DeFi Week 38: Spark adds $551M as bridge exploits and Aave rate hikes reshape risk
DeFi TVL held near flat at $88.56B as Spark expanded by $551M, Nomic's $3.15M bridge exploit diluted Osmosis allBTC, and Aave hiked USDe borrowing rates.
DeFi's aggregate total value locked settled at $88.557B on the daily snapshot for September 13, 2026, dipping $310.1M, or 0.3489%, from $88.867B recorded on September 7. 1 The headline consolidation masks substantial capital reshuffling across major ecosystems, led by Spark's capital concentration on Ethereum, a surge in canonical bridge deposits into Lisk, eight security incidents totaling $3.94M, and active governance parameter interventions across Aave and Curve. 23
The scheduled evaluation window covers September 7 to September 14, 2026, at 10:00 UTC-05:00. Endpoint evaluations rely on the nearest daily historical balances around that cutoff.
Quick scan
| Metric | Verified reading | Strategic significance |
|---|---|---|
| Aggregate DeFi TVL | $88.867B to $88.557B; -$310.1M / -0.3489% 1 | The market absorbed a midweek dip to $86.511B before recovering toward weekly flat lines. |
| Largest protocol dollar gainer | SparkLend: +$363.6M; $4.553B to $4.916B 4 | Capital concentrated into core Ethereum money markets as Spark announced the shutdown of its Gnosis instance. 5 |
| Largest protocol dollar loser | Grove Finance: -$176.6M; $2.148B to $1.971B 2 | Multi-chain treasury and vault allocations declined following off-chain parameter updates. |
| Institutional credit shift | Maple: -$175.6M; $3.039B to $2.863B 2 | Fixed-term loan maturities and repayments outpaced new pool originations. |
| Largest security incident | Nomic: $3.15M (40.65 BTC unbacked mint) 3 | Diluted Osmosis allBTC backing to 63.97%; validators froze 22.65 BTC while proposal #4122 absorbs the remainder. 6 |
| Lending protocol accounting incident | Zentra Finance: $140,030 on Citrea 7 | Rounding defect in repayWithATokens; all 4 reserves paused within 17 minutes, with a 10.19% haircut planned. 7 |
| Key finalized governance vote | sdCRV Vote 1496 passed with 17.39M votes 8 | Surpassed 5.30M quorum to ramp TricryptoUSDC pool parameters, curbing liquidity provider slippage. |
| Highest displayed APY | Aerodrome CTR-USDC: 52,703.27% at $534.4K TVL 9 | Rewards supply 52,699.03% of the displayed figure, exposing farmers to reward-token liquidity risk. |
Aggregate TVL consolidates after midweek dip
DeFi total value locked opened at $88.867B on September 7, drifted to $87.287B on September 10, and hit a weekly trough of $86.511B on September 11. Bids returned over the weekend, lifting balances back to $88.557B on September 13. 1
Loading chart…
Aggregate TVL aggregates asset market valuations, native staking balances, cross-chain bridge collateral, and stablecoin deposits. The $2.356B drawdown between September 7 and September 11 tracked broader cryptocurrency price weakness, whereas the subsequent $2.046B rebound reflected collateral replenishment and stablecoin minting rather than fresh speculative leverage.
Capital distribution across primary chains
The chain endpoint totals $88.455B across tracked networks. Ethereum commands $50.006B, representing 56.533% of the recorded balance. 10 Solana, Base, and BSC occupy the next three tiers, with Base maintaining a slight lead over BSC.
| Chain | Current TVL | Share of tracked total |
|---|---|---|
| Ethereum | $50.006B | 56.533% 10 |
| Solana | $5.888B | 6.657% 10 |
| Base | $5.627B | 6.362% 10 |
| BSC | $5.608B | 6.340% 10 |
| Tron | $5.489B | 6.205% 10 |
| Bitcoin | $4.235B | 4.787% 10 |
| Arbitrum | $1.401B | 1.584% 10 |
| Hyperliquid L1 | $1.399B | 1.582% 10 |
| Monad | $1.024B | 1.158% 10 |
| Robinhood Chain | $919.4M | 1.039% 10 |
| Polygon | $803.9M | 0.909% 10 |
| Plasma | $582.6M | 0.659% 10 |
Base retained its position ahead of BSC, supported by sustained volume in Aerodrome Slipstream liquidity pools. Monad maintained its benchmark above $1.0B, while native Bitcoin TVL stood at $4.235B across liquid staking and vault wrappers.
Protocol ranking: Spark expands as institutional lending contracts
The screen evaluates non-centralized exchange protocols with at least $50M in current TVL. Baseline balances use
current TVL / (1 + change_7d / 100). Dollar deltas reflect underlying API feed values rounded to the nearest $0.1M. 2Top protocol dollar gainers
| Protocol | TVL before | Current TVL | 7-day change | Dollar move | Primary driver |
|---|---|---|---|---|---|
| SparkLend | $4.553B | $4.916B | +7.99% | +$363.6M | Collateral inflows on Ethereum Core; Spark announced the permanent closure of SparkLend on Gnosis Chain to concentrate liquidity. 45 |
| Ethena USDe | $4.382B | $4.616B | +5.33% | +$233.6M | Basis trading expansion; Aave Risk Stewards enacted rate steps aligning USDe borrow costs toward native staking yield. 211 |
| RocketSwap Anubis | $183.1M | $373.4M | +103.97% | +$190.4M | Rapid liquidity deployment on the newly tracked Anubis chain; organic stability unconfirmed. 2 |
| Spark Liquidity Layer | $2.392B | $2.580B | +7.86% | +$188.0M | Capital routing expansion following a passed Snapshot vote zeroing rate limits for Ethena sUSDe allocations. 28 |
| Lido | $24.145B | $24.332B | +0.78% | +$187.7M | Baseline staking growth on Ethereum matching price stabilization. 2 |
| Lisk Bridge | $33.4M | $184.9M | +453.85% | +$151.5M | Inflow wave across the canonical Lisk L2 bridge on Ethereum following migration campaigns. 12 |
| SSV Network | $13.077B | $13.189B | +0.86% | +$112.0M | Distributed validator technology adoption across institutional staking clusters. 2 |
| ether.fi Stake | $4.558B | $4.652B | +2.05% | +$93.7M | Core liquid restaking deposits grew steadily despite a separate legacy queue exploit. 2 |
Top protocol dollar losers
| Protocol | TVL before | Current TVL | 7-day change | Dollar move | Primary driver |
|---|---|---|---|---|---|
| Grove Finance | $2.148B | $1.971B | -8.22% | -$176.6M | Treasury allocations and tokenized JTRSY vault balances adjusted lower following parameter governance. 28 |
| Maple | $3.039B | $2.863B | -5.78% | -$175.6M | Natural credit contraction as institutional term loans matured and borrowers repaid principal. 2 |
| Aave V3 | $17.594B | $17.436B | -0.89% | -$157.4M | Outflows on select secondary network deployments outpaced Core Ethereum deposit cap growth. 2 |
| Hyperliquid Bridge | $6.732B | $6.583B | -2.22% | -$149.5M | Collateral withdrawals aligned with a reduction in derivatives exchange trading activity. 2 |
| WBTC | $9.267B | $9.120B | -1.58% | -$146.6M | Rotations into competing institutional Bitcoin wrappers including cbBTC and cirBTC. 2 |
| LayerZero V2 | $7.230B | $7.095B | -1.87% | -$134.9M | Broad reduction in cross-chain messaging liquidity balances across secondary chains. 2 |
| Sky Lending | $5.527B | $5.403B | -2.24% | -$123.9M | Debt repayments and collateral withdrawals from legacy Maker vault infrastructure. 2 |
| Kinetiq kHYPE | $1.186B | $1.063B | -10.38% | -$123.1M | Unstaking activity and asset revaluation on Hyperliquid L1. 2 |
Spark captured the week's strongest growth, adding $551.6M across SparkLend and its Liquidity Layer. Spark's September 10 announcement confirmed that SparkLend on Gnosis Chain will shut down on September 14, prompting users to wind down debt or face forced liquidations. 5 Meanwhile, Maple's $175.6M decline illustrates structural differences between open pool lending and institutional credit books: fixed-tenor loans naturally expire, reducing reported TVL until borrowers roll over facility agreements.
Security analysis: Bridge counterfeits, rounding bugs, and legacy queues
DeFiLlama recorded eight exploit events between September 7 and September 14, totaling $3,936,542 in removed assets. 3 Cross-chain bridges and lending share accounting represented the primary threat vectors.
| Protocol | Chain | Loss amount | Attack vector | Remediation status |
|---|---|---|---|---|
| Nomic | Nomic / Osmosis | $3,150,000 (40.65 BTC) 3 | Unbacked cross-chain mint on June 25 surfaced after Nomic halted on September 7; 39.84 BTC entered Osmosis allBTC transmuter pool. 6 | Osmosis v31.1.0 froze 22.65 BTC on September 7. Proposal #4122 authorizes moving frozen BTC and absorbing 17.19 BTC from community pool to restore 1:1 backing. 6 |
| Symbiosis | BSC & Ethereum | $336,000 3 | Unbacked BridgeV2 mint generating counterfeit syBTC. 13 | Bridge paused; team recovered 15 BTC and offered a 20% white-hat bounty for remaining funds. 13 |
| Cozy V2 | Optimism | $163,326 3 | Protocol logic failure. 3 | Returned funds recorded as null; patch and recovery status remain undisclosed. 3 |
| Zentra Finance | Citrea | $140,030 (140K ctUSD, 30 USDC.e) 7 | Inconsistent accounting during repayWithATokens in Aave V3 fork; debt cleared while aToken burn was reduced to zero due to a safeguard boundary flaw. 7 | Contained; multisig paused all 4 reserves within 17 minutes. A 10.19% proportional adjustment restores solvency ahead of a planned September 15 restart. 7 |
| BeatXswap | BSC | $77,512 3 | Spot price oracle manipulation. 3 | Returned funds recorded as null; recovery status undisclosed. 3 |
| ether.fi Liquid | Ethereum | $43,260 (15.45 ETH) 3 | Abuse of leftover token allowances in legacy Veda-built AtomicQueue contract on September 11. 14 | Legacy contract isolated; CEO announced 100% reimbursement for affected addresses. 14 |
| WealthManagementV2 | BSC | $26,414 3 | Private key compromise. 3 | Status undisclosed. 3 |
| Dominion | Solana | Undisclosed 3 | Private key compromise. 3 | Status undisclosed. 3 |
The Nomic incident demonstrates severe collateral contagion. On June 25, 2026, the Nomic bridge minted 40.65 BTC of unbacked nBTC on Osmosis across 25 identical transfers. 6 The breach went undetected for 74 days until Nomic halted on September 7, leaving 39.84 counterfeit BTC inside the Osmosis allBTC transmuter pool and driving its real asset backing down to 63.97%. 6 Osmosis governance proposal #4122 establishes an explicit resolution roadmap: validators froze 22.65 allBTC held by the exploiter, and community pool funds will absorb the remaining 17.19 BTC shortfall before unbacked nBTC tokens are burned. 6
Zentra Finance on Citrea Mainnet suffered an atomic rounding exploit on September 9. The attacker flash-borrowed 200,000 USDC.e to establish temporary collateral, borrowed ctUSD, and invoked
repayWithATokens for the exact debt plus one base unit. 7 A safeguard intended to prevent transaction reverts when rounding errors caused burns to exceed balances reduced the required aToken burn to zero when the caller held no aTokens. 7 Zentra's multisig paused all contracts within 17 minutes. The protocol announced a 10.19% one-time adjustment across zctUSD balances to restore claim solvency before reopening withdrawals. 7Governance outcomes: Quorum achievements and parameter adjustments
DeFi governance during the September 7–14 window delivered binding parameter changes across liquidity pools and rate structures. 8
| Protocol | Space / Portal | Proposal title | Outcome | Total vote / Quorum | Operational impact |
|---|---|---|---|---|---|
| sdCRV Governance | sdcrv-gov.eth | [OWNERSHIP] Update TricryptoUSDC parameters | Passed 8 | 17,391,583.62 / 5,298,570.15 (Quorum met) 8 | Executes a 14-day ramp for A parameter (1,707,629 to 821,254) and gamma (11.8T to 33.2T); commits fee schedule updates to protect liquidity providers. 8 |
| Spark Protocol | sparkfi.eth | Spark Liquidity Layer - Set Ethena sUSDe Rate Limits to 0 | Passed 8 | 628,343,553.45 / 0 (Quorum met) 8 | Removes rate allocation throttles for Ethena sUSDe in the Spark Liquidity Layer, enabling frictionless liquidity routing. 8 |
| Spark Protocol | sparkfi.eth | SAEP-20: Update Risk Curation Framework Artifact Section | Passed 8 | 628,343,553.45 / 0 (Quorum met) 8 | Formalizes operational artifacts governing risk curation standards across Spark products. 8 |
| Panther Protocol | pantherprotocol.eth | PIP-42: Launch of DAO-Operated Zone on Base | Passed 8 | 8,263,853.72 / 7,521,798.00 (Quorum met) 8 | Approves deployment of compliant privacy zones on Base and completes ownership transition. 8 |
Complementing DAO votes, Aave V3 Risk Stewards published three parameter executions on September 7, September 9, and September 11. 111516 Risk Stewards expanded USDC supply caps to 3.0B and borrow caps to 2.7B on Ethereum Core to accommodate institutional borrowing demand. 11 Simultaneously, Risk Stewards raised the USDe base borrow rate by 100 basis points across five network deployments, continuing a progressive climb toward 5.25% to match Ethena's native staking yield and deter cheap recursive carry trades. 11
Yield anomalies: Emissions dominate four-digit APY prints
The yields endpoint identifies several concentrated liquidity pools exhibiting APYs above 1,000% with at least $500,000 in locked collateral. 9 Dissecting total return into base swap fees versus reward token emissions reveals severe distribution skew.
| Pool | Chain | TVL | Total APY | Base APY | Reward APY | 7-day Base | 30-day Mean | Risk profile |
|---|---|---|---|---|---|---|---|---|
| Aerodrome Slipstream CTR-USDC | Base | $534,420 | 52,703.27% | 4.23% | 52,699.03% | 4.97% | 45,530.18% | Rewards account for 99.99% of headline yield; reward-token exit liquidity dictates realized return. 9 |
| Aerodrome Slipstream USDC-VELVET | Base | $994,678 | 41,294.96% | 0.56% | 41,294.40% | 2.00% | 125,848.00% | Base swap fee generation dropped to 0.56%; return depends entirely on sustained emissions. 9 |
| Aerodrome Slipstream USDC-PROS | Base | $802,655 | 11,510.53% | 6.90% | 11,503.63% | 7.89% | 72,464.15% | Emissions supply 99.94% of return; 30-day mean indicates rapid reward rate decay. 9 |
| Aerodrome Slipstream USDC-SNDKC | Base | $849,892 | 9,672.00% | 137.82% | 9,534.18% | 26.11% | 2,261.45% | Strong 24-hour volume ($6.4M) lifted base yield, though rewards still drive 98.5% of total. 9 |
| Aerodrome Slipstream USDC-SPCXC | Base | $837,295 | 6,624.68% | 88.75% | 6,535.93% | 24.33% | 896.12% | Elevated trading activity generates genuine fees, accompanied by substantial reward incentives. 9 |
| Aerodrome Slipstream WETH-CBBTC | Base | $1,395,510 | 4,277.64% | 79.91% | 4,197.73% | 57.19% | 3,485.35% | Daily swap volume ($35.9M) generated an 79.91% base return; dual volatile exposure adds impermanent loss risk. 9 |
The extreme yield profiles remain concentrated within Aerodrome Slipstream pools on Base. Pools such as CTR-USDC and USDC-VELVET feature base annual yields below 5%, with rewards providing virtually the entire advertised rate. In contrast, the WETH-CBBTC pair generated $35.9M in daily trading volume, providing a durable 79.91% base rate alongside incentives. Farmers entering these positions must distinguish between liquidity-driven swap fees and emission-driven token distribution.
Trader and yield farmer action checklist
- Audit Bitcoin wrapper reserves. Check underlying bridge backing before supplying liquidity to multi-asset transmuter pools. The Nomic incident demonstrates that bridge accounting discrepancies can dilute shared collateral reserves. 6
- Repay SparkLend loans on Gnosis Chain. Close open debt positions before the September 14 execution deadline to prevent forced protocol liquidations. 5
- Recalibrate stablecoin carry trades on Aave V3. Account for progressive 100 basis point hikes in USDe base borrow rates across Ethereum, Arbitrum, and secondary deployments. Ensure delta-neutral yields exceed rising debt costs. 11
- Review token allowance hygiene. Revoke approvals granted to deprecated smart contracts and legacy withdrawal queues. The ether.fi incident demonstrates that dormant contracts remain vulnerable to delayed exploitation. 14
- Discount headline APYs on incentive-heavy pools. Estimate exit slippage for reward tokens on Aerodrome pools where emissions account for more than 98% of total yield. 9
References
- 1DeFiLlama historical chain TVL API
api.llama.fi
- 2DeFiLlama protocols API
api.llama.fi
- 3DeFiLlama hacks API
api.llama.fi
- 4DeFiLlama SparkLend protocol page
defillama.com
- 5Odaily SparkLend Gnosis closure report
odaily.news
- 6Osmosis proposal 4122 on nBTC incident
forum.osmosis.zone
- 7
- 8Snapshot GraphQL API
hub.snapshot.org
- 9DeFiLlama yield pools API
yields.llama.fi
- 10DeFiLlama chain TVL API
api.llama.fi
- 11Aave governance Risk Stewards Sep 7 IRM report
governance.aave.com
- 12DeFiLlama Lisk Bridge protocol page
defillama.com
- 13Symbiosis incident recovery reporting
crypto.news
- 14ether.fi Liquid exploit reporting
cryptotimes.io
- 15Aave governance Risk Stewards Sep 9 IRM report
governance.aave.com
- 16Aave governance Risk Stewards Sep 11 IRM report
governance.aave.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.