Web3 security audit firm Immunefi’s just-released “2026 Ecosystem Vulnerability Audit Report” reveals that decentralized finance (DeFi) protocols have seen a dramatic improvement in security since the peak of hack losses in 2022. Specifically, DeFi protocols lost $2.62 billion to hackers in 2022, but by 2025 that figure fell to approximately $680.3 million — a 74% decline, meaning a reduction of nearly $2 billion. The median loss per attack also plunged from $6 million in 2022 to $1.5 million in 2025, indicating that the damage inflicted by each breach has significantly lessened and that overall defensive capabilities have been substantively validated.
Looking at attack vector shares, the report highlights the biggest shift in bridge exploits: these accounted for 73% of total DeFi losses in 2022, a dominant proportion, but their share plummeted to just 3% in 2025, transforming them from a primary threat to a marginal one. Flash loan attacks dropped even more dramatically, from 54% to less than 1%, virtually disappearing. These shifts mark a structural change in the threat landscape. Meanwhile, infrastructure-level risks such as private key leaks and database attacks fell from 30.7% in 2022 to 10.3% in 2025. Immunefi attributes these improvements to ongoing refinements in oracle design, reentrancy protection, and access control standards, concluding that the DeFi ecosystem is “getting safer.”
Nevertheless, the report also flags risks: although 2025 losses are far below the 2022 peak, they did edge up from the prior year to reach $680.3 million, a rebound largely driven by increasing multi-chain complexity and a few high-severity incidents. Moreover, the absolute number of independent security events continues to rise, suggesting the attack surface has not shrunk but rather shifted in focus. Despite this, the sustained decline in median loss suggests that defensive measures remain effective at containing the most serious breaches. Looking at the longer trend from 2022 to today, the overall security posture of DeFi protocols has markedly improved, and the industry is transitioning from an early chaotic phase toward a more mature defense stage.