When a DeFi protocol is hacked, the headline is the amount stolen. The bigger loss usually comes after, when depositors leave. We matched 202 hacks since 2020 against DefiLlama’s daily deposit data and found that six months later the typical hacked protocol held 22.5% of the money it had the day before the hack. Protocols of the same type and size, measured over the same six months, held 65.5%.
Only 11% of hacked protocols were back to their pre-hack size after six months, against 29% of their peers. And 38% had lost 90% or more of their deposits, against 11%.
Key findings
- Six months after a hack, the median DeFi protocol with $1 million or more in TVL the day before held 22.5% of its pre-hack total value locked, against 65.5% for up to five protocols of the same category and size over the same dates (142 hacks, 2020 to 2026, DefiLlama).
- 11% of hacked DeFi protocols were back at or above their pre-hack TVL 180 days later, against 29% of matched peers (difference 11 to 24 points, 95% interval); 38% had lost 90% or more of their TVL, against 11% of peers.
- When the amount stolen was half of a DeFi protocol’s TVL or more, the median protocol held 1.5% of its pre-hack TVL six months later and 69% had lost 90% or more (39 hacks, 2020 to 2026); when it was under 10%, the median held 51% (80 hacks).
- Subtracting the amount stolen from the pre-hack base, the median hacked DeFi protocol still held only 35% of its remaining TVL 180 days later (159 hacks), so most of the decline is withdrawals rather than the theft itself.
- Hacked DeFi protocols were not shrinking before the hack: in the 30 days before, their median TVL rose 1.0% while matched peers fell 3.6%, a difference of +3.0% (95% interval -2.9% to +6.1%, 174 hacks).
- Caveat: TVL is the dollar value of tokens in a protocol, so it also falls when the protocol’s own token crashes after a hack; matching peers on the same dates removes market-wide moves but not that. A relaunch under a new version (Euler V1 to V2) counts as a loss.
Deposits keep leaving for months
We used every hack in DefiLlama’s database that it links to a tracked protocol, took each protocol’s first hack only, and kept the ones with at least $1 million in total value locked (TVL) the day before. That leaves 202 hacks from April 2020 to September 2026, mostly lending markets (59) and exchanges (38). For each hack we found up to five protocols in the same DefiLlama category, with TVL between half and double the hacked protocol’s on the same day, and no hack of their own within a year. Dead protocols are in the pool too, so the peers are not just the survivors.
The gap opens fast and keeps growing. After 30 days the median hacked protocol held 49% of its deposits and its peers 95%. After 90 days, 36% against 87%. After 180 days, 22.5% against 65.5% (142 hacks with peers). Put another way, six months on the typical hacked protocol was 60% smaller than its peers had become (95% interval 38% to 72%).
The peers lose money too: DeFi deposits are priced in tokens that fall in bear markets, and many small protocols fade on their own. That is why the comparison is made on the same dates, so a crypto crash hits both sides.
It is not just the stolen money
Part of the drop is mechanical: the stolen funds were in the TVL and now they are not. So we subtracted the amount stolen from the starting point and measured again. The median hacked protocol still held only 35% of what was left after the theft six months later (159 hacks). Most of the decline is depositors walking out, not the hacker’s take.
The size of the hit still matters a lot. When the hacker took less than 10% of the TVL, the median protocol held 51% of its deposits after six months (80 hacks). Between 10% and 50%, it held 17% (50 hacks). When half or more was taken, it held 1.5%, and 69% of those protocols lost 90% or more (39 hacks). Mango Markets (October 2022), the Nomad bridge (August 2022) and Qubit (January 2022) all went to almost zero.
Size helps. Protocols with $100 million or more before the hack held a median 71% of it after 90 days (48 hacks); those with $1 million to $10 million held 14% (62 hacks). Compound kept 72% six months after its $147 million distribution bug in September 2021, and Curve kept 81% after its front end was hijacked in August 2022.
Getting the money back does not bring depositors back
In 13 hacks DefiLlama records that some funds were returned. Those protocols held a median 41% of their deposits after 90 days, against 39% for the 174 with nothing returned. The group is small, but nothing suggests a refund wins depositors back. Euler is the extreme case: the attacker returned the funds from its $197 million hack in March 2023, users were repaid, and Euler V1 still never got its deposits back. The team later launched Euler V2 as a new protocol.
Timing matters. In the 2020 and 2021 bull market, 46% of hacked protocols were back above their pre-hack size 90 days later (24 hacks). Since 2024 it has been 5% (84 hacks).
Our earlier study of $20.65 billion in crypto hacks asked whether stolen money comes back (2% of it did). This one asks a different question: what happens to the protocol and the deposits that were not stolen.
Were they already shrinking?
One worry is that hackers pick protocols that are already in trouble, so the decline would have happened anyway. The data say no. In the 30 days before the hack, the median hacked protocol’s TVL rose 1.0% while its peers’ fell 3.6%. The difference, +3.0% (interval -2.9% to +6.1%), is not distinguishable from zero. The drop starts with the hack.
What this is not
TVL is not a count of users or of dollars deposited. It is the dollar value of the tokens in a protocol, so it falls when token prices fall even if nobody leaves. Matching peers on the same dates removes the market-wide move, but not a crash in the hacked protocol’s own token, which often follows a hack and counts here as lost deposits.
A relaunch counts as a loss. When a team moves users to a new contract or a new version, as Euler did, DefiLlama often tracks it as a separate protocol, and we see the old one go to zero. We excluded sister versions from the peer group but did not add them back to the hacked protocol.
The dataset covers hacks that DefiLlama links to a protocol it tracks. Of 1,320 incidents in its database, 783 have no such link: 478 DeFi protocols DefiLlama never listed or no longer tracks, plus exchanges, tokens, chains and wallets. Small and obscure protocols are underrepresented, and they tend to fare worst, so if anything our numbers flatter hacked protocols. Weighted by dollars instead of by protocol, the picture is much milder, but it is driven by giants with tiny incidents: Aave V3’s $0.9 million incident in March 2026 alone accounts for 47% of the dollar decline, so we do not use that measure.
This is about protocols, not about your deposit. A falling TVL means money left, not that depositors lost it.
Download the data (CSV)
defi-hacks-tvl-after-2020-2026.csv: one row per first hack of a DeFi protocol with $1 million or more in TVL the day before, April 2020 to September 2026 (202 rows). Columns: hack date, protocol, DefiLlama category, technique, amount stolen and returned (USD), TVL the day before, TVL 30, 90 and 180 days later as % of the day before, median of matched peers at 90 days, and the number of peers matched. Free to use and cite under CC BY 4.0 with attribution to BullpenBrief and a link to this page.
Methodology
Data come from three DefiLlama endpoints, downloaded October 26, 2026: the hacks database (date, amount stolen, technique, funds returned and the linked protocol), the list of protocols with category and parent protocol, including dead ones, and each protocol’s daily TVL history. Of 1,320 hacks, 783 are not linked to a protocol on DefiLlama’s current list and 29 are exchanges or chains. We kept each protocol’s first hack (84 repeat hacks dropped) and dropped 22 protocols without TVL history, 104 hacks without TVL data in the 30 days before, 93 with less than $1 million in TVL the day before and 3 less than 30 days old. That leaves 202 hacks of 202 protocols from April 18, 2020 to September 22, 2026.
The starting point is TVL on the day before the hack. We measure TVL 30, 90 and 180 days later as a share of it, only where that much time has passed (201, 187 and 169 hacks). If DefiLlama’s series ends before the horizon, we use its last value; this happened once. Back to pre-hack size means a share of 100% or more; lost 90% or more means under 10%.
Peers come from a random sample of up to 700 protocols per DefiLlama category (5,701 in all, live and dead alike), in categories with at least three hacks. For each hack we take up to five protocols in the same category with TVL between 0.5 and 2 times the hacked protocol’s on the day before, closest in size first, with at least 30 days of history, no hack within 365 days and a different parent protocol. 173, 159 and 142 hacks have at least one peer at 30, 90 and 180 days. The size gap is the median, across hacks, of the hacked protocol’s log change in TVL minus the average log change of its peers. Intervals are 95% bootstrap intervals over hacks. The pre-hack check repeats the same comparison for the 30 days before the hack. Figures, charts and the method are free to cite with attribution to BullpenBrief.
