Across EVM chains and Solana, DeFi lending hacks have produced an annualized loss rate around $3 per $10,000 deposited, about 3 basis points of TVL.

The risk metric provides a priced, measurable sense of lending risk in DeFi, informing lenders, insurers, and allocators.

DefiLlama data show gross DeFi losses totaling about $7.75 billion historically, with bridges accounting for a significant portion and skewing the overall risk picture.

Excluding bridge incidents, cumulative gross losses reach roughly $4.52 billion in DeFi history, highlighting that bridge events disproportionately distort risk metrics.

Industry guidance urges diversification across DeFi lending protocols and lean, minimalistic code designs to reduce attack surfaces, with emphasis on immutability and simplicity from Morpho contributors.

Aave and Morpho continue to attract new lending capital, while 2026 has seen notable incidents such as the April KelpDAO breach.

Loss patterns show exploits often target individual components rather than entire protocols, with larger markets absorbing smaller percentage losses.

Recoveries reduce headline losses, totaling about 8% of gross DeFi losses across all affected protocols, and around 20% when focusing on EVM and Solana lending excluding bridges.

The $3 per $10,000 figure reflects historical realized losses and does not guarantee future results, as tail risks remain.

Trailing 12-month non-bridge lending exploits total $30.9 million gross against $99.6 billion average TVL, equating to roughly 3.1 basis points gross and 3 basis points net after recoveries.

Loss distributions are skewed, with a few mega-events driving most damage while many incidents are small, following a lognormal pattern.

April 2026 saw $606 million in hacks, driven largely by Kelp DAO and Drift exploits, marking the worst month since 2025 breach activity.