocol. Exchanges took 78% of all 2026 losses in DefiLlama's data, and their funds are not part of DeFi TVL.
Sources
- DefiLlama: Hacks dataset API (read November 6, 2026)
- DefiLlama: Historical total DeFi TVL API (read November 6, 2026)
- DefiLlama: API documentation, free endpoints (read November 6, 2026)
- Chainalysis: North Korea Drives Record $2 Billion Crypto Theft Year, Pushing All-Time Total to $6.75 Billion (December 18, 2025)
- Guardian: Were Hacked Protocols Audited? Audited vs Unaudited Exploits (November 2026)
- Guardian: Crypto Hack Statistics 2026 (November 2026)
- Guardian: Crypto Hack Statistics Compared, Why the Reports Disagree (November 2026)
Underwrite the protocols you hold
A sector loss rate is a starting point; Guardian scores each position on its own code, controls and dependencies, and re-scores it when they change.