Why is DeFi safer than it looks.
Who hasn't been hit by an incident or felt the bullet very close? Who isn't scared right now to deploy in DeFi? I think it's fair. $3.4B stolen in 2025, another billion in H1 2026. The fear is real. But what if the actual DeFi landscape was actually built on irrational sentiment?
I went through every major exploit on Ethereum and Solana from January 2024 to today. Here's what the data says.
The code is getting stronger and stronger.
Ask people what a "DeFi hack" is and a lot will describe a smart contract bug. Some genius finds a flaw in the code, drains the pool, gone.
That's now roughly 12-14% of stolen value. Every year since 2024. Every tracker agrees.
The other 85%+: keys, humans, and infrastructure.
Bybit lost $1.5B because the signing interface their executives used was poisoned. They approved a transaction that wasn't what their screen showed. Drift lost $285M after attackers spent six months social-engineering their Security Council into pre-signing blank checks. Step Finance: phished treasury key. BonkDAO: someone bought 1% of the token supply for $4.4M, passed a malicious governance proposal nobody read, walked away with . WazirX, Radiant, Phemex, DMM: keys, keys, keys, keys.
None of these are "DeFi broke." These are the oldest crimes in finance wearing new clothes: forged signatures, insider access, con men.
The code layer is quietly excellent now.
On Solana specifically, over 2.5 years: net user losses from actual smart contract bugs in live protocols land around . Total. On an ecosystem that peaked at $12B TVL.
The exploits that did happen mostly got returned (Loopscale: 100% recovered, Texture: 90%, Raydium: refunded by the team). And the protocols everyone actually uses, Jupiter, Kamino, Orca, marginfi, Sanctum, Meteora: zero production exploits.
The big code failures that do still happen have a pattern. Balancer lost $120M+ to a rounding bug in code that was 4.5 years old and audited by everyone. GMX v1: 2021 code. Raydium's June incident: a deprecated 2021 pool still holding funds. Truebit: legacy contract, integer overflow. Old, forgotten code that nobody was watching anymore. The other cluster: protocols pricing another protocol's token as collateral, where one bad assumption in the middle of the sandwich breaks the whole thing.
So the actual risk map: humans with privileged access, abandoned code, and deep protocol-on-protocol leverage stacks. Not "DeFi."
"But AI is making it worse"
Also aimed at the wrong thing. Split the question in two. Did AI find the bugs and write the exploits? No evidence, anywhere: not one post-mortem of Bybit, Drift, Balancer or KelpDAO cites AI in the technical execution. Did AI help run the cons? At Drift, everyone assumes so, and it's a fair assumption, because North Korea demonstrably uses AI to fabricate identities and deepfake video calls elsewhere. But look at what the investigations actually describe: a fake trading firm, a million dollars deposited to build trust, six months of patience. Techniques older than the internet. Maybe AI wrote their emails. Humans ran the con, and blind signing did the stealing.
Where AI provably shows up in the data: scams. AI-run scam operations extract 4.5x more per operation than non-AI ones. Impersonation scams up 1,400% in 2025. Deepfakes in ~40% of high-value fraud. Where North Korea uses AI: fake identities to pass job interviews, deepfake Zoom calls. AI made the cons better. It didn't make the code weaker.
Honest caveat, because these things age badly: in lab benchmarks, frontier models can now reproduce about half of historical contract exploits. That capability is real and growing. But teams aren’t helpless. The defender scans first. You can run the same models on it before deployment and on every release. The attacker only gets it after. An AI model found a 4-year-old critical bug in Zcash before any attacker did. Code security is one of the rare domains where AI compounds faster for defense, as long as the code is actually being watched.
The code AI doesn't protect: dead code. Deprecated pools still holding funds, contracts whose teams left in 2022. That's where the free lunch is, and attackers know it.
The 7 questions that actually protect you.
Stop asking "is DeFi safe." You're not going to audit code anyway. What you can check is whether the team removed themselves from the attack surface. Seven questions, and the good ones have answers you can verify on-chain:
1. Can the team touch my funds?
The only acceptable answer is no, structurally: non-custodial, no admin key over user deposits. Better yet, ask for the blast radius: "if every key you own is stolen tonight, what happens to my money?" A serious team has that answer written down. This one question covers the vector behind 85% of everything stolen.
2. Who can change the code under my deposit, and how fast?
On Solana, the program's upgrade authority is public in the explorer. Immutable, or a real multisig behind a timelock: fine. A single wallet: walk away. The delay between "upgrade approved" and "upgrade live" is your exit window.
3. Can a governance vote move user funds?
BonkDAO lost $20M because the answer was yes, with no timelock. Best answer: governance can't reach deposits at all.
4. Is the audit on the code that's actually deployed?
Not "we're audited" but which firm, which version, where's the report. Code shipped after the audit is unaudited code. "Audited in 2022" is not an answer, it's a warning.
5. What do you trust that you didn't build?
Every oracle, every external token accepted as collateral, every protocol funds flow through is a wall someone else built. Then the follow-up that separates real teams from tourists: "what happens to my position if that dependency breaks?" Loopscale got hit pricing another protocol's token. Fewer walls, smaller blast radius.
6. Where does old code go to die?
Deprecated versions should be drained and disabled. Raydium's 2026 loss was a 2021 pool nobody had emptied.
7. What happens when, not if?
Monitoring, a pause switch, an incident plan, a public security contact. Teams that planned for compromise recovered everything (Loopscale: 100% returned). Teams that assumed it couldn't happen wound down.
Protocols that clear all seven exist. Their realized contract risk, per the last 2.5 years of data, is measured in basis points of TVL per year. Meanwhile the "safe" alternative, leaving funds on an exchange, is precisely the custodial honeypot model that produced the single largest theft in crypto history. Nobody outside Bybit got to run this checklist on Bybit. In DeFi, you're allowed to demand answers, and mostly verify them yourself.
DeFi isn't risk-free. It's risk-legible. On-chain, you can read the blast radius before you deposit. Try doing that with an exchange's hot wallet you'll never see.
That's the trade. The data says it's a better one than the headlines suggest.
