Binance Research’s May 2026 market report revealed that a wave of DeFi security exploits in April triggered approximately $13 billion in total value locked (TVL) outflows, marking one of the sector’s largest monthly capital exoduses. The exchange’s research arm attributed the drawdown to a record 28 hack incidents that month, which saw $635.24 million in direct exploit losses—the highest monthly total since the Bybit incident in February 2025.
The two largest attacks were on Drift Protocol (~$285 million) and KelpDAO (~$292 million), together accounting for $577 million. Reports linked both to North Korea’s Lazarus Group, highlighting how DeFi risk now extends beyond code bugs to social engineering, compromised governance, and bridge infrastructure weaknesses. The KelpDAO incident also created ~$230 million in bad debt on Aave, slashing its TVL by half and demonstrating how a single bridge failure can cascade through lending markets.
Binance Research noted that despite a broader crypto pullback, “meaningful deleveraging has yet to materialize.” The on-chain leverage ratio climbed to about 38%, a level last seen in 2021, driven by shrinking TVL rather than renewed borrowing demand. With a smaller capital base, each dollar of debt weighs more heavily on the system. CoinDesk separately reported that the bulk of the $13 billion outflow occurred within 48 hours of the KelpDAO hack, showing how fast confidence can evaporate.
Security incidents continued after April. Later cases involving Humanity Protocol ($36 million stolen via compromised bridge admin keys), Aztec Connect ($2.1 million from an old immutable contract), and Raydium ($1.3 million across five legacy Solana pools) further underlined that DeFi exploit risks remain active. Raydium announced user reimbursement plans, but the broader concern persists as leverage stays elevated and liquidity remains weak.
