A Decade of DeFi Attacks: Pattern Evolution, Risk Dynamics, and the Fragmentation of the Attack Surface (2017-2026)

We analyze 824 confirmed DeFi security incidents (2017-2026), the largest empirical study of its kind. We classify attacks into a 17-pattern taxonomy and conduct longitudinal analysis revealing three critical findings: (1) dominant attack vectors shifted from high-value flash loan exploits (median $15M) to small-scale permission bugs (median $50K); (2) the DeFi Risk Index declined 30% from 2020 to 2025; (3) a hardening gradient shows large protocols hardening while small protocols remain exposed. We further characterize the 2026 attack landscape introducing precision errors, intentional backdoors, and accounting inconsistencies. Both English and Chinese versions included.