DeFi Weekly Intel: LayerZero exodus tops $4B as THORChain suffers $11M hack
$84.44B total DeFi TVL this week: Ethena gains $835M, SSV Network drops $966M, THORChain loses $11M to exploit, 13 governance votes close including WLFI's 62B-token restructuring.
May 10–17, 2026 | Total DeFi TVL: $84.44B
The week's defining story was structural: protocols migrating their cross-chain infrastructure away from LayerZero — a chain reaction still reverberating from April's $292M KelpDAO exploit. Six new exploits added another ~$12.5M in losses. Governance was unusually active, with 13 votes closed, led by WLFI's 62B token unlock restructuring.
| Category | Headline figure | Direction |
|---|---|---|
| Total DeFi TVL | $84.44B | ↓ 0.61% (24h) |
| Top TVL gainer (7d) | Ethena ecosystem +$835M combined | ↑ |
| Top TVL loser (7d) | SSV Network −$966M | ↓ |
| Exploits this week | ~$12.5M across 6 incidents | — |
| Largest exploit | THORChain $10–11M | — |
| Governance votes closed | 13 | — |
| Chains with positive 7d TVL | Solana (+3.93%), Base (+5.84%) | ↑ |
TVL snapshot: ETH staking bleeds, Solana and Base hold
Total DeFi TVL closed the week at $84.44B, down 0.61% in 24 hours. 1 Twenty-two of the top 30 protocols posted negative seven-day changes, with ETH-denominated protocols bearing the steepest cuts. 2
Chain-level picture:
| Chain | TVL | 7d change |
|---|---|---|
| Ethereum | $44.18B | −2.98% |
| Solana | $6.01B | +3.93% |
| BSC | $5.56B | −0.83% |
| Bitcoin | $5.19B | −1.95% |
| Tron | $5.15B | −0.19% |
| Base | $4.85B | +5.84% |
Ethereum's 7-day decline of −2.98% is modest in isolation; its 30-day figure of −20.65% reflects the cumulative damage from the KelpDAO exploit in mid-April. Solana and Base are the only top-6 chains with positive 7-day growth — a split that likely reflects capital rotating out of heavy ETH-denominated staking positions.
Top 7-day TVL gainers
Ethena dominated the gainers list with +$835M combined across two products. 2
| Protocol | TVL | 7d change | 7d abs. |
|---|---|---|---|
| Ethena USDtb | $1.08B | +71.72% | +$450M |
| Ethena USDe | $4.35B | +9.71% | +$385M |
| Portal (Wormhole) | $2.37B | +17.05% | +$345M |
| Steakhouse Financial | $2.15B | +17.95% | +$327M |
| Uniswap V3 | $2.09B | +17.81% | +$315M |
| Grove Finance | $2.84B | +9.63% | +$249M |
| Jupiter Lend | $1.23B | +24.30% | +$240M |
| BlackRock BUIDL | $3.23B | +8.01% | +$239M |
| Kamino Lend | $1.64B | +9.63% | +$144M |
| Ondo Global Markets | $1.02B | +7.73% | +$73M |
Three distinct inflow themes are visible here. First, Ethena's RWA-backed USDtb gained +71.7%, more than double the rate of USDe itself — suggesting demand is shifting toward the real-world-asset-collateralized variant of the stablecoin. 4 Second, Solana-native lending (Jupiter Lend +$240M, Kamino Lend +$144M) is directly mirroring the chain's +3.93% TVL growth. Third, RWA protocols as a group — BlackRock BUIDL, Ondo, and Ethena USDtb — added roughly +$561M, the clearest signal yet that institutional-grade yield products are pulling capital from pure-play DeFi structures.
Top 7-day TVL losers
ETH staking protocols collectively shed ~$3.7B. 2
| Protocol | TVL | 7d change | 7d abs. |
|---|---|---|---|
| SSV Network | $16.15B | −5.64% | −$966M |
| Lido | $19.41B | −4.55% | −$926M |
| Aave V3 | $14.30B | −4.16% | −$621M |
| Binance staked ETH | $8.10B | −5.60% | −$480M |
| WBTC | $8.96B | −3.87% | −$360M |
| EigenCloud | $7.16B | −4.73% | −$355M |
| Coinbase Bridge | $6.33B | −4.41% | −$292M |
| Obol | $0.91B | −23.84% | −$286M |
| ether.fi Stake | $4.77B | −5.62% | −$284M |
| Mellow Core | $0.17B | −61.87% | −$270M |
The five liquid staking and restaking protocols at the top of this list (SSV, Lido, Binance staked ETH, EigenCloud, ether.fi) account for roughly $3.0B of the total decline. A significant portion reflects ETH price movement rather than protocol-specific outflows; however, Obol's −23.8% and Mellow Core's −61.9% are too large to explain by price alone, suggesting protocol-level migrations or product changes that have not yet been publicly disclosed.
LayerZero exodus: $4B+ moves to Chainlink CCIP
The migration wave triggered by the April 18 KelpDAO $292M exploit (the largest DeFi hack of 2026, attributed to North Korea's Lazarus Group 5) continued all week. The attack exploited LayerZero's single-signer DVN (Decentralized Verifier Network — a bridge security model that relied on just one independent verifier to confirm cross-chain messages) configuration. LayerZero subsequently acknowledged it "made a mistake" by permitting that configuration for high-value assets. 6
Confirmed migrations, May 7–15:
- Solv Protocol — migrated $700M in tokenized Bitcoin (SolvBTC and xSolvBTC) on May 7 6
- Re.xyz — $475M in TVL, citing CCIP's 16 independent validator nodes and built-in rate limits 7
- Kraken — announced May 14 that kBTC and all future Kraken Wrapped Assets will use Chainlink CCIP exclusively, citing ISO 27001 and SOC 2 Type 2 certifications 5
- Lombard Finance — migrated $1B+ in BTC-native assets on May 15, pushing cumulative migrations past $4B 6
Chainlink CCIP (Cross-Chain Interoperability Protocol — a cross-chain messaging infrastructure using a decentralized oracle network with multiple independent node operators) accumulated over $2.5B in protocol TVL from this migration wave. 8 The security argument is straightforward: where LayerZero allowed a 1-of-1 verifier model, CCIP requires consensus across an ensemble of independent nodes.
LayerZero has since removed support for 1-of-1 DVN configurations and is moving most routes toward 5-of-5 verifier setups. Despite the migrations, LayerZero reported over $9B in bridged assets moved through its infrastructure since April 19.
Aave's rsETH market restarts; Morpho keeps absorbing displaced users
On May 13, Aave transferred the first 25,000-rsETH tranche into the LayerZero OFT adapter, formally reopening cross-chain bridging after a month-long freeze. A total of 117,132 rsETH (~$278M) is being replenished in staged tranches over two weeks. 9 On May 15, a court greenlit an Arbitrum DAO vote to route $71M in recovered Kelp ETH to Aave. 10 A terrorism-creditor restraining notice filed May 1 creates legal uncertainty that could delay the final recovery tranches.
While Aave's 7-day TVL declined −$621M, Morpho (a modular lending protocol — it runs isolated lending markets rather than a shared liquidity pool, limiting contagion between collateral types) reached $11.78B TVL, with only $1M in KelpDAO-related exposure versus Aave's ~$200M bad debt. 11 Apollo Global (a private credit and alternative asset manager with $940B in assets under management) committed to acquire 90M MORPHO tokens over 48 months. 11 Coinbase-originated USDC loans on Morpho totaled $2.17B — half of Morpho's entire $4B active loan book.
Exploits: ~$12.5M across 6 incidents
Six confirmed exploits closed this week, with THORChain accounting for roughly 85% of total losses.
| Protocol | Date | Chain | Est. loss | Vector | Status |
|---|---|---|---|---|---|
| THORChain | May 15 | ETH, BTC, BSC, Base, +5 | ~$10–11M | Suspected GG20 TSS flaw | Trading halted, post-mortem pending |
| Transit Finance | May 13 | Ethereum | ~$1.8M | Unknown | No official statement |
| Renegade.fi | May 10 | Arbitrum | ~$209K | Access control (V1 legacy) | White hat recovered ~$190K; full compensation pledged |
| INK Finance | May 11 | Polygon | ~$140K | Whitelist bypass + flash loan | No official statement |
| ShapeShift FOX Colony | ~May 15 | Arbitrum | ~$132K | Auth trust chain flaw | SlowMist analysis published |
| Huma Finance | May 11 | Polygon | ~$101K | Deprecated V1 logic error | Users unaffected; protocol fees only |
Total: approximately $12.4M
THORChain — $10–11M multi-chain hack, trading halted 12+ hours
On May 15, THORChain (a decentralized cross-chain liquidity protocol that enables native asset swaps across Bitcoin, Ethereum, and other chains without wrapped tokens) suffered a security breach across at least nine blockchains: Bitcoin, Ethereum, BSC, Base, Avalanche, Dogecoin, Litecoin, Bitcoin Cash, and XRP. PeckShield confirmed 36.75 BTC (~$3M) and ~$7M in EVM tokens were stolen. 12 The protocol's Mimir governance module activated an emergency pause, halting all trading and signing operations for approximately 12 hours 42 minutes.
THORChain's initial statement said: "Initial findings indicate that no user funds were affected. The team continues to work on a comprehensive recovery and network relaunch plan." 13 The team flagged a potential implementation flaw in the GG20 TSS (Threshold Signature Scheme — a multi-party computation method used to generate multi-chain transaction signatures without exposing private keys to any single party) design, though a full technical post-mortem had not been released by May 17.
RUNE fell roughly 13% immediately after news broke. 14 TRM Labs noted that cumulative losses from THORChain-related thefts since 2021 — including two prior exploits and a 2025 founder wallet compromise — now approach $25M. 15
The smaller four: authorization logic as the common thread
Three of the week's five smaller exploits — INK Finance's whitelist bypass, ShapeShift FOX Colony's authorization trust chain flaw, and Renegade.fi's access control failure — all trace to authorization logic rather than smart contract arithmetic errors. 161718 Huma Finance's $101K loss came from a deprecated V1 contract that was never removed from the network. 19 Renegade.fi is the week's bright spot: a white hat recovered ~$190K of the ~$209K stolen, and the protocol pledged full compensation. 17
Yield anomalies: THORChain offline, Flare cuts 40%, Base farms lead
THORChain yield destruction
THORChain's emergency halt wiped out all in-protocol yield for the duration of the pause — liquidity providers could not earn swap fees or RUNE emissions, and all pending transactions were suspended. For active LP positions in THORChain pools, the relevant question is whether the protocol fully resumes before the next block reward cycle; as of May 17 the full post-mortem and relaunch timeline remained pending. 20
Flare Network: 40% emissions cut, operational utility phase begins
Flare Network (a blockchain layer designed for XRP ecosystem DeFi, supporting smart contracts for assets from non-smart-contract chains) implemented a 40% reduction in FLR token emissions, alongside new MEV capture mechanisms and revised burn mechanics. 21 The network's multi-year FlareDrop distribution program has ended; Flare is now in what it calls an "operational utility" phase with bounded new issuance.
SparkDEX (Flare's primary DEX) held a community vote from May 13–17 on how to allocate protocol revenue and SPRK emissions between buybacks and burns, stFLR rewards, and ongoing emissions. 21 FLR gained 16.1% in 7 days versus ~2.2% for the broader altcoin market. The XRPFi ecosystem on Flare holds approximately $457M in TVL with ~$200M attributed to XRP-specific activity.
The yield implication: pools with high SPRK emission allocations could see rate changes in the days following the vote's execution. LPs holding FLR-denominated positions should verify their current APY sources against the new emissions schedule once the SparkDEX vote executes.
Base Aerodrome Slipstream: highest reward efficiency in DeFi this week
According to a May 16 r/defi yield summary, Aerodrome Slipstream pools on Base were printing the week's highest reward efficiency: USDC-AERO at 45.9%, WETH-CBBTC at 57.1%, and multiple WETH-AERO and WETH-BRETT pools at 94–152%. 22 These figures come from a community aggregator and have not been independently confirmed against DeFiLlama's Base chain data; treat them as directional rather than precise.
The broader pattern: Berachain TVL gained +$26M on the same day Ethereum lost -$2B. The APyPulse analyst summarized it this way: "The meta has shifted from 'hold everything on Ethereum' to 'chase the new yield meta on Base + Berachain while Ethereum consolidates.'" 22 Morpho Blue's PRIME pool saw a 24-hour TVL increase of +565% from a ~$10M base — notable growth in absolute terms but too small to signal a structural shift on its own.
Ethena ENA launches on Solana; blue-chip yields hold 2–5%
On May 14, Ethena's ENA governance token launched on Solana through integration with Sunrise DeFi. 23 USDe's current yield on Ethereum is 4.27% APY (30-day average), essentially flat from the previous period. 24
Blue-chip yield baselines as of May 17: 24
| Protocol / Pool | TVL | APY |
|---|---|---|
| Sky Lending (SUSDS) | $6.06B | 3.65% |
| Maple (USDC Syrup) | $3.39B | 4.83% |
| Circle USYC | $2.86B | 3.06% |
| Ethena USDe | $1.80B | 4.27% |
| Spark Savings (USDT) | $1.27B | 2.50% |
| Lido stETH | $19.43B | 2.43% |
| Binance staked ETH (WBETH) | $7.64B | 2.57% |
| ether.fi WEETH | $4.08B | 2.60% |
Ethereum's validator count reached an all-time high of 1,034,051 (up 65% year-over-year), pushing ETH staking APR down to 3.22% — more validators competing for the same issuance means each earns less. 25 No established protocol above $10M in TVL showed a sustainable APY above 50% during this period.
Governance: 13 votes closed, WLFI leads by size
Thirteen governance proposals closed during May 10–17, with Curve (6 proposals) and ENS (2 proposals) accounting for most of the volume. The two votes with direct protocol-parameter consequences for LPs are the Curve A-parameter ramps and the WLFI token unlock.
| Protocol | Proposal | Result | On-chain impact |
|---|---|---|---|
| WLFI | 62B token unlock restructuring | 99.9% pass, 11,537 wallets | ~4.5B tokens burned (10% of founder/team tranche); remainder on 2–5 year vesting |
| Balancer | BIP-920 veBAL compensation airdrop | 100% pass (3.44M veBAL) | Airdrop to veBAL holders displaced by BIP-919 tokenomics overhaul |
| Beets | BIP-115 terminate sFTMx on Fantom Opera | 100% pass (14.28M BEETS) | FTM bridges to Sonic as S; users can claim through year-end |
| Curve | alETH/WETH pool: A ramp 200→300 | Passed (sdCRV 18M, Convex 12M CVX) | Lower slippage on alETH/WETH swaps; one-week ramp |
| Curve | alETH/frxETH pool: A ramp 100→300 | Passed (sdCRV 16.7M, Convex 13.1M CVX) | Tighter peg maintenance for alETH/frxETH |
| Curve / sdCRV | USDM Pegkeeper debt ceiling → 0 | Passed (sdCRV 13.5M) | Removes USDM from crvUSD price aggregator; reduces Curve's USDM exposure |
| Curve (Concentrator) | twocrypto implementation update | Failed (quorum not met, 0 votes) | No change |
| ENS | ENSv2 pricing (5+ char names) | 99.2% pass (1.75M ENS) | Multi-year discounts, grace period changes for longer names |
| ENS | SPP3 service provider program | 95.4% pass (1.55M ENS) | Committee structure for ENS service providers authorized |
| Orderly Network | Deprecate 6 low-TVL chains | Passed by default | Story ($186K TVL), Plume ($24K), Monad ($14K), Abstract ($9K), Morph ($975) deprecated |
| Decentraland | Remove Catalyst node peer.kyllian.me | Passed (11.9M MANA) | Node removed from network |
Three votes to watch closely
WLFI token unlock is the highest-stakes vote by order of magnitude. 26 Approximately 62B previously frozen tokens now enter a 2–5 year vesting schedule via a Lockbox smart contract; early supporters (~17B WLFI) get a 2-year cliff, while founder, team, and partner allocations (~45.2B) burn 10% immediately with the remainder on a 2-year cliff + 3-year linear vest. The vote passed at 99.9% approval — unsurprising given that the top four wallets control ~40% of voting power. WLFI traded at $0.059 at the time of the vote, down ~88% from its September 2025 peak of $0.46. The 10% burn is a net positive for supply, but the unlock windows beginning in two years are the real variable; any price recovery between now and 2028 will face significant scheduled sell pressure.
Curve A-parameter ramps: Raising the amplification parameter (A) in StableSwap pools tightens the peg range around the 1:1 curve, reducing slippage for in-range swaps while increasing impermanent loss exposure for LPs providing liquidity away from peg. The alETH/WETH ramp from 200→300 and alETH/frxETH from 100→300 both take effect over one week. 27 LPs in these pools should verify their position concentrations; the higher A values make positions more sensitive to any depeg event.
Arbitrum Constitutional AIP (active, not yet closed): The proposal to release $71M in frozen ETH — the Arbitrum Security Council's seizure from the KelpDAO hacker — is on Tally with 98.1M ARB in favor as of May 17. 29 If it passes, those recovered funds route to Aave as partial bad-debt coverage. This is a Constitutional-level proposal requiring higher quorum, and the terrorism-creditor restraining notice filed May 1 adds jurisdictional complexity.
Cross-week signal summary
Three patterns emerged across the four data streams this week:
1. Structural shift in bridge security standards. Four major protocols replacing LayerZero with Chainlink CCIP in eight days is not noise — it reflects a real repricing of bridge security risk following the KelpDAO exploit. Protocols still operating on multi-chain infrastructure with 1-of-N verifier configurations are carrying the same structural exposure that LayerZero had.
2. ETH dominance declining at the protocol level. Ethereum's -2.98% chain-level TVL for the week, against Base's +5.84% and Solana's +3.93%, follows a −20.65% 30-day trend. Capital is not leaving DeFi; it is moving to newer execution environments. The Aerodrome Slipstream data, Morpho's Coinbase-origin loan volume, and Jupiter/Kamino inflows on Solana all point the same direction.
3. Authorization vulnerabilities now outnumber arithmetic bugs. Three of six exploits this week were authorization failures. As smart contract auditing matures and arithmetic bugs become harder to slip through, the attack surface has shifted to who is allowed to call what — access control, permission inheritance, and verifier trust assumptions. The THORChain GG20 TSS suspected flaw, the INK Finance whitelist bypass, and the ShapeShift trust chain breach are all variants of the same class.
Coverage window: May 10–17, 2026. TVL data sourced from DeFiLlama as of May 17, 2026. Exploit figures represent estimates as of May 17; post-mortems were pending for THORChain and Transit Finance at time of publication.
References
- 1DeFiLlama - DeFi Dashboard
defillama.com
- 2DeFiLlama API - Protocols
api.llama.fi
- 3Chain Rankings by TVL - DeFiLlama
defillama.com
- 4Ethena USDe TVL, Fees & Revenue
defillama.com
- 5Kraken replaces LayerZero with Chainlink CCIP
coindesk.com
- 6
- 7Kraken Migrates to Chainlink CCIP
thedefiant.io
- 8Chainlink CCIP Surpasses $2.5B
crypticmedia.co
- 9Aave's rsETH Bridge Restart
ainvest.com
- 10Court Greenlights Arbitrum DAO Vote
thedefiant.io
- 11
- 12
- 13
- 14CoinDesk: THORChain halts trading
coindesk.com
- 15TRM Labs: THORChain Exploit Drains USD 11M+
trmlabs.com
- 16INK Finance loses $140K
ambcrypto.com
- 17Cryptopolitan: Ink Finance and Renegade exploited
cryptopolitan.com
- 18SlowMist: ShapeShift FOX Colony Analysis
slowmist.medium.com
- 19Huma Finance reports $101K exploit
cryptobriefing.com
- 20TokenPost: THORChain Hack
tokenpost.com
- 21Flare FLR Surges 16.1%
coinmarketcap.com
- 22Reddit r/defi ApyPulse
reddit.com
- 23Ethena ENA Token Launches on Solana
thedefiant.io
- 24DeFiLlama Stablecoin Yields
defillama.com
- 25Blockworks: crypto narrative evolution
blockworks.co
- 26WLFI 62B Token Unlock
memeburn.com
- 27Snapshot.org GraphQL API
hub.snapshot.org
- 28Crypto Briefing: Orderly Network
cryptobriefing.com
- 29Tally: Arbitrum Governance
tally.xyz
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.