Four years after Terra's collapse and the FTX bankruptcy, a specific reassurance has become standard in DeFi commentary: the industry grew up. Audits are routine, bug bounties are large, insurance funds exist, and the reckless yield-farming excess of 2021 is gone. Every part of that is at least partly true, and the exploit data backs it up more convincingly than most people making the claim seem to realize. What almost nobody checks alongside it is a completely different, less flattering question: while individual protocols got measurably harder to hack, did the ecosystem as a whole get harder to break? Those are not the same question, and the answer to the second one is no.

This piece runs both tests side by side, using the same rigor. The exploit-loss data genuinely supports "DeFi learned its lesson" as a claim about code quality and infrastructure design. The TVL concentration data tells a nearly opposite story about systemic structure. Both are true at the same time, and the tension between them is the actual, useful finding here.

What genuinely got better

Start with the part of the claim that is simply true, because it's substantial. Immunefi's 2026 Ecosystem Vulnerability Audit, covering six years of DeFi protocol losses across major blockchains, found exploit-driven losses fell from $2.62 billion in 2022 to $534 million in 2024, an 80% decline, before ticking back up to $680.3 million in 2025, still 74% below the 2022 peak. The composition of those losses shifted dramatically in ways that reflect real architectural improvement, not just smaller numbers. Bridge exploits, which accounted for nearly three-quarters of all DeFi losses in 2022, the year of the $625 million Ronin Bridge hack and the $320 million Wormhole exploit, shrank to just 3% of losses by 2025. Ecosystem-class attacks like oracle manipulation and reentrancy bugs fell from 19% of all breaches in 2022 to below 1% in 2025. Infrastructure failures, including key compromises, dropped from 30.7% to 10.3% of incidents. The median loss per incident fell 75%, from $6 million in 2022 to $1.5 million in 2025.

None of that is spin. It reflects specific, identifiable engineering responses: better bridge validator design after Ronin and Wormhole, more rigorous oracle architecture after years of manipulation exploits, and more mature key-management practices industry-wide. If the "DeFi learned its lesson" claim were only about whether individual protocols got harder to exploit through code-level attacks, the data would support it clearly.

Here is what the exploit statistics don't capture. In the immediate aftermath of Terra and FTX, in December 2022, DeFi's total value locked had fallen to $39.37 billion, spread across a top tier that included Lido and MakerDAO (both just above $5 billion), and Aave, Curve, Uniswap, and Convex Finance clustered closely together, each above $3 billion. Using those figures, the top six protocols accounted for roughly two-thirds of total TVL, with the remaining third spread across the long tail, a Herfindahl-Hirschman Index of approximately 1,942, which the US Department of Justice's own merger guidelines classify as "moderately concentrated."

By June 2026, the picture had changed shape entirely. Total DeFi TVL stood at $71.77 billion, but Lido alone held $15.17 billion and Aave $12.10 billion, a combined 38% of the entire ecosystem in just two protocols. Adding Morpho Blue ($6.83 billion) and SparkLend ($3.32 billion) brought the top four to 52% of all TVL. Run the same Herfindahl-Hirschman calculation on this snapshot and the index rises to approximately 3,134, comfortably inside the "highly concentrated" band above 2,500. The market did not diversify after its near-death experience. It consolidated, hard, into a small set of protocols that survived multiple cycles and earned enough trust to absorb an outsized share of the capital that returned.

This is not a criticism of any individual protocol's decisions, and it is arguably rational behavior by allocators: after watching Terra and FTX evaporate, moving capital toward the protocols with the longest, most audited, most battle-tested track records is a sensible individual response. The problem is what it does in aggregate. A higher HHI means a single protocol-level failure now has a larger systemic footprint than it did in 2022. When the North Korea-linked KelpDAO exploit hit a LayerZero bridge configuration in April 2026, the downstream contagion produced up to $230 million in bad debt on Aave alone and triggered $13 billion in DeFi-wide TVL withdrawals within 48 hours, a systemic reaction to a single incident that a more distributed 2022-style market structure would have been less exposed to.

2026 is quietly re-testing the improvement trend

The exploit-decline story also has a 2026 problem the "lesson learned" framing tends to skip. DeFi protocols lost more than $1.3 billion to hacks and exploits through roughly the first two-thirds of 2026, already exceeding the entire $534 million total for 2024 and closing in on 2025's full-year $680.3 million. Two incidents eighteen days apart, Drift Protocol ($285 million) and KelpDAO ($292 million), together account for more than $577 million, and both are attributed to North Korea's Lazarus Group, the same actor behind the 2022 Ronin Bridge hack. Against a total 2026 loss figure of roughly $1.3 billion, Lazarus alone accounts for at least 44% of stolen funds.

What makes 2026's losses different from 2022's is the method, not just the target. The Drift Protocol breach was not a smart-contract bug; it was a six-month social engineering operation, Lazarus operatives building trust with developers and targeting specific session credentials, combined with governance manipulation and oracle abuse once inside. This is a materially different threat model than the ecosystem-class code exploits that dominated 2022, and it is one that better audits and more rigorous bridge architecture, the exact fixes credited with 2022 to 2025's improvement, do very little to prevent. Measured as a share of total value locked, the annualized 2026 loss rate works out to roughly 2.7%, up sharply from 2025's 0.36%, though still well below 2022's 6.65% peak rate.

The tool: measuring both dimensions at once

The DN DeFi Systemic Concentration Heatmap below has two panels. The first computes a Herfindahl-Hirschman concentration score from any set of protocol TVL figures you enter, classified using the same US Department of Justice thresholds used in antitrust merger review. The second computes an exploit loss rate, annual losses as a share of total value locked, so you can compare years on a normalized basis rather than raw dollars. Load the real Dec 2022 and June 2026 snapshots to see the concentration shift for yourself, and the 2022, 2025, and 2026 loss-rate presets to see that the improvement trend, while real, was not a straight line.

What would actually confirm or kill this thesis

Two specific things to watch. If TVL concentration keeps rising toward the top two or three protocols while exploit losses stay elevated above 2025's rate through the rest of 2026, that combination would confirm the bear case directly: a smaller number of larger, more interconnected failure points, hit more often, is a worse systemic structure than 2022's, regardless of how much safer any individual protocol's code has become. If instead 2026's loss spike proves to be a one-year anomaly driven by a specific, unusually capable threat actor, and the loss rate reverts back toward 2025's 0.36% while concentration stabilizes rather than continuing to climb, that would support the more optimistic reading: DeFi's core security posture has structurally improved, and 2026 was simply a bad year against an adversary category (nation-state social engineering) the whole industry, not just DeFi, is still learning to defend against.

Positioning around a genuinely mixed picture

None of this is a signal to exit or pile into any specific protocol. For readers looking to size DeFi exposure with both dimensions, concentration and exploit trend, in mind rather than relying on either half of the "DeFi is safer now" claim alone, Bybit and OKX both offer direct access to the underlying tokens of the protocols discussed here, and VALR provides regulated access for South African readers.

Frequently asked questions

DN-internal: This piece connects to the DN Custody Chain Scanner's attestation-transparency framework and the DN Debasement Divergence Ledger's systemic-risk lens, applying concentration analysis to DeFi's on-chain capital structure rather than sovereign debt or custodial reserves.