Less Than 2% of DeFi Funds Are Insured as Hacks Surpass $7.7 Billion

May 16, 2026 — Despite billions of dollars flowing through decentralized finance, less than 2% of total value locked is insured, leaving the vast majority of users exposed to mounting security exploits, a new analysis reveals. The gap between risk and coverage has widened as attackers have shifted from smart contract bugs to harder-to-price offchain failures, with protocols losing $7.7 billion to hacks over the past six years. In April 2026 alone, over $600 million was drained in security incidents, led by the Drift and Kelp DAO exploits.

Immediate Details & Direct Quotes

The DeFi insurance sector, which debuted with massive ambitions during the 2020 crypto boom, has largely failed to keep pace with evolving threats. Data from DeFiLlama shows that just 28 insurance protocols exist today, but Nexus Mutual accounts for nearly the entire sector’s $123.5 million in total value locked — a mere 0.14% of DeFi’s broader $83 billion market.

“Less than 2% of DeFi’s TVL is covered or insured, and we see that as one of the largest barriers to real DeFi adoption,” said Hugh Karp, founder of Nexus Mutual, in an interview.

Early insurance products focused on smart contract bugs, which were easier to audit and price. However, attackers have adapted. Recent exploits increasingly stem from compromised private keys, phishing scams, and social engineering — risks that are far more difficult for insurers to assess.

“Many of the largest hacks have originated offchain from operational security failures,” Karp said, adding that the premiums required for such policies become “prohibitively expensive” in the absence of clear security standards.

Market Context & Reaction

The Kelp DAO exploit illustrates the challenge. Cybercriminals manipulated a bridge mechanism to access real assets, then used them as collateral on Aave. According to Karp, “The core failure of bridge risk isn’t something that would have been covered” under typical policies.

Even when coverage applies, it can be indirect. Losses may only qualify if they trigger downstream effects, such as bad debt in lending markets caused by frozen oracles.

Why aren’t users demanding better protection? Many DeFi participants prioritize yield over security. Paying 2%–3% in insurance premiums can significantly cut into profits, especially in strategies built on narrow margins.

“Most DeFi users are yield-driven and do not want to give up several percentage points of return for cover,” said Dan She, senior audit partner at CertiK.

Background & Historical Context

The DeFi insurance sector grew rapidly during the early days of “DeFi Summer,” rising from roughly $3 million in early 2020 to $1.89 billion by November 2021. Nexus Mutual, Cover Protocol, InsurAce, Tidal Finance, and Bridge Mutual were leaders during that period.

However, the sector collapsed under the same risks it was built to cover. Cover Protocol was hacked and then collapsed, while Armor.fi, Bridge Mutual, and Tidal either flatlined or vanished between 2021 and 2024 due to unsustainable tokenomics and conflicts of interest.

Gaspard Peduzzi, founder of Spectra Finance, argued that the model itself is flawed. “You were just stacking counterparty risk on top of the counterparty risk,” he said.

Matthew Pinnock, COO at Altura, pointed to another weakness: capital backing insurance pools is often exposed to the same vulnerabilities as the protocols they cover. “When exploits hit, the capital backing the cover was often exposed to the same risks as the underlying protocol, so it evaporated precisely when it was needed most,” he said.

What This Means

The result is a system where losses still land somewhere — often on users least equipped to absorb them. According to Karp, following a major exploit, protocol safety modules absorb initial losses, treasuries take the next hit, and if those fall short, regular depositors face reductions in their holdings.

“In practice, when there’s no cover, the cost falls disproportionately on the least sophisticated participants,” Karp said.

The industry is beginning to rethink its approach. Some experts call for embedding insurance directly into DeFi products rather than selling it separately. Others advocate for narrower coverage focused on specific risks. A third camp suggests integrating traditional insurance outside the blockchain realm entirely.

For now, DeFi’s insurance market remains small — not because the need is absent, but because the risks are complex, evolving, and increasingly difficult to price. As hacks continue and losses mount, pressure is building to close that gap, or risk slowing the sector’s growth.

—