CipherTrace: in H1 2020, DeFi thefts accounted for 40% of all crypto thefts and hacks, amounting to $51.5M; since July, $47.7M more has been stolen from DeFi
Robert Stevens / Decrypt :
Context & Ripple Effects
CipherTrace's crime reporting had previously tracked a market centered on exchanges and scams: it counted a 400%+ surge in stolen crypto in 2018 and roughly $3.1B lost to exit scams plus $874M misappropriated in 2019. The H1 2020 figures mark a pivot point — for the first time, DeFi protocols are named as the single largest category, at 40% of all thefts.
The timing matters because DeFi was scaling fast through mid-2020, and the report lands alongside CipherTrace's own push into crypto-crime tracking and compliance tooling, backed by fresh Series B funding. In hindsight this was an early reading of a shift that only deepened: by 2021 DeFi made up over 60% of hack and theft volume, and 2022's record $3.8B haul was drawn mainly from DeFi protocols.
First-order effects
- DeFi protocol operators and their users absorb direct losses — nearly $100M across the reported periods — with no intermediary to reverse transactions once contracts are drained.
- CipherTrace's compliance and tracing business gets its clearest demand signal yet: exchanges and regulators now need tooling specifically for DeFi-originated illicit flows, not just exchange thefts.
Second-order effects
- Security auditing of smart contracts becomes a gating step for new DeFi launches, as unaudited code is shown to be the preferred target and projects compete on safety credentials to attract deposits.
- Exchanges and off-ramps face pressure to flag and freeze DeFi-sourced stolen funds, pushing AML obligations down toward a layer of the stack that was built to operate without intermediaries.
Third-order effects
- If the trajectory holds — and the following years suggest it did — crypto crime restructures around protocol-level attacks rather than custodial breaches, culminating in state-linked groups like Lazarus treating DeFi as primary infrastructure for revenue generation.
- The pattern cements an industry of on-chain forensics and compliance vendors whose value depends on quantifying exactly these losses, making firms like CipherTrace recurring infrastructure rather than incident responders.
The trend: Crypto theft is migrating from centralized exchanges and investor scams toward DeFi protocols, turning smart-contract exploits into the sector's dominant attack surface and the core business case for on-chain compliance firms.