Crosshairs on Solana: Its Protocols Account for 29% of 2026 DeFi Hack Losses
Solana protocols were hacked for at least $347M this year, the most of any single chain. Half of those affected had been live for over a year, and the pattern repeats for critical vulnerabilities found through bug bounty programs.
Solana has a vibrant ecosystem. It attracts builders, which attract users, which bring capital, which inevitably draws unwanted attention. At least 13 DeFi protocols built only on the network were hacked this year for a total of $347.4 million according to data from DefiLlama, the largest amount by chain among single-chain DeFi protocol hacks in 2026.
Over half of the protocols affected had been live for over a year when the exploit happened. This reflects a pattern found on bug bounties on Immunefi, where 6 in 10 critical vulnerabilities on Solana projects came after the first year, with a median of 685 days between the bug bounty going live and the critical vulnerability being found.
As Solana heads into Breakpoint, this is a good time to look back at the incidents that marked Solana this year and the security practices to observe if we are to bring more assets and payments onchain.
A critical vulnerability in a Solana OG, found through a bug bounty
Solana protocols keep pace with the expansion of the network, constantly upgrading. Each upgrade adds code the last audit never saw, and the older code keeps holding funds long after anyone last reviewed it.
In March 2025, researcher Lastc0de disclosed a critical vulnerability in Raydium’s cp-swap program through Immunefi, 685 days after the protocol’s bug bounty went live. The vulnerability appeared in the deposit function due to the lack of validation for input amounts sent by the user, allowing an attacker to mint LP tokens by depositing only one side of the pair and extract more value than deposited, gradually draining the pool.
A bounty of $505,000 in USDC was awarded to the whitehat for this discovery. Raydium, an AMM launched on the Solana blockchain in early 2021, quickly addressed and resolved the issue. Bugs can slip past even the most experienced veterans, but when independent researchers get involved through bug bounty programs, there are better odds of them being found before they’re used in an exploit.
Solana Hacks in 2026
One large exploit is enough to put a chain at the top of the loss rankings. At least 13 Solana protocols were hacked this year, and 85% of the value lost came from a single exploit. Only 2 of those lost more than $5M each, so it’s the other 11 that serve as a cautionary tale for smaller teams or overlooked pools or vaults within larger protocols.
This pattern repeats across networks and categories: protocols old and new are being targeted, regardless of size. 2026 saw a 2.3x increase in the overall number of hacks from 2025, with the median loss dropping from $811,000 to $402,000, per DefiLlama.
Once an exploit has occurred, teams’ hands are often tied, but before one, they have the power to put the right reviews in place. Between audit competitions, Managed Triage and bug bounty programs, teams can find solutions for each particular need.
Your rules, our program
Once code is written, audited and shipped, any extra reviews are rework, time that could be better employed on iterating new products. This is why Immunefi works like infrastructure that teams can plug into, so reports and triage updates go straight into the tools each team already uses, without having to choose between speed or security.
93% of crypto's critical vulnerability disclosures already flow through Immunefi, and 99.3% of the reports our triage closed stayed closed after review, eliminating noise, duplicates and false positives. Teams that run a program stop relying on luck between audits.
Three things keep a protocol covered after launch:
- A bug bounty on live code. It keeps researchers reading your contracts as long as you see fit, and you pay rewards only for valid bugs.
- Managed Triage, so your engineers only see the reports that need their review.
- An audit competition before each upgrade or new market, so new code is reviewed when needed.
Your team keeps the decisions on scope, rewards, and which reports are valid.
We're at Breakpoint in London from November 15 to 17. If you’re already on Solana or planning on launching there, talk to us about a bug bounty on your live code.
