DeFi's Year of Exploits: $2B Lost, Lessons Learned

This is Section 11, excerpted from our Amberdata Crypto Market Review 2025 and 2026 Outlook: Six Regimes, One Story. Our full report spans 14 sections - ETF flows, derivatives, on-chain, liquidity, and our complete 2026 outlook.

TVL, utilization, liquidations, and the security problem that won't go away.

$2.07 billion was stolen in 2025. Bybit alone lost $1.46B to state-sponsored hackers. DeFi protocols suffered $388M in exploits. And yet, DeFi TVL reached new highs, utilization remained robust, liquidation mechanisms functioned, and the ecosystem kept building. The contradiction defines DeFi's current state: an industry that has grown too large to ignore and is too vulnerable to ignore the security problem. The exploits were devastating. The resilience was remarkable. Here's how both coexisted in 2025.

Figure 11.1: DeFi TVL vs BTC Price - TVL tracked BTC price throughout 2025, demonstrating the reflexive relationship between crypto valuations and DeFi capital. The October crash temporarily reduced TVL, but the recovery showed capital returning to protocols rather than fleeing the ecosystem entirely.

The TVL Story: Growth Despite Everything

Resilience Beyond Headlines. DeFi's total value locked tells a story of resilience that the exploit headlines obscure. Capital didn't flee the ecosystem after Cetus lost $220M or Balancer lost $128M. TVL continued growing, driven by yield opportunities, leverage demand, and the fundamental utility that DeFi protocols provide.

Multiple Sources. The growth came from multiple sources. Lending protocols like Aave and Compound saw increased deposits as interest rates attracted yield-seeking capital. Liquid staking derivatives expanded as Ethereum staking participation grew. New L2 ecosystems launched with liquidity mining programs that attracted TVL. The multi-chain thesis played out - capital spread across Ethereum, Arbitrum, Base, Optimism, and newer entrants like Sui and Aptos.

October Stress Test. The October stress test provided the clearest evidence of ecosystem maturity. When BTC dropped sharply during Regime 5, DeFi TVL declined proportionally - but proportionally, not catastrophically. There was no cascade of protocol failures, no systemic unwind, no repeat of the Terra/Luna collapse. Protocols functioned as designed. Liquidations cleared positions. The infrastructure held. This represented meaningful progress from 2022's fragility.

$388M

In DeFi-specific exploits during 2025 - Cetus ($220M), Balancer ($128M), and GMX ($40M). Each attack exploited novel vulnerabilities that had survived multiple security audits. The sophistication of attacks has outpaced the sophistication of defenses.

The Utilization Picture: Lending Markets Under Pressure

Window Into Stress. DeFi utilization - the ratio of borrowed assets to deposited assets - provides a window into market stress. High utilization indicates strong borrowing demand and potential liquidity stress. Low utilization suggests excess capacity. In 2025, utilization told a story of active markets that functioned through volatility.

Utilization spiked during each stress event. When prices dropped sharply, traders borrowed to hedge existing positions or speculate on further moves. When prices recovered, borrowers repaid or got liquidated. The lending protocols - Aave, Compound, Maker, and others - handled these spikes without protocol failures. Interest rates adjusted dynamically, attracting more deposits when utilization climbed too high.

October Peak. The October crash pushed utilization to yearly highs as leveraged traders scrambled to manage positions. Some were liquidated. Others added collateral. The protocols processed these transactions without failure, demonstrating that DeFi's core infrastructure - automated market makers, lending protocols and liquidation bots - has matured significantly since the chaotic liquidation cascades of earlier years.

Figure 11.2: DeFi Utilization vs BTC Price - Utilization (borrowed/deposited) spiked during volatility events as traders borrowed to hedge or speculate. The 80% threshold indicates high demand and potential liquidity stress. Note the October spike coinciding with the Regime 5 crash.

DeFi's growth and DeFi's security problems coexist uncomfortably. The ecosystem has grown too large to ignore and too vulnerable to ignore the security problem. Both statements are true simultaneously.

The Liquidations: Stress Testing Protocol Design

Ultimate Stress Test. DeFi liquidations represent the ultimate stress test of protocol design. When collateral values drop below required thresholds, automated liquidation bots step in to close positions and protect protocol solvency. In 2025, this infrastructure was tested repeatedly - and it held.

Liquidations spiked during each major volatility event. The February Security Shock (Regime 2) triggered significant DeFi liquidations as the Bybit hack created market uncertainty. The October Macro Shock (Regime 5) produced the largest liquidation volume of the year as leveraged positions unwound across protocols. Each spike demonstrated the liquidation infrastructure working as designed - positions were closed, bad debt was minimized, and protocols remained solvent.

Contrast with CEX. The contrast with centralized exchange liquidations is instructive. CEX liquidations during the same periods were larger in absolute terms but sometimes created cascading effects as liquidation engines struggled with volume. DeFi liquidations, while smaller, were processed by decentralized networks of bots competing for liquidation profits. This decentralized approach provided resilience - no single point of failure, no liquidation engine overload.

Figure 11.3: DeFi Liquidations vs BTC Price - Liquidation volume spiked during each stress event, with the October crash producing the largest volumes. DeFi liquidations often lead or coincide with CEX liquidations during major market moves.

3

Major DeFi exploits in 2025 - Cetus (May), GMX (July), and Balancer (November). Each exploited different vulnerabilities: fake asset contracts, flash loan attacks, and mathematical rounding bugs. The diversity of attack vectors demonstrates that no single security approach is sufficient.

The DEX Volume: On-Chain Trading Persists

Permanent Feature. Decentralized exchange volume remained stable throughout 2025, demonstrating that on-chain trading has established itself as a permanent feature of the crypto market structure. Volume actually spiked during stress events as traders sought execution when centralized exchange infrastructure was strained.

Shifting Landscape. Uniswap maintained its dominance of Ethereum DEX volume, but the competitive landscape shifted. New DEXs on alternative L1s - Sui, Aptos, Solana - captured volume that might previously have stayed on Ethereum. Layer 2 DEXs on Arbitrum, Optimism, and Base grew their share as users sought lower gas costs. The multi-chain future that DeFi promised began materializing, with liquidity fragmenting across networks.

Cetus Example. The Cetus exploit highlighted both the opportunity and risk of new chain DEXs. Sui's native DEX had grown rapidly, attracting hundreds of millions in liquidity. The $220M exploit wiped out that progress overnight. But the broader DEX ecosystem absorbed the shock - volume shifted to other platforms, liquidity found new homes, and on-chain trading continued. The resilience came from fragmentation itself.

Figure 11.4: DEX Volume (Ethereum) vs BTC Price - Volume remained stable despite exploits, with spikes during volatility as traders sought on-chain execution. The regime shading shows volume patterns across market phases.

The exploits were devastating. The resilience was remarkable. Both statements are true. DeFi processed billions in liquidations, absorbed hundreds of millions in exploit losses, and continued functioning throughout.

The Exploits: Sophistication Meets Scale

Not Simple Bugs. The DeFi exploits of 2025 weren't the simple bugs of crypto's early days. They were sophisticated attacks on mature, audited protocols - attacks that required deep mathematical understanding and patient preparation. Each major exploit represented a new category of vulnerability.

Cetus (May 28, $220M). The Cetus exploit targeted Sui's native DEX through a fake asset contract vulnerability. The attacker created a malicious token contract that the protocol's validation logic incorrectly accepted, allowing them to drain pools of legitimate assets. The exploit required understanding both Sui's unique Move programming language and Cetus's specific implementation - knowledge that suggested either an insider or months of careful reverse engineering.

GMX v1 (July 9, $40M). The GMX exploit combined flash loans with a reentrancy attack in a novel configuration. The attacker borrowed massive amounts, manipulated oracle prices, and extracted value before the protocol could react - all in a single atomic transaction. GMX had been audited multiple times, but the specific attack path had never been considered.

Balancer (November 3, $128M). The Balancer exploit exploited a mathematical edge case in weighted pool rebalancing. The bug had survived three independent audits and two years of production operation. The attacker needed to understand not just the code, but the mathematical model underlying it - then construct a series of transactions that exploited the model's edge cases. This level of sophistication represents the new normal for DeFi attacks.

Figure 11.5: 2025 DeFi Exploits - Each triggered temporary DeFi deleveraging and liquidity provider retreat. The November Balancer exploit came during the already fragile Regime 6 recovery.

$2.07B

Total stolen across all crypto in 2025 - the largest year on record. While Bybit ($1.46B) dominated the total, DeFi's $388M in losses represented sophisticated attacks that the ecosystem must address. The Amberdata Crypto Market Review 2025 Section 12 details the complete security picture.

The Regime View: DeFi Through Market Phases

Regime Patterns. Mapping DeFi metrics to 2025's regime structure reveals how the ecosystem responded to each market phase. TVL, utilization, liquidations, and DEX volume all showed distinct patterns across regimes - patterns that provide insight into DeFi's behavior under different market conditions.

Regime 2 (Security Shock). DeFi metrics declined in sympathy with the broader Bybit-driven crash. TVL dropped as capital fled to safety. Utilization spiked as traders borrowed to hedge. Liquidations cleared overleveraged positions. But protocols functioned - there was no DeFi-specific cascade. The Bybit hack was a CEX problem that DeFi weathered without contagion.

Regime 5 (Macro Shock). The October crash provided the more severe test. It produced the highest DeFi liquidation volumes of the year. Utilization spiked past 80% on major lending protocols. TVL declined sharply. But again, protocols held. Liquidation bots cleared positions. Interest rates adjusted to attract deposits. The infrastructure demonstrated that DeFi could survive macro stress without systemic failure.

Figure 11.6: DeFi Summary by Regime - Reference table showing average TVL, total liquidations, and DEX volume per regime. Note R5's liquidation spike and the relative stability of DEX volume across all regimes.

This analysis connects to (S6)'s liquidity and leverage analysis across the broader ecosystem, and (S10)'s on-chain valuation metrics that provide context for DeFi's growth trajectory.

From here, (S12) provides the complete security analysis including CEX hacks. (S13) examines how regulatory changes may affect DeFi's future development and adoption.

This article provides the DeFi analysis. The full Amberdata Crypto Market Review 2025 goes deeper:

• The $80,000 floor: What happens when ETF cost basis breaks?
• Which ETF issuer is already underwater? The entity-level breakdown reveals all
• October's "capitulation"? The data says arbitrage - here's the carry trade proof
• 123,173 BTC: The mega whale accumulation hiding in plain sight
• Six regimes, 14 sections: One framework that explains everything
• Early or late cycle? On-chain valuation signals decoded
• $60K or $180K? 2026 scenarios with specific price targets
• DeFi's $2B security crisis: What broke and why it matters
• SAB 121 to 401(k): The regulatory timeline reshaping crypto
• And more...

Full-Market Research. Institutional Depth. Derivatives, ETFs, on-chain, DEXs, microstructure, risk signals - and more. Subscribe at the bottom of our page for research that covers every corner of crypto and visit the Amberdata Research Blog.

Access Amberdata Intelligence for institutional-grade digital asset intelligence, or contact our team to discuss custom solutions.

Links & Resources

Platform

• Research Library
• Intelligence Platform
• Developer Docs
• Contact Us

Recommended next reads

ETF Cost Basis Series

• Part 1/3: The $80,000 Floor (ETF Cost Basis)
• Part 2/3: Who Breaks First (ETF Cost Basis)
• Part 3/3: The Stress Test (ETF Cost Basis)

More key reads

• The ETF Exodus Decoded: Basis Arbitrage, Not Capitulation
• Bitcoin's Great Rotation: Who Bought the Dip and Why It Matters
• October 2025 Crash (7 charts): How $3.21B Vanished in 60 Seconds
• Beyond the Spread: Market Impact and Execution

Disclaimers

The information contained in this report is provided by Amberdata solely for educational and informational purposes. The contents of this report should not be construed as financial, investment, legal, tax, or any other form of professional advice. Amberdata does not provide personalized recommendations; any opinions or suggestions expressed in this report are for general informational purposes only.

Although Amberdata has made every effort to ensure the accuracy and completeness of the information provided, it cannot be held responsible for any errors, omissions, inaccuracies, or outdated information. Market conditions, regulations, and laws are subject to change, and readers should perform their own research and consult with a qualified professional before making any financial decisions or taking any actions based on the information provided in this report.

Past performance is not indicative of future results, and any investments discussed or mentioned in this report may not be suitable for all individuals or circumstances. Investing involves risks, and the value of investments can go up or down. Amberdata disclaims any liability for any loss or damage that may arise from the use of, or reliance on, the information contained in this report.

By accessing and using the information provided in this report, you agree to indemnify and hold harmless Amberdata, its affiliates, and their respective officers, directors, employees, and agents from and against any and all claims, losses, liabilities, damages, or expenses (including reasonable attorney's fees) arising from your use of or reliance on the information contained herein.

Copyright © 2026 Amberdata. All rights reserved.