Why DeFi Keeps Losing Millions to Exploits
In the first five months of 2026, DeFi hacks have caused losses exceeding $840 million, with April alone accounting for more than $600 million due to major exploits on KelpDAO ($292 million) and Drift Protocol ($285 million). Attacks continued into May, notably forcing THORChain to halt trading after a suspected cross-chain breach. According to DeFiLlama, various protocols have been targeted, exposing persistent architectural weaknesses, particularly across bridges and administrative controls. Security experts point to advances in AI enabling attackers to identify vulnerabilities more efficiently, and to North Korean state actors as the primary force behind the largest thefts; North Korea-linked groups accounted for 76% of losses so far in 2026. Common attack methods include privileged access failures, malicious contract upgrades, and cross-chain verification flaws. While incident numbers are stable compared to 2023, the scale of individual exploits is rising. Security professionals stress that audits alone are insufficient and that real-time coordination and AI-driven defenses are becoming essential. The repeated hacks are damaging confidence, especially among newer users, raising fundamental questions about DeFi’s long-term trustworthiness and safety.
