DeFi is losing ground again. Total value locked (TVL) across decentralized finance has dropped by roughly 39% in 2026 so far, sliding to a little over $70 billion from about $115 billion in January, according to a report shared this week by CryptoRank.

CryptoRank links the decline largely to the market’s post-October 2025 correction, after Bitcoin’s sharp run-up ended in a major liquidation event. But security incidents are also taking their toll—either by directly draining funds from protocols or by nudging users toward the exits more quickly than they otherwise might.

Key takeaways

CryptoRank estimates DeFi TVL is down about 39% in 2026 to just over $70 billion, versus roughly $115 billion in January.
CryptoRank points to the broader deleveraging after Bitcoin’s Oct. 10, 2025 liquidation event as a primary driver of the TVL drawdown.
CryptoRank reports 121 hacks and about $942 million in losses year-to-date, which may be weighing on user confidence and capital allocation.
Nansen analysis highlighted that the April 18 Kelp DAO exploit triggered rapid outflows, compressing what would normally be a slower capital rotation.
While the total stolen in 2026 quarters appears lower than historical peaks, analysts argue this can reflect attackers shifting to new targets rather than genuine security progress.

DeFi TVL down as the 2025 selloff reverberates

The foundation for 2026’s contraction traces back to a broader correction that followed Bitcoin’s late-2025 peak. After Bitcoin pushed above $122,000, a market-wide liquidation event on Oct. 10, 2025 erased more than $19 billion in leveraged positions, according to the CryptoRank report. That liquidation intensified a wider deleveraging cycle across digital assets, which then translated into weaker demand and reduced liquidity across DeFi.

CryptoRank said that despite the double-digit drawdown seen this year, the current DeFi decline is materially smaller than the stress phase during the 2021–2022 bear market. In other words, the drawdown appears severe—but not as extreme as the earlier cycle’s contraction—suggesting DeFi has some resilience even when risk appetite falls.

Security incidents: fewer headlines, still meaningful pressure

CryptoRank also flagged security as a continuing headwind for DeFi activity in 2026. The provider reported 121 hacks and roughly $942 million in losses year-to-date. In CryptoRank’s view, exploits may not be the sole cause of TVL falling, but their frequency can still influence user sentiment and hasten capital outflows.

This distinction matters for investors and operators. If TVL is declining mainly because of market-wide deleveraging, risk management is largely about cycle navigation. If security events are accelerating outflows, however, the issue becomes more protocol-specific—turning “time to confidence” into a measurable performance variable for DeFi platforms.

Kelp DAO exploit illustrates how quickly capital can flee

One incident that demonstrates the speed of capital rotation was the Kelp DAO exploit on April 18, an event described by Cointelegraph as involving $293 million. According to Nicolai Søndergaard, senior research analyst at Nansen, the fallout from the breach concentrated into days rather than dragging out over weeks.

Søndergaard’s analysis indicated that Aave users withdrew about $15 billion in deposits within four days after the exploit. The scale and speed of those withdrawals underline how DeFi markets can reprice trust rapidly: once a high-profile event breaks user confidence, liquidity providers and depositors often act immediately to reduce exposure, even if broader conditions would likely have pressured TVL anyway.

The same period also reinforced that the industry’s incident pace remains elevated. CryptoRank described Q2 2026 as the most-hacked quarter on record by incident count, with 83 exploits targeting crypto protocols. Yet the total value stolen during the quarter—$755 million—was far below the $3.56 billion lost in Q4 2020, which Cointelegraph describes as the costliest quarter for hacks on record.

Lower stolen value doesn’t necessarily mean better security

Some readers may interpret smaller aggregate losses as an improvement in security. But multiple perspectives in the reporting suggest the reality is more complex.

HackenProof CEO Dmytro Matviiv argued that the decline in total stolen funds can be “misread as progress.” He said that while leading protocols may be harder to exploit, attackers adapt by expanding their attack surface—seeking out new targets rather than disappearing entirely. The implication for DeFi participants is that security performance may improve at the top end, while risk can migrate to less mature or more exposed systems.

Bitget Wallet COO Alvin Kan added a related behavioral angle: exploits make users more cautious, but the resulting capital shifts can also move liquidity away from “weaker” venues toward “stronger venues” with clearer yield models. Kan suggested this dynamic may encourage consolidation, where protocols with more credible risk assumptions attract deposits, while others struggle to regain capital after incidents.

Taken together, these points suggest that the DeFi TVL trend is being shaped by two overlapping forces: macro liquidity conditions that reduce leverage and risk-taking, and micro-level trust events that determine which protocols retain or regain capital once stress hits.

For the months ahead, the key question is whether TVL stabilizes as leverage normalizes—or whether security events continue to accelerate outflows for individual protocols. Monitoring both incident frequency and how quickly capital returns after major exploits may offer the clearest signal of whether DeFi’s drawdown is settling or still widening.