DeFi's pursuit of outsized yields continues to outpace its appetite for protection, and attackers are profiting from the gap. What began as the idealistic "DeFi Summer" of 2020—a vision of permissionless finance without intermediaries—has grown into an $83 billion ecosystem that still operates with minimal insurance. Uninsured lending protocols have lost an estimated $7.7 billion to exploits since the term DeFi entered the crypto mainstream, according to DeFiLlama. In April 2026 alone, security incidents erased more than $600 million, driven by prominent breaches at Drift and Kelp DAO. Those incidents highlight a structural issue: DeFi insurance remains small and poorly aligned with today's threat landscape. Less than 2% of DeFi's total value locked (TVL) is insured, Nexus Mutual founder Hugh Karp told CoinDesk. DeFiLlama tracks 28 insurance protocols, yet Nexus Mutual accounts for nearly all of the sector's $123.5 million in TVL—about 0.14% of the wider DeFi market. Attack vectors have shifted Early DeFi insurance products largely focused on smart-contract vulnerabilities, risks that can be audited and modeled. Losses are increasingly driven by offchain failures: stolen private keys, phishing, social engineering and flawed bridge mechanics. DeFiLlama's attack-method data shows private-key compromises as the largest category, followed by phishing aimed at multisig wallets. "Many of the largest hacks have originated offchain from operational security failures," Karp said. These scenarios are difficult to underwrite because security practices vary widely and lack standardization. Without clear benchmarks, pricing becomes unreliable and premiums rise beyond what most users will pay. Karp pointed to the Kelp DAO incident as an example. Attackers allegedly manipulated a bridge to seize real assets and then used them as collateral on Aave. He said the underlying "core failure of bridge risk" often falls outside typical DeFi insurance coverage, which in some cases compensates only for downstream effects such as bad debt triggered by frozen oracles. Why coverage remains unpopular User incentives remain a major obstacle. Many DeFi strategies operate on thin margins, and insurance premiums of 2% to 3% can wipe out returns. "Most DeFi users are yield-driven and do not want to give up several percentage points of return for cover," said Dan She, senior audit partner at CertiK. The sector's first wave of decentralized insurers also faced structural fragility. Many shared the same infrastructure risks they aimed to cover, creating circular exposure. DeFi insurance grew rapidly from roughly $3 million in early 2020 to about $1.89 billion by November 2021, led by protocols including Nexus Mutual, Cover Protocol, InsurAce, Tidal Finance and Bridge Mutual. From 2021 to 2024, many of those projects collapsed after hacks, failures or unsustainable token models. Cover Protocol was hacked and unraveled, while Armor.fi, Bridge Mutual and Tidal largely faded from view. Nexus Mutual, operating since 2019, remains one of the few survivors. Karp said Nexus has covered more than $6.5 billion in value and paid out just over $18.5 million—a meaningful figure in isolation, but small compared with the broader market's risk exposure. Critics argue the earlier model was fundamentally flawed. "You were just stacking counterparty risk on top of counterparty risk," said Gaspard Peduzzi, founder of Spectra Finance, describing how DeFi insurance often relied on the same decentralized mechanisms it insured. Matthew Pinnock, COO at Altura, added that capital backing insurance pools was frequently exposed to the same vulnerabilities it was meant to hedge, causing protection to disappear when it was most needed. When coverage is missing, retail users often take the hit. Karp described a typical post-exploit sequence: protocol safety modules absorb the first losses, treasuries are tapped next, and if those buffers fall short, depositors bear the remaining damage. "In practice, when there's no cover, the cost falls disproportionately on the least sophisticated participants," he said. Where DeFi insurance goes from here The market is beginning to adjust. Some projects are integrating insurance directly into DeFi products, making coverage automatic instead of optional. Others advocate narrower, clearly defined policies or greater involvement from traditional insurers to address offchain operational and custody risks. The central problem persists: DeFi's risk profile is complex and evolves quickly, while insurance standards and underwriting tools have not kept pace. Until pricing and coverage catch up with the realities of modern attack methods, the ecosystem is likely to remain exposed, with incentives continuing to push users toward yield-first choices that leave billions at risk. As exploits accumulate and losses grow, pressure is rising to close the protection gap. If insurers, protocols and users cannot align on workable trade-offs between cost and coverage, DeFi's expansion may slow—and future "summers" could come with a far higher price tag for the unprepared.