The value held inside decentralized-finance applications has dropped roughly 39% so far in 2026, falling from about $115 billion in January to just over $70 billion and erasing close to $45 billion, according to Cointelegraph citing data aggregator CryptoRank. (That precise framing traces to a single aggregator and a start-of-year baseline.)
DeFi refers to financial services — lending, trading, yield generation — that run on blockchains through automated programs called smart contracts, rather than through banks or brokerages. The standard gauge of the sector's size is total value locked, or TVL: the dollar value of crypto assets users have deposited into those applications. A smart-contract exploit is an attack that abuses a flaw in that code to drain deposited funds.
Two forces, both at work
TVL can fall for two distinct reasons. The first is price: much of what is "locked" is volatile tokens, so when their prices drop, the dollar figure shrinks even if no one withdraws. The second is genuine capital flight — users pulling assets out. Both are at play.
Bitcoin has slid more than 50% from its October peak near $122,000, falling below $63,000 in early June for the first time since February, after sustained ETF outflows and weakening sentiment. Falling token prices mechanically lower TVL before any withdrawals.
A record run of theft
Layered on top is an exceptional run of hacks. The original report counts 121 hacks in 2026 to date and roughly $942 million stolen, with the second quarter the most-hacked on record by number of incidents. Cross-firm tallies vary by method, but the trend is corroborated: Immunefi found crypto losses averaging about $25 million per incident, with a few outsized breaches skewing totals.
The largest 2026 incident cited was a $293 million exploit of restaking protocol Kelp DAO in April. The report says it triggered a cascade, with users withdrawing about $15 billion from lending protocol Aave within four days — a vivid example of how a code failure becomes capital flight. BeInCrypto reported TVL fell across all top 20 chains after the hack.
The two forces compound. A downturn thins liquidity and pressures prices; a major hack erodes confidence, prompting users to flee protocols they fear could be next, which deepens the slide. DefiLlama data shows Ethereum, Solana, BSC, Arbitrum and Base all posting double-digit TVL declines over a recent 30-day window.
Not uniformly grim
The picture has nuance. The hack totals, while a record by count, remain below the worst dollar quarters of prior cycles — Chainalysis put 2025 crypto theft at about $3.4 billion, much of it from a single $1.5 billion Bybit breach. Some analysts frame the drawdown as a stress test rather than a structural break, noting it is far smaller than the 2021–2022 bear market, and a large share of stablecoins — tokens pegged to a currency such as the U.S. dollar — has stayed put. Whether the bleeding has stopped remains tied to the wider crypto market.
