DeFi Week 31: TVL rises, but bridge and oracle risk widens
Week 31 DeFi TVL rose 1.33% to $76.6B, led by ETH-linked staking, while $50.3M in day-labeled losses and extreme yield prints sharpened the bridge, oracle, and rate-risk screen.
DeFi TVL climbed from $75.624B on the July 20 daily snapshot to $76.633B on July 27, a gain of $1.009B (1.33%). The move was positive but concentrated: Lido added about $1.126B, while Portal lost about $755.2M. The security ledger carried $50.326M in quantified losses, led by the AFX bridge drain and a Triple-A hot-wallet breach. 123
Data cutoff: July 27, 2026, 10:00 a.m. GMT-5. DeFiLlama's TVL series is daily, so the total uses the daily points nearest the scheduled cutoff rather than an hour-level balance. The chain endpoint returned current TVL levels but no per-chain seven-day field in this retrieval; the chain table below is therefore a composition snapshot, while the protocol table uses DeFiLlama's
change_7d field. 14Week 31 quick scan
| Signal | Result | Trading read |
|---|---|---|
| Total DeFi TVL | $76.633B, up 1.33% from $75.624B | The rebound continued, but the aggregate hides large protocol-level rotations. 1 |
| Largest protocol dollar gain | Lido: +$1.126B, +6.53%, to $18.370B | The largest positive move in the non-CEX screen. 2 |
| Largest protocol dollar loss | Portal: -$755.2M, -32.51%, to $1.568B | A bridge-level outflow that needs a protocol-specific explanation; the TVL feed does not provide one. 2 |
| Quantified security losses | $50.326M across eight day-labeled records | AFX and Triple-A account for most of the amount; Garden's record is tied to solver infrastructure rather than user funds according to the project's account. 35 |
| Governance | Uniswap's V4 temp check closed below its stated quorum; Lido and Arbitrum votes closed with For-majority results, but some quorum fields were unavailable | Treat closed Snapshot state as a vote record, not proof of on-chain execution. 6 |
| Yield anomaly | APXUSD-USDC on Curve printed 7,190.77% APY on $9.40M TVL versus a 11,912.57% 30-day mean | This is an investigation trigger, not a baseline return. 7 |
TVL: Ethereum carried the week, but the leaderboard did not move as one
Ethereum held about $42.062B, more than half of the $76.633B total. Solana was at $4.913B, Tron at $4.880B, BSC at $4.876B, and Base at $4.635B. Smaller but relevant snapshots were Hyperliquid L1 at $1.267B, Arbitrum at $1.231B, Monad at $778.1M, and Robinhood Chain at $335.7M. These are current chain levels, not per-chain weekly deltas, because the returned chain feed did not include that field. 4
| Chain | Current TVL | Share of total | What the snapshot says |
|---|---|---|---|
| Ethereum | $42.062B | 54.9% | The main liquidity base for the week. |
| Solana | $4.913B | 6.4% | Similar in size to BSC and Tron in the current snapshot. |
| Tron | $4.880B | 6.4% | Large stablecoin-heavy chain level, without a returned seven-day delta. |
| BSC | $4.876B | 6.4% | Near Solana and Tron in current TVL. |
| Base | $4.635B | 6.0% | The largest of the listed newer L2 snapshots. |
| Hyperliquid L1 | $1.267B | 1.7% | A smaller base where protocol moves can look large in percentage terms. |
| Arbitrum | $1.231B | 1.6% | The chain-level figure does not identify which applications drove the move. |
| Monad | $778.1M | 1.0% | A high-growth ecosystem remains small relative to Ethereum. |
| Robinhood Chain | $335.7M | 0.4% | A small base makes percentage comparisons especially noisy. |
For the protocol ranking, I screened records with at least $50M of current TVL, excluded CEX entries, and back-calculated the prior comparison value as
current TVL / (1 + change_7d). That produces a dollar-change ranking, not a claim about deposits or withdrawals. DeFiLlama's protocol feed does not attach a cause to each move, so the rows below are signals to investigate rather than causal findings. 2| Protocol | TVL before | Current TVL | 7-day change | Dollar move | Chains in feed |
|---|---|---|---|---|---|
| Lido | $17.245B | $18.370B | +6.53% | +$1.126B | Ethereum, Solana, Moonbeam, Moonriver, Terra |
| Spiko | $1.211B | $2.214B | +82.85% | +$1.003B | Stellar, Arbitrum, Ethereum, Polygon, Base, Starknet, Etherlink |
| SSV Network | $9.134B | $9.689B | +6.08% | +$555.0M | Ethereum |
| ether.fi Stake | $3.028B | $3.393B | +12.05% | +$364.8M | Arbitrum, Ethereum, Base |
| Binance staked ETH | $6.962B | $7.299B | +4.83% | +$336.4M | Ethereum, Binance |
| Portal | $2.323B | $1.568B | -32.51% | -$755.2M | Ethereum, Algorand, Binance, Solana, Sui, Polygon, Base, Near, Avalanche, Arbitrum, Aptos, Optimism and others |
| Polygon Bridge | $2.828B | $2.690B | -4.91% | -$139.0M | Ethereum |
| USDT0 | $3.485B | $3.379B | -3.06% | -$106.7M | Ethereum |
| Ethena USDtb | $454.1M | $354.8M | -21.88% | -$99.4M | Ethereum |
| Maple | $2.438B | $2.356B | -3.37% | -$82.2M | Ethereum, Solana |
The gain side is dominated by ETH-linked staking. Lido, SSV, ether.fi Stake, and Binance staked ETH all rose while Ethereum remained the largest chain snapshot. That alignment is consistent with an ETH-linked TVL rebound, but the data cannot separate token-price appreciation from new capital. Spiko's 82.85% increase is large in percentage terms and almost as large as Lido's dollar gain; its smaller starting base makes the percentage less comparable.
Portal is the outlier on the loss side. The feed shows a $755.2M fall across many chains, but it does not say whether the change came from redemptions, asset-price moves, accounting, or a migration. The correct trade response is to find a protocol statement or on-chain position change before treating it as a fundamental exit. The same caution applies to Ethena USDtb's 21.88% decline and Lorenzo sUSD1+'s larger percentage loss, which is outside the top-dollar-loss table because its current TVL is below the screen's main size threshold.
Exploits: $50.3M in day-labeled records, with bridge and wallet risk back in focus
DeFiLlama's hack database returned eight quantified records dated July 21 through July 26 in the local display window, totaling $50.326M. The feed also listed an unquantified Zilliqa record. The dates are day labels rather than event timestamps, so the table is a database-window screen, not a claim that each event occurred before the cutoff hour. 3
| Record | Chain(s) | Amount in feed | Technique / surface | Status or limitation |
|---|---|---|---|---|
| AFX Bridge | Arbitrum | $24.15M | Private-key compromise; cross-chain bridge withdrawal | AFX operations were suspended or under investigation in the reviewed report; no recovery was confirmed. 8 |
| Triple-A | Ethereum, Tron, Polygon, Arbitrum, Solana, TON | $9.70M in DeFiLlama; later report estimated about $12M | Hot-wallet compromise | Triple-A said customer funds were not affected; the reviewed report said the investigation was ongoing. 9 |
| Verus-Ethereum Bridge | Verus | $7.53M | Bridge verification bypass | The returned DeFiLlama record contained no recovery or remediation field. 3 |
| Wanchain | Cardano | $6.50M | Signature exploit | The returned DeFiLlama record contained no recovery or remediation field. 3 |
| Garden | Ethereum, Base, Arbitrum, BSC | $450K | HTLC / solver-infrastructure incident | Garden said an independent solver's off-chain database was compromised, no user funds were lost or at risk, and the app was paused while funds were traced. 5 |
| DeBond | Ethereum | $542K | Accounting error | No recovery detail was present in the returned feed. 3 |
| Lien | Ethereum | $542K | Input-validation flaw | No recovery detail was present in the returned feed. 3 |
| 42DAO | BSC | $912K in DeFiLlama; reporting put the loss at $912K–$915K | Oracle manipulation and liquidation abuse | BLC fell about 99.75% in the reviewed report; no team recovery plan was visible there. 10 |
AFX is the largest single loss and the most actionable bridge warning. A crypto.news report, citing Blockaid and an Arbiscan transfer, put the drain at $24.15M USDC from an AFX-operated bridge on Arbitrum and explicitly separated it from Arbitrum's native bridge. The report said the attacker moved the funds to Ethereum and bought about 12,467 ETH; no recovery had been confirmed at publication. 8
Triple-A adds a different failure mode. The initial DeFiLlama amount was $9.7M, while a July 26 Crypto Briefing report put the estimate near $12M after continued tracking. That discrepancy is why the ledger uses the DeFiLlama value for its total and shows the later estimate separately. The report said the drain hit hot wallets across six chains and that customer funds were not affected. 39
The 42DAO incident is the week's clearest stablecoin-specific warning. The reviewed report described a falsified BTCB price on BNB Chain, missing price protection and liquidation delay, and a resulting BLC collapse. The direct loss was under $1M, but the peg failure widened the user impact beyond the drained treasury. 10
Governance: closed votes, limited execution evidence
The Snapshot query for tracked major DAO spaces returned four relevant closures in or immediately after the cutoff boundary. It reports vote scores, state, and quorum fields, but not an execution transaction. A
quorum: 0 response is treated here as unavailable, not as proof that quorum was met. 6| DAO / proposal | Close time | Returned result | Governance read-through |
|---|---|---|---|
Lido: 0x02 CSM: New Permissionless Module Launch | July 20, 11:00 a.m. GMT-5 | For 58.014M, Against 0; quorum field 0 | Closed with a For-only score; execution status was not in the returned payload. |
Lido: Adopt the CMv2 Penalty Framework | July 20, 11:00 a.m. GMT-5 | For 58.014M, Against 0; quorum field 0 | The vote record does not establish the execution step or a formal quorum result. |
Arbitrum: Ratification of Security Council Election Process Improvements | July 23, 8:45 a.m. GMT-5 | For 182.211M, Against 74.9K, Abstain 21.848M; quorum field 0 | For dominated the returned score, but the available payload does not prove quorum or on-chain execution. |
Uniswap: [Temp Check] - Four for V4 | July 26, 6:15 p.m. GMT-5 | For 5.348M, Against 0, Abstain 1.814K; stated quorum 10M | The returned score was below the stated quorum, so this temp check did not meet that threshold. |
The practical distinction is between a vote result and a protocol parameter change. Lido's two records concern staking-module access and penalty policy, while Arbitrum's concerns Security Council election-process improvements. Uniswap's V4 item is a temp check rather than an execution record. Governance-token traders should wait for the on-chain execution or a protocol announcement before pricing a completed parameter change.
Yield anomalies: headline APY is diverging from recent history
The yield feed contains several pools where the current APY is far from the 30-day mean or the seven-day comparison field. Those differences can come from fees, incentives, changing pool denominators, or data artifacts. None is a standalone promise of repeatable return. 7
| Pool | Chain | TVL | Current APY | 7-day comparison | 30-day mean |
|---|---|---|---|---|---|
| USDC-VELVET on Aerodrome Slipstream | Base | $3.01M | 34,765% | -190,225 pp | 224,966% |
| APXUSD-USDC on Curve | Ethereum | $9.40M | 7,190.77% | +7,185.87 pp | 11,912.57% |
| WSTETH-AAVE on Balancer V2 | Ethereum | $13.38M | 1.06% | -260,978 pp | 35,170.70% |
| ETH-01 on Uniswap V4 | Ethereum | $1.10M | 160.09% | -44.60 pp | 1,461.63% |
| USDC on Growihf | Hyperliquid L1 | $9.20M | 33.63% | +30.44 pp | 1,296.17% |
The feed's units are percentage points for the comparison fields, not a claim that a pool earned those rates over the full period. The strongest warning is the combination of a very high current print and a very different baseline: Aerodrome's USDC-VELVET pool shows 34,765% current APY against a 2.29% seven-day base field and a 224,966% 30-day mean. That is a rate-data anomaly until volume, incentives, and exit liquidity are checked.
The opposite case is Balancer's WSTETH-AAVE pool. Its current APY is just 1.06% against a 35,170.70% 30-day mean, with a -260,978 pp seven-day comparison. A collapsed rate can be as important as a spike for farmers who are still carrying impermanent-loss or smart-contract risk after the incentive has disappeared. 7
Position implications
- For ETH-linked exposure: The total TVL increase and gains in Lido, SSV, ether.fi Stake, and Binance staked ETH point in the same direction as the large Ethereum snapshot. The feed does not isolate price effects from new deposits, so treat the move as exposure growth, not proof of fresh net inflows. 12
- For bridge users: AFX's loss came from an AFX-operated bridge, not Arbitrum's native bridge. The distinction matters, but it does not remove the need to review third-party custody, validator, and withdrawal authorization assumptions before moving funds. 8
- For stablecoin and lending positions: 42DAO shows why oracle sanity checks and liquidation delays belong in the risk review. A passed contract audit is not evidence that the price-feed configuration can resist a manipulated input. 10
- For yield farmers: Reject four- and five-figure APYs until the pool's base yield, incentive schedule, TVL path, volume, and exit liquidity reconcile. The current feed contains both extreme spikes and extreme collapses. 7
- For governance-token holders: Mark the four records as closed vote events, not completed parameter changes, until execution evidence appears. Uniswap's stated quorum was not met in the returned score; Lido, Arbitrum, and the other fields require a follow-up check because their quorum or execution data was unavailable. 6
The next checkpoint is whether Ethereum-linked growth can persist without another bridge or oracle failure widening the gap between headline TVL and usable liquidity.
References
- 1DeFiLlama historical chain TVL
api.llama.fi
- 2DeFiLlama protocol TVL
api.llama.fi
- 3DeFiLlama hack database
api.llama.fi
- 4DeFiLlama chain TVL
api.llama.fi
- 5
- 6Snapshot governance data
hub.snapshot.org
- 7DeFiLlama yield pools
yields.llama.fi
- 8AFX bridge exploit report
cryptonews.net
- 9Triple-A hot-wallet incident
cryptobriefing.com
- 1042DAO oracle-attack report
techtimes.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.