DeFi Weekly Intel: LayerZero exodus tops $4B as THORChain suffers $11M hack

May 10–17, 2026 | Total DeFi TVL: $84.44B

The week's defining story was structural: protocols migrating their cross-chain infrastructure away from LayerZero — a chain reaction still reverberating from April's $292M KelpDAO exploit. Six new exploits added another ~$12.5M in losses. Governance was unusually active, with 13 votes closed, led by WLFI's 62B token unlock restructuring.

Category	Headline figure	Direction
Total DeFi TVL	$84.44B	↓ 0.61% (24h)
Top TVL gainer (7d)	Ethena ecosystem +$835M combined	↑
Top TVL loser (7d)	SSV Network −$966M	↓
Exploits this week	~$12.5M across 6 incidents	—
Largest exploit	THORChain $10–11M	—
Governance votes closed	13	—
Chains with positive 7d TVL	Solana (+3.93%), Base (+5.84%)	↑

TVL snapshot: ETH staking bleeds, Solana and Base hold

Total DeFi TVL closed the week at $84.44B, down 0.61% in 24 hours. 1 Twenty-two of the top 30 protocols posted negative seven-day changes, with ETH-denominated protocols bearing the steepest cuts. 2

Chain-level picture:

Chain	TVL	7d change
Ethereum	$44.18B	−2.98%
Solana	$6.01B	+3.93%
BSC	$5.56B	−0.83%
Bitcoin	$5.19B	−1.95%
Tron	$5.15B	−0.19%
Base	$4.85B	+5.84%

Ethereum's 7-day decline of −2.98% is modest in isolation; its 30-day figure of −20.65% reflects the cumulative damage from the KelpDAO exploit in mid-April. Solana and Base are the only top-6 chains with positive 7-day growth — a split that likely reflects capital rotating out of heavy ETH-denominated staking positions.

Top 7-day TVL gainers

Ethena dominated the gainers list with +$835M combined across two products. 2

Protocol	TVL	7d change	7d abs.
Ethena USDtb	$1.08B	+71.72%	+$450M
Ethena USDe	$4.35B	+9.71%	+$385M
Portal (Wormhole)	$2.37B	+17.05%	+$345M
Steakhouse Financial	$2.15B	+17.95%	+$327M
Uniswap V3	$2.09B	+17.81%	+$315M
Grove Finance	$2.84B	+9.63%	+$249M
Jupiter Lend	$1.23B	+24.30%	+$240M
BlackRock BUIDL	$3.23B	+8.01%	+$239M
Kamino Lend	$1.64B	+9.63%	+$144M
Ondo Global Markets	$1.02B	+7.73%	+$73M

Three distinct inflow themes are visible here. First, Ethena's RWA-backed USDtb gained +71.7%, more than double the rate of USDe itself — suggesting demand is shifting toward the real-world-asset-collateralized variant of the stablecoin. 4 Second, Solana-native lending (Jupiter Lend +$240M, Kamino Lend +$144M) is directly mirroring the chain's +3.93% TVL growth. Third, RWA protocols as a group — BlackRock BUIDL, Ondo, and Ethena USDtb — added roughly +$561M, the clearest signal yet that institutional-grade yield products are pulling capital from pure-play DeFi structures.

Top 7-day TVL losers

ETH staking protocols collectively shed ~$3.7B. 2

Protocol	TVL	7d change	7d abs.
SSV Network	$16.15B	−5.64%	−$966M
Lido	$19.41B	−4.55%	−$926M
Aave V3	$14.30B	−4.16%	−$621M
Binance staked ETH	$8.10B	−5.60%	−$480M
WBTC	$8.96B	−3.87%	−$360M
EigenCloud	$7.16B	−4.73%	−$355M
Coinbase Bridge	$6.33B	−4.41%	−$292M
Obol	$0.91B	−23.84%	−$286M
ether.fi Stake	$4.77B	−5.62%	−$284M
Mellow Core	$0.17B	−61.87%	−$270M

The five liquid staking and restaking protocols at the top of this list (SSV, Lido, Binance staked ETH, EigenCloud, ether.fi) account for roughly $3.0B of the total decline. A significant portion reflects ETH price movement rather than protocol-specific outflows; however, Obol's −23.8% and Mellow Core's −61.9% are too large to explain by price alone, suggesting protocol-level migrations or product changes that have not yet been publicly disclosed.

LayerZero exodus: $4B+ moves to Chainlink CCIP

The migration wave triggered by the April 18 KelpDAO $292M exploit (the largest DeFi hack of 2026, attributed to North Korea's Lazarus Group 5) continued all week. The attack exploited LayerZero's single-signer DVN (Decentralized Verifier Network — a bridge security model that relied on just one independent verifier to confirm cross-chain messages) configuration. LayerZero subsequently acknowledged it "made a mistake" by permitting that configuration for high-value assets. 6

Confirmed migrations, May 7–15:

Solv Protocol — migrated $700M in tokenized Bitcoin (SolvBTC and xSolvBTC) on May 7 6
Re.xyz — $475M in TVL, citing CCIP's 16 independent validator nodes and built-in rate limits 7
Kraken — announced May 14 that kBTC and all future Kraken Wrapped Assets will use Chainlink CCIP exclusively, citing ISO 27001 and SOC 2 Type 2 certifications 5
Lombard Finance — migrated $1B+ in BTC-native assets on May 15, pushing cumulative migrations past $4B 6

Chainlink CCIP (Cross-Chain Interoperability Protocol — a cross-chain messaging infrastructure using a decentralized oracle network with multiple independent node operators) accumulated over $2.5B in protocol TVL from this migration wave. 8 The security argument is straightforward: where LayerZero allowed a 1-of-1 verifier model, CCIP requires consensus across an ensemble of independent nodes.

LayerZero has since removed support for 1-of-1 DVN configurations and is moving most routes toward 5-of-5 verifier setups. Despite the migrations, LayerZero reported over $9B in bridged assets moved through its infrastructure since April 19.

Aave's rsETH market restarts; Morpho keeps absorbing displaced users

On May 13, Aave transferred the first 25,000-rsETH tranche into the LayerZero OFT adapter, formally reopening cross-chain bridging after a month-long freeze. A total of 117,132 rsETH (~$278M) is being replenished in staged tranches over two weeks. 9 On May 15, a court greenlit an Arbitrum DAO vote to route $71M in recovered Kelp ETH to Aave. 10 A terrorism-creditor restraining notice filed May 1 creates legal uncertainty that could delay the final recovery tranches.

While Aave's 7-day TVL declined −$621M, Morpho (a modular lending protocol — it runs isolated lending markets rather than a shared liquidity pool, limiting contagion between collateral types) reached $11.78B TVL, with only $1M in KelpDAO-related exposure versus Aave's ~$200M bad debt. 11 Apollo Global (a private credit and alternative asset manager with $940B in assets under management) committed to acquire 90M MORPHO tokens over 48 months. 11 Coinbase-originated USDC loans on Morpho totaled $2.17B — half of Morpho's entire $4B active loan book.

Exploits: ~$12.5M across 6 incidents

Six confirmed exploits closed this week, with THORChain accounting for roughly 85% of total losses.

Protocol	Date	Chain	Est. loss	Vector	Status
THORChain	May 15	ETH, BTC, BSC, Base, +5	~$10–11M	Suspected GG20 TSS flaw	Trading halted, post-mortem pending
Transit Finance	May 13	Ethereum	~$1.8M	Unknown	No official statement
Renegade.fi	May 10	Arbitrum	~$209K	Access control (V1 legacy)	White hat recovered ~$190K; full compensation pledged
INK Finance	May 11	Polygon	~$140K	Whitelist bypass + flash loan	No official statement
ShapeShift FOX Colony	~May 15	Arbitrum	~$132K	Auth trust chain flaw	SlowMist analysis published
Huma Finance	May 11	Polygon	~$101K	Deprecated V1 logic error	Users unaffected; protocol fees only

Total: approximately $12.4M

THORChain — $10–11M multi-chain hack, trading halted 12+ hours

On May 15, THORChain (a decentralized cross-chain liquidity protocol that enables native asset swaps across Bitcoin, Ethereum, and other chains without wrapped tokens) suffered a security breach across at least nine blockchains: Bitcoin, Ethereum, BSC, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP. PeckShield confirmed 36.75 BTC (~$3M) and ~$7M in EVM tokens were stolen. 12 The protocol's Mimir governance module activated an emergency pause, halting all trading and signing operations for approximately 12 hours 42 minutes.

THORChain's initial statement said: "Initial findings indicate that no user funds were affected. The team continues to work on a comprehensive recovery and network relaunch plan." 13 The team flagged a potential implementation flaw in the GG20 TSS (Threshold Signature Scheme — a multi-party computation method used to generate multi-chain transaction signatures without exposing private keys to any single party) design, though a full technical post-mortem had not been released by May 17.

RUNE fell roughly 13% immediately after news broke. 14 TRM Labs noted that cumulative losses from THORChain-related thefts since 2021 — including two prior exploits and a 2025 founder wallet compromise — now approach $25M. 15

THORChain exploit news graphic — *Image from: THORChain loses nearly $11 million in suspected exploit — Crypto Briefing*

The smaller four: authorization logic as the common thread

Three of the week's five smaller exploits — INK Finance's whitelist bypass, ShapeShift FOX Colony's authorization trust chain flaw, and Renegade.fi's access control failure — all trace to authorization logic rather than smart contract arithmetic errors. 16 17 18 Huma Finance's $101K loss came from a deprecated V1 contract that was never removed from the network. 19 Renegade.fi is the week's bright spot: a white hat recovered ~$190K of the ~$209K stolen, and the protocol pledged full compensation. 17

Yield anomalies: THORChain offline, Flare cuts 40%, Base farms lead

THORChain yield destruction

THORChain's emergency halt wiped out all in-protocol yield for the duration of the pause — liquidity providers could not earn swap fees or RUNE emissions, and all pending transactions were suspended. For active LP positions in THORChain pools, the relevant question is whether the protocol fully resumes before the next block reward cycle; as of May 17 the full post-mortem and relaunch timeline remained pending. 20

Flare Network: 40% emissions cut, operational utility phase begins

Flare Network (a blockchain layer designed for XRP ecosystem DeFi, supporting smart contracts for assets from non-smart-contract chains) implemented a 40% reduction in FLR token emissions, alongside new MEV capture mechanisms and revised burn mechanics. 21 The network's multi-year FlareDrop distribution program has ended; Flare is now in what it calls an "operational utility" phase with bounded new issuance.

SparkDEX (Flare's primary DEX) held a community vote from May 13–17 on how to allocate protocol revenue and SPRK emissions between buybacks and burns, stFLR rewards, and ongoing emissions. 21 FLR gained 16.1% in 7 days versus ~2.2% for the broader altcoin market. The XRPFi ecosystem on Flare holds approximately $457M in TVL with ~$200M attributed to XRP-specific activity.

The yield implication: pools with high SPRK emission allocations could see rate changes in the days following the vote's execution. LPs holding FLR-denominated positions should verify their current APY sources against the new emissions schedule once the SparkDEX vote executes.

Base Aerodrome Slipstream: highest reward efficiency in DeFi this week

According to a May 16 r/defi yield summary, Aerodrome Slipstream pools on Base were printing the week's highest reward efficiency: USDC-AERO at 45.9%, WETH-CBBTC at 57.1%, and multiple WETH-AERO and WETH-BRETT pools at 94–152%. 22 These figures come from a community aggregator and have not been independently confirmed against DeFiLlama's Base chain data; treat them as directional rather than precise.

The broader pattern: Berachain TVL gained +$26M on the same day Ethereum lost -$2B. The APyPulse analyst summarized it this way: "The meta has shifted from 'hold everything on Ethereum' to 'chase the new yield meta on Base + Berachain while Ethereum consolidates.'" 22 Morpho Blue's PRIME pool saw a 24-hour TVL increase of +565% from a ~$10M base — notable growth in absolute terms but too small to signal a structural shift on its own.

Ethena ENA launches on Solana; blue-chip yields hold 2–5%

On May 14, Ethena's ENA governance token launched on Solana through integration with Sunrise DeFi. 23 USDe's current yield on Ethereum is 4.27% APY (30-day average), essentially flat from the previous period. 24

Blue-chip yield baselines as of May 17: 24

Protocol / Pool	TVL	APY
Sky Lending (SUSDS)	$6.06B	3.65%
Maple (USDC Syrup)	$3.39B	4.83%
Circle USYC	$2.86B	3.06%
Ethena USDe	$1.80B	4.27%
Spark Savings (USDT)	$1.27B	2.50%
Lido stETH	$19.43B	2.43%
Binance staked ETH (WBETH)	$7.64B	2.57%
ether.fi WEETH	$4.08B	2.60%

Ethereum's validator count reached an all-time high of 1,034,051 (up 65% year-over-year), pushing ETH staking APR down to 3.22% — more validators competing for the same issuance means each earns less. 25 No established protocol above $10M in TVL showed a sustainable APY above 50% during this period.

Governance: 13 votes closed, WLFI leads by size

Thirteen governance proposals closed during May 10–17, with Curve (6 proposals) and ENS (2 proposals) accounting for most of the volume. The two votes with direct protocol-parameter consequences for LPs are the Curve A-parameter ramps and the WLFI token unlock.

Protocol	Proposal	Result	On-chain impact
WLFI	62B token unlock restructuring	99.9% pass, 11,537 wallets	~4.5B tokens burned (10% of founder/team tranche); remainder on 2–5 year vesting
Balancer	BIP-920 veBAL compensation airdrop	100% pass (3.44M veBAL)	Airdrop to veBAL holders displaced by BIP-919 tokenomics overhaul
Beets	BIP-115 terminate sFTMx on Fantom Opera	100% pass (14.28M BEETS)	FTM bridges to Sonic as S; users can claim through year-end
Curve	alETH/WETH pool: A ramp 200→300	Passed (sdCRV 18M, Convex 12M CVX)	Lower slippage on alETH/WETH swaps; one-week ramp
Curve	alETH/frxETH pool: A ramp 100→300	Passed (sdCRV 16.7M, Convex 13.1M CVX)	Tighter peg maintenance for alETH/frxETH
Curve / sdCRV	USDM Pegkeeper debt ceiling → 0	Passed (sdCRV 13.5M)	Removes USDM from crvUSD price aggregator; reduces Curve's USDM exposure
Curve (Concentrator)	twocrypto implementation update	Failed (quorum not met, 0 votes)	No change
ENS	ENSv2 pricing (5+ char names)	99.2% pass (1.75M ENS)	Multi-year discounts, grace period changes for longer names
ENS	SPP3 service provider program	95.4% pass (1.55M ENS)	Committee structure for ENS service providers authorized
Orderly Network	Deprecate 6 low-TVL chains	Passed by default	Story ($186K TVL), Plume ($24K), Monad ($14K), Abstract ($9K), Morph ($975) deprecated
Decentraland	Remove Catalyst node peer.kyllian.me	Passed (11.9M MANA)	Node removed from network

26 27 28 29

Three votes to watch closely

WLFI token unlock is the highest-stakes vote by order of magnitude. 26 Approximately 62B previously frozen tokens now enter a 2–5 year vesting schedule via a Lockbox smart contract; early supporters (~17B WLFI) get a 2-year cliff, while founder, team, and partner allocations (~45.2B) burn 10% immediately with the remainder on a 2-year cliff + 3-year linear vest. The vote passed at 99.9% approval — unsurprising given that the top four wallets control ~40% of voting power. WLFI traded at $0.059 at the time of the vote, down ~88% from its September 2025 peak of $0.46. The 10% burn is a net positive for supply, but the unlock windows beginning in two years are the real variable; any price recovery between now and 2028 will face significant scheduled sell pressure.

Curve A-parameter ramps: Raising the amplification parameter (A) in StableSwap pools tightens the peg range around the 1:1 curve, reducing slippage for in-range swaps while increasing impermanent loss exposure for LPs providing liquidity away from peg. The alETH/WETH ramp from 200→300 and alETH/frxETH from 100→300 both take effect over one week. 27 LPs in these pools should verify their position concentrations; the higher A values make positions more sensitive to any depeg event.

Arbitrum Constitutional AIP (active, not yet closed): The proposal to release $71M in frozen ETH — the Arbitrum Security Council's seizure from the KelpDAO hacker — is on Tally with 98.1M ARB in favor as of May 17. 29 If it passes, those recovered funds route to Aave as partial bad-debt coverage. This is a Constitutional-level proposal requiring higher quorum, and the terrorism-creditor restraining notice filed May 1 adds jurisdictional complexity.

Cross-week signal summary

Three patterns emerged across the four data streams this week:

1. Structural shift in bridge security standards. Four major protocols replacing LayerZero with Chainlink CCIP in eight days is not noise — it reflects a real repricing of bridge security risk following the KelpDAO exploit. Protocols still operating on multi-chain infrastructure with 1-of-N verifier configurations are carrying the same structural exposure that LayerZero had.

2. ETH dominance declining at the protocol level. Ethereum's -2.98% chain-level TVL for the week, against Base's +5.84% and Solana's +3.93%, follows a −20.65% 30-day trend. Capital is not leaving DeFi; it is moving to newer execution environments. The Aerodrome Slipstream data, Morpho's Coinbase-origin loan volume, and Jupiter/Kamino inflows on Solana all point the same direction.

3. Authorization vulnerabilities now outnumber arithmetic bugs. Three of six exploits this week were authorization failures. As smart contract auditing matures and arithmetic bugs become harder to slip through, the attack surface has shifted to who is allowed to call what — access control, permission inheritance, and verifier trust assumptions. The THORChain GG20 TSS suspected flaw, the INK Finance whitelist bypass, and the ShapeShift trust chain breach are all variants of the same class.

Coverage window: May 10–17, 2026. TVL data sourced from DeFiLlama as of May 17, 2026. Exploit figures represent estimates as of May 17; post-mortems were pending for THORChain and Transit Finance at time of publication.