Evolving Threats, Shifting Patterns: A Multi-Source Verified Dataset and Statistical Analysis of 823 DeFi Security Incidents (2017-2026)

Abstract

Decentralized Finance (DeFi) has suffered over $5 billion in cumulative losses from security incidents, yet the academic community lacks a large-scale, multi-source-verified dataset to systematically characterize these threats. We present DEFIHACK-824, a curated dataset of 823 DeFi security incidents spanning 2017 to 2026, cross-validated against three independent intelligence sources (Rekt News, SlowMist, and CertiK). Each record is annotated with attack category, confidence level (Gossip/Classified/Ground Truth), and estimated financial loss. We classify incidents into 14 attack categories and conduct statistical analyses: (1) flash-loan-enabled price manipulation and reentrancy together account for 51.5% of all attacks; (2) a chi-squared test rejects the null hypothesis of uniform category distribution at p < 0.0001 (chi-squared = 1,273.2, df = 13); (3) despite widespread deployment of automated detection tools, the annual attack count has not monotonically decreased. We further propose a six-layer DeFi threat model and quantify the effectiveness of four defense classes. The dataset, threat model, and 50 categorized Solidity vulnerability patterns are released under the MIT license.