Skip to content

REKT: where DeFi projects lose funds

  • defi
  • rekt
← Blog

In the world of blockchain and cryptocurrencies, rekt is the shorthand for suffering a severe financial loss. With the exponential growth of DeFi, a wave of "fast-food" scam projects emerged. But scams aren't the only reason a project gets rekt: protocols can also harbor vulnerabilities in their smart contracts.

I analyzed 100 representative incidents from the De.Fi "Rekt Database" (≈2,500 total). Amounts are in USD millions. Estimated total losses are about US$4,500M, while the 100-case sample covers US$4,336M. This sampling choice favors representativeness by value, but it may underweight the long tail of smaller incidents.

How projects get rekt: Four drivers

  1. Exit Scam. Malicious actions planned by a team intending to steal depositors’ and investors’ funds.
  2. Flash Loans. External attacks that manipulate prices and imbalances, leading to lender losses.
  3. Smart Contract Exploits. Internal or external vectors taking advantage of a vulnerability.
  4. Access Control. Compromised keys that drain wallets.

Reks issues by chain

Values in millions of USD. Relationship between issue and network by funds lost.

Networks: Losses vs. Case Counts

By losses

Fund lost by issue and network percentage Relationship between issue and network by total losses

  • Ethereum accounts for ~48% of total losses (≈ US$2,101M).
  • Ronin ranks second by value due to a single outsized event.
  • On Ethereum, category shares by value are substantial: exploits ≈51%, access-control ≈59%, and flash-loan ≈72% of the losses within each category across networks.
  • Exit scams skew toward other/smaller networks, which account for ~57% of exit-scam losses—evidence that scams often cluster on less-mature chains.

By number of cases

Number of cases by issue and network Relationship between issue and network by number of cases

  • Ethereum, BSC, and other/smaller networks lead by count of incidents.
  • Within exit scams, BSC becomes more prominent by count, even if not by total value.

Since 2020, incident counts have risen across all categories.

Distribution of issue by year

  • The snapshot for 2022 may be incomplete if data collection was still underway at the time.
  • Exploits gained relative importance by value, while exit scams and access-control remained comparatively flat in value terms.

Percentage distribution of year by issue

Case studies: The biggest rekt events

  • Ronin (≈US$624M). Centralization of validator keys enabled an attacker to gather enough signatures (five validators) to approve fraudulent withdrawals, an acute governance and key-management failure.
  • Poly Network. A cross-chain permissioning flaw allowed privileged contracts to relay messages that invoked special-privilege functions. Systems that rely on privileged calls must ensure cross-chain relays cannot access those code paths.
  • Wormhole (Solana, Feb 2022). A bridge verification failure led to ETH being treated as deposited on Ethereum, allowing the attacker to mint the corresponding WETH on Solana.

Takeaways

  • Decentralization of key management and validator sets is non-negotiable.
  • Bridge security and cross-chain permissioning matter as much as on-chain contract safety.
  • Treat flash loans as a stress test: if a protocol breaks under them, the issue is in its logic or oracle design.
Source: https://defiyield.app/rekt-database