DeFi now carries roughly $83 billion in total market value, yet only a sliver of that capital has any insurance protection. Hugh Karp, founder of Nexus Mutual, said less than 2% of DeFi’s total value locked is covered. DeFiLlama currently tracks 28 insurance protocols, but Nexus Mutual makes up nearly all of the sector’s $123.5 million TVL, equal to just 0.14% of the broader DeFi market.
The loss figures tell a different story. Since the term DeFi was coined six years ago, uninsured lending protocols have lost $7.7 billion to exploits, according to DeFiLlama. In April 2026 alone, security incidents wiped out more than $600 million, with the Drift and Kelp DAO hacks standing out.
Attack patterns have shifted beyond smart contracts
Early DeFi insurance products were mostly designed around smart contract bugs. Those risks were easier to audit and easier to price. That is no longer the full picture. Karp said many of the biggest hacks now start offchain, tied to compromised private keys, phishing, or social engineering rather than a flaw in onchain code.
That creates a pricing problem for insurers. Without clear standards for how teams run infrastructure and security operations, insurers struggle to assess exposure. Karp said the premiums needed in that environment can become prohibitively expensive.
The Kelp DAO exploit showed the limits of current cover
The Kelp DAO case exposed the gap between real-world attack paths and what insurance policies are built to cover. According to the report, cybercriminals manipulated a bridge mechanism to access real assets and then used those assets as collateral on Aave. Karp said the core failure tied to bridge risk would not itself have been covered.
Even where protection might apply, it can come through indirect effects instead of the original exploit. Losses may only qualify once they trigger downstream problems, such as bad debt in lending markets caused by frozen oracles. In practice, the part of the risk that matters most is often the hardest to insure.
Users still prefer returns over paying for cover
The demand side is weak for a simple reason: many DeFi users care more about yield than protection. Paying 2% to 3% in insurance premiums can take a visible bite out of strategies built on thin margins. Dan She, senior audit partner at CertiK, said most DeFi users are yield-driven and do not want to surrender several percentage points of return for coverage.
That helps explain why DeFi insurance has stayed small even while losses keep mounting. Users may acknowledge the risk, but many still choose not to pay for protection if the cost cuts too deeply into expected returns.
Insurance protocols also carried their own structural weaknesses
Some critics say the model itself has problems. Gaspard Peduzzi, founder of Spectra Finance, argued that insuring DeFi risk with other DeFi protocols adds another layer of exposure rather than removing it. In his words, the sector was stacking counterparty risk on top of counterparty risk.
The segment did have a rapid growth phase during the early DeFi Summer. Decentralized insurance expanded from about $3 million in early 2020 to $1.89 billion in November 2021. Nexus Mutual, Cover Protocol, InsurAce, Tidal Finance, and Bridge Mutual were among the leading names at the time.
That momentum did not last. Cover Protocol was hacked and later collapsed, while Armor.fi, Bridge Mutual, and Tidal either stalled or disappeared between 2021 and 2024. The report cited unsustainable tokenomics and conflicts of interest among the reasons.
Nexus Mutual, which has operated since 2019, has covered more than $6.5 billion in value and paid out just over $18.5 million. Karp said even those figures represent only a small fraction of what the market actually needs.