DeFi's attack surface has shifted from code to people, infrastructure, and interconnected risk.
We publish these reports because understanding where value breaks is the foundation of everything we build at Incentive.
Full Q1 data sourced from DeFi Llama, PeckShield, CertiK, Halborn, and Chainalysis.
🧵 Incentive Q1 2026 DeFi Hack Report
34 protocols exploited. $168.6M drained. And a nation-state operation that took six months to set up.
Q1 2026 was down 89% from Q1 2025, but the attacks that landed were far more sophisticated.
Here's what happened and what it means 👇
Q1 2025: $1.58B stolen (Bybit alone was $1.4B)
Q1 2026: $168.6M stolen (pure DeFi)
That's an 89% decline year-over-year, but include phishing + social engineering: ~$450M across 145+ incidents.
The protocols got harder to crack. So attackers went after the people instead.
Another day, another $26M gone.
@Truebitprotocol exploited through a mispriced minting function in a 5-year-old purchase contract—letting attackers buy TRU tokens at pennies.
First hack of 2026: frozen liquidity, no exit. This is why we're building claim markets for DeFi.
Crypto Hacks vs. Fundraising Overview
As the industry grows, more bad actors are targeting it. Crypto is a prime example, with hacks hovering around $3B per year. Here’s the share of hacked funds relative to total funds raised each year:
• 2021: 8%
• 2022: 10%
• 2023: 25%
• 2024: 20%
• 2025: 10%
THIS ONE IS FOR BUILDERS.
Between 10–25% of annual DeFi fundraising is lost to hacks, forcing a choice: stop building, dilute your community, or lock users into uncertainty.
We help protocols manage this risk and ensure capital never gets stuck.
@brian_armstrong DeFi has generated ~$50B in yield since 2018 — and lost over $23B to exploits (not even counting single-wallet drains).
That asymmetry keeps institutions out. The risk-reward equation is upside-down.
We’re fixing it with TradFi-grade guarantees for DeFi. Let’s talk.
@klarnaseb Since 2018, DeFi users earned ~$50B in yield but lost over $23B to exploits.
That imbalance is why institutional liquidity still stays out. DeFi’s risk–reward ratio is upside-down.
We fix that by introducing TradFi-like guarantees - Let’s chat!