DeFi's Old Hack Vectors Fade, But Shared Code Creates New Multi-Chain Risk

Decentralized finance has gotten a lot safer over the past six years, and a new review of protocol losses from 2020 through 2025 puts a pretty large number behind that claim. Industry-wide DeFi losses peaked at $2.62 billion in 2022 and fell roughly 80% to $534 million by 2024. Bridge hacks that once produced billion-dollar headlines now account for a tiny slice of annual totals, and the typical exploit today does about a quarter as much damage as it did at the peak. While this is certainly great news for the crypto industry, there's still quite a bit of risk left; it just shows up in a different place. Major protocols now often deploy the same code across Ethereum, Base, Arbitrum, Polygon, OP Mainnet, and Sonic, so a single flaw can drain funds on every network running it at the same time, and that's the form crypto's next systemic problem is likely to take.

We saw this in November last year, when Balancer's V2 Composable Stable Pools were drained of roughly $128 million in under half an hour across six blockchains simultaneously. According to Check Point Research, the attacker exploited an arithmetic precision flaw in the pools' invariant math, nudging token balances onto a rounding boundary and then chaining batched swaps until those tiny errors compounded into a full drain. The contracts with the same vulnerability had been deployed on Ethereum, Arbitrum, Base, Polygon, Sonic, and OP Mainnet, so the exploit reached all of them at once because the flaw was embedded in the code itself, and that code had been copied everywhere. As CryptoSlate reported at the time, eleven separate audits had failed to catch it, which tells you just how subtle this class of bug has become and why it's so much harder to anticipate than the attacks that came before.

The hacks got smaller as the chains multiplied. The encouraging part of the data is that the cheap, repeatable attacks that defined crypto's early years have mostly been engineered out of existence, and total losses dropped 80% in two years, even as DeFi's TVL kept climbing. A huge drop was also seen in the median loss per incident, which fell from $6 million in 2022 to $1.5 million in 2025, a 75% decline. The count of unique incidents actually rose to 83 in 2025, so more hacks are happening while each one does far less damage, which is roughly what a maturing security field is supposed to look like.

Bridges were the defining vulnerability in 2021 and 2022, and in that second year alone, nine bridge exploits resulted in $1.9 billion in losses. These hacks were truly some of crypto's worst moments, with the Ronin Bridge accounting for a $624 million loss on its own. CryptoSlate tracked it on-chain as the funds moved through Tornado Cash, followed by Binance Bridge at $570 million, Wormhole at $326 million, Nomad at $190 million, Harmony at $100 million, and Qubit at $80 million. It accounted for 73% of all DeFi losses that year, and by 2025, the bridge's share had collapsed to 3%, thanks to improved verification mechanisms, decentralized validator sets, and a broader shift toward native cross-chain messaging.

Flash-loan attacks followed the same path down. They represented 54% of all losses in 2020 when they were the signature DeFi technique, and by 2025, they accounted for under 1%, because protocols adopted defenses tailored specifically to that attack: time-weighted average prices, Chainlink oracle integrations, reentrancy guards, and designs that assume an attacker can manipulate prices within a single atomic transaction. Private-key compromises saw a similar decline, falling from 28.7% of losses in 2022 to 8.1% in 2025.

Each of these categories shrank for the same underlying reason, which is that the industry recognized a repeatable pattern and built a standardized answer to it, and as CryptoSlate's year-end review of 2025 found, those answers have largely held.

What's left is harder to defend against. Closing off the generic attacks left behind a far more difficult category