Found some surprising results while doing some analysis on the chance of a protocol being exploited compared to how many audits they had. The more audits they have on average, the higher the chance of them being exploited.
Getting exploited once makes you 3x more likely to get exploited again in DeFi.
A protocol that's been exploited has a 13% chance of another hack in any given year. One that hasn't has a 4% chance.
30 of the 128 Compound V2 forks been hacked. That's basically 1 in 4.
Rari, CREAM, Qubit, Hundred, Sonne, Tectonic, Venus, Moonwell. Same donation and oracle bugs, over and over.
Move was pitched as the safe smart-contract language. Its resource model was supposed to kill whole bug classes.
Per dollar of TVL, Move protocols have lost 6x what Solidity has. One Cetus overflow ($223M) did most of it.
The bugs just moved up a layer, into protocol math.
The 'hack tax' is the amortised percent of onchain funds you're expected to lose each year from exploits. Calculated as the total amount of funds stolen that year, divided by the total TVL onchain.
In 2025 it was 0.6%, In 2026 it's up massively to 2.1% (annualized). So if your'e earning 3.81% yield in a vault or a lending protocol, that's really 1.71% on average when taking into account exploit risk.
Projecting this forward, assuming the increase in exploits is because of AI, and using different industry estimates for AI growth, we have between 2.4% and 8.6% hack tax in 2027.
The increase in crypto exploits in 2026 is almost exclusively from smart contract exploits, what AI is best at finding and executing.
Exploits in crypto are increasing significantly due to AI. We're on track to have 440 exploits in 2026, compared to just 148 in 2025, a 3x in a year. And it's accelerating.
Chase retweeted
The Season 1 Trading Competition is live!
$20,000+ in prizes. Rewards every week.
No signup, free to enter, multiple ways to win each week. Get started below.
