DeFi exploits: what actually happens to depositors

Every few weeks a DeFi protocol is exploited and a headline number — $40 million, $200 million — does the rounds. What those headlines rarely cover is the part depositors actually care about: whose money was that, and do they get it back?

Who loses, mechanically

When a lending pool, bridge or vault is exploited, the funds taken are depositors' funds. There's no bank, no guarantee scheme, and no licensed custodian standing behind a smart contract. The protocol's "treasury" may or may not choose to help; nothing obliges it to.

The loss also isn't always even. Depending on the exploit, the loss can land on whoever withdraws last — a bank run at machine speed, where the fastest exits get out whole and the remainder share what's left.

The recovery outcomes, from best to worst

1. The attacker returns funds. It happens — some exploiters negotiate a "whitehat bounty" and return the rest. It's a gift, not a system.
2. The team or treasury reimburses. Some protocols make depositors whole from their own tokens or reserves. Read the fine print: reimbursement in a protocol's own token, vested over years, is not the same as your money back.
3. Partial socialised recovery. Losses spread across all depositors, everyone takes a haircut.
4. Nothing. The most common outcome for smaller protocols. The entity that could reimburse you may not meaningfully exist.

What "audited" meant

An audit is a point-in-time review of specific code by a firm with a specific scope. It is real, useful work — and it is not a guarantee, an insurance policy, or a statement about the protocol's economics, its admin keys, or the bridge it depends on. Many of the largest exploits were on audited code; several were in the parts the audit scope didn't cover.

When you see "audited", the questions are: by whom, of what, when, and what did the report actually flag? Protocols proud of an audit publish it.

Questions to ask before depositing anything

• Can the admin keys upgrade or drain the contract, and who holds them?
• What happened the last time this protocol or its dependencies had an incident?
• Is the yield explainable? Yield is someone paying to borrow your assets — if you can't identify the payer, reconsider.
• Could you absorb the total loss of this deposit? In DeFi, that's not pessimism; it's the stated deal.

None of this is a reason never to touch DeFi. It's the frame for sizing what you put in: deposits are uninsured positions in experimental financial software, and the only guaranteed protection is the amount you chose not to deposit.

More from the blog