DeFi Week 31: TVL rises, but bridge and oracle risk widens (2026)

DeFi TVL climbed from $75.624B on the July 20 daily snapshot to $76.633B on July 27, a gain of $1.009B (1.33%). The move was positive but concentrated: Lido added about $1.126B, while Portal lost about $755.2M. The security ledger carried $50.326M in quantified losses, led by the AFX bridge drain and a Triple-A hot-wallet breach. 1 2 3

Data cutoff: July 27, 2026, 10:00 a.m. GMT-5. DeFiLlama's TVL series is daily, so the total uses the daily points nearest the scheduled cutoff rather than an hour-level balance. The chain endpoint returned current TVL levels but no per-chain seven-day field in this retrieval; the chain table below is therefore a composition snapshot, while the protocol table uses DeFiLlama's change_7d field. 1 4

Week 31 quick scan

Signal	Result	Trading read
Total DeFi TVL	$76.633B, up 1.33% from $75.624B	The rebound continued, but the aggregate hides large protocol-level rotations. 1
Largest protocol dollar gain	Lido: +$1.126B, +6.53%, to $18.370B	The largest positive move in the non-CEX screen. 2
Largest protocol dollar loss	Portal: -$755.2M, -32.51%, to $1.568B	A bridge-level outflow that needs a protocol-specific explanation; the TVL feed does not provide one. 2
Quantified security losses	$50.326M across eight day-labeled records	AFX and Triple-A account for most of the amount; Garden's record is tied to solver infrastructure rather than user funds according to the project's account. 3 5
Governance	Uniswap's V4 temp check closed below its stated quorum; Lido and Arbitrum votes closed with For-majority results, but some quorum fields were unavailable	Treat closed Snapshot state as a vote record, not proof of on-chain execution. 6
Yield anomaly	APXUSD-USDC on Curve printed 7,190.77% APY on $9.40M TVL versus a 11,912.57% 30-day mean	This is an investigation trigger, not a baseline return. 7

TVL: Ethereum carried the week, but the leaderboard did not move as one

Ethereum held about $42.062B, more than half of the $76.633B total. Solana was at $4.913B, Tron at $4.880B, BSC at $4.876B, and Base at $4.635B. Smaller but relevant snapshots were Hyperliquid L1 at $1.267B, Arbitrum at $1.231B, Monad at $778.1M, and Robinhood Chain at $335.7M. These are current chain levels, not per-chain weekly deltas, because the returned chain feed did not include that field. 4

Chain	Current TVL	Share of total	What the snapshot says
Ethereum	$42.062B	54.9%	The main liquidity base for the week.
Solana	$4.913B	6.4%	Similar in size to BSC and Tron in the current snapshot.
Tron	$4.880B	6.4%	Large stablecoin-heavy chain level, without a returned seven-day delta.
BSC	$4.876B	6.4%	Near Solana and Tron in current TVL.
Base	$4.635B	6.0%	The largest of the listed newer L2 snapshots.
Hyperliquid L1	$1.267B	1.7%	A smaller base where protocol moves can look large in percentage terms.
Arbitrum	$1.231B	1.6%	The chain-level figure does not identify which applications drove the move.
Monad	$778.1M	1.0%	A high-growth ecosystem remains small relative to Ethereum.
Robinhood Chain	$335.7M	0.4%	A small base makes percentage comparisons especially noisy.

For the protocol ranking, I screened records with at least $50M of current TVL, excluded CEX entries, and back-calculated the prior comparison value as current TVL / (1 + change_7d). That produces a dollar-change ranking, not a claim about deposits or withdrawals. DeFiLlama's protocol feed does not attach a cause to each move, so the rows below are signals to investigate rather than causal findings. 2

Protocol	TVL before	Current TVL	7-day change	Dollar move	Chains in feed
Lido	$17.245B	$18.370B	+6.53%	+$1.126B	Ethereum, Solana, Moonbeam, Moonriver, Terra
Spiko	$1.211B	$2.214B	+82.85%	+$1.003B	Stellar, Arbitrum, Ethereum, Polygon, Base, Starknet, Etherlink
SSV Network	$9.134B	$9.689B	+6.08%	+$555.0M	Ethereum
ether.fi Stake	$3.028B	$3.393B	+12.05%	+$364.8M	Arbitrum, Ethereum, Base
Binance staked ETH	$6.962B	$7.299B	+4.83%	+$336.4M	Ethereum, Binance
Portal	$2.323B	$1.568B	-32.51%	-$755.2M	Ethereum, Algorand, Binance, Solana, Sui, Polygon, Base, Near, Avalanche, Arbitrum, Aptos, Optimism and others
Polygon Bridge	$2.828B	$2.690B	-4.91%	-$139.0M	Ethereum
USDT0	$3.485B	$3.379B	-3.06%	-$106.7M	Ethereum
Ethena USDtb	$454.1M	$354.8M	-21.88%	-$99.4M	Ethereum
Maple	$2.438B	$2.356B	-3.37%	-$82.2M	Ethereum, Solana

The gain side is dominated by ETH-linked staking. Lido, SSV, ether.fi Stake, and Binance staked ETH all rose while Ethereum remained the largest chain snapshot. That alignment is consistent with an ETH-linked TVL rebound, but the data cannot separate token-price appreciation from new capital. Spiko's 82.85% increase is large in percentage terms and almost as large as Lido's dollar gain; its smaller starting base makes the percentage less comparable.

Portal is the outlier on the loss side. The feed shows a $755.2M fall across many chains, but it does not say whether the change came from redemptions, asset-price moves, accounting, or a migration. The correct trade response is to find a protocol statement or on-chain position change before treating it as a fundamental exit. The same caution applies to Ethena USDtb's 21.88% decline and Lorenzo sUSD1+'s larger percentage loss, which is outside the top-dollar-loss table because its current TVL is below the screen's main size threshold.

Exploits: $50.3M in day-labeled records, with bridge and wallet risk back in focus

DeFiLlama's hack database returned eight quantified records dated July 21 through July 26 in the local display window, totaling $50.326M. The feed also listed an unquantified Zilliqa record. The dates are day labels rather than event timestamps, so the table is a database-window screen, not a claim that each event occurred before the cutoff hour. 3

Record	Chain(s)	Amount in feed	Technique / surface	Status or limitation
AFX Bridge	Arbitrum	$24.15M	Private-key compromise; cross-chain bridge withdrawal	AFX operations were suspended or under investigation in the reviewed report; no recovery was confirmed. 8
Triple-A	Ethereum, Tron, Polygon, Arbitrum, Solana, TON	$9.70M in DeFiLlama; later report estimated about $12M	Hot-wallet compromise	Triple-A said customer funds were not affected; the reviewed report said the investigation was ongoing. 9
Verus-Ethereum Bridge	Verus	$7.53M	Bridge verification bypass	The returned DeFiLlama record contained no recovery or remediation field. 3
Wanchain	Cardano	$6.50M	Signature exploit	The returned DeFiLlama record contained no recovery or remediation field. 3
Garden	Ethereum, Base, Arbitrum, BSC	$450K	HTLC / solver-infrastructure incident	Garden said an independent solver's off-chain database was compromised, no user funds were lost or at risk, and the app was paused while funds were traced. 5
DeBond	Ethereum	$542K	Accounting error	No recovery detail was present in the returned feed. 3
Lien	Ethereum	$542K	Input-validation flaw	No recovery detail was present in the returned feed. 3
42DAO	BSC	$912K in DeFiLlama; reporting put the loss at $912K–$915K	Oracle manipulation and liquidation abuse	BLC fell about 99.75% in the reviewed report; no team recovery plan was visible there. 10

AFX is the largest single loss and the most actionable bridge warning. A crypto.news report, citing Blockaid and an Arbiscan transfer, put the drain at $24.15M USDC from an AFX-operated bridge on Arbitrum and explicitly separated it from Arbitrum's native bridge. The report said the attacker moved the funds to Ethereum and bought about 12,467 ETH; no recovery had been confirmed at publication. 8

Triple-A adds a different failure mode. The initial DeFiLlama amount was $9.7M, while a July 26 Crypto Briefing report put the estimate near $12M after continued tracking. That discrepancy is why the ledger uses the DeFiLlama value for its total and shows the later estimate separately. The report said the drain hit hot wallets across six chains and that customer funds were not affected. 3 9

The 42DAO incident is the week's clearest stablecoin-specific warning. The reviewed report described a falsified BTCB price on BNB Chain, missing price protection and liquidation delay, and a resulting BLC collapse. The direct loss was under $1M, but the peg failure widened the user impact beyond the drained treasury. 10

Governance: closed votes, limited execution evidence

The Snapshot query for tracked major DAO spaces returned four relevant closures in or immediately after the cutoff boundary. It reports vote scores, state, and quorum fields, but not an execution transaction. A quorum: 0 response is treated here as unavailable, not as proof that quorum was met. 6

DAO / proposal	Close time	Returned result	Governance read-through
Lido: `0x02 CSM: New Permissionless Module Launch`	July 20, 11:00 a.m. GMT-5	For 58.014M, Against 0; quorum field 0	Closed with a For-only score; execution status was not in the returned payload.
Lido: `Adopt the CMv2 Penalty Framework`	July 20, 11:00 a.m. GMT-5	For 58.014M, Against 0; quorum field 0	The vote record does not establish the execution step or a formal quorum result.
Arbitrum: `Ratification of Security Council Election Process Improvements`	July 23, 8:45 a.m. GMT-5	For 182.211M, Against 74.9K, Abstain 21.848M; quorum field 0	For dominated the returned score, but the available payload does not prove quorum or on-chain execution.
Uniswap: `[Temp Check] - Four for V4`	July 26, 6:15 p.m. GMT-5	For 5.348M, Against 0, Abstain 1.814K; stated quorum 10M	The returned score was below the stated quorum, so this temp check did not meet that threshold.

The practical distinction is between a vote result and a protocol parameter change. Lido's two records concern staking-module access and penalty policy, while Arbitrum's concerns Security Council election-process improvements. Uniswap's V4 item is a temp check rather than an execution record. Governance-token traders should wait for the on-chain execution or a protocol announcement before pricing a completed parameter change.

Yield anomalies: headline APY is diverging from recent history

The yield feed contains several pools where the current APY is far from the 30-day mean or the seven-day comparison field. Those differences can come from fees, incentives, changing pool denominators, or data artifacts. None is a standalone promise of repeatable return. 7

Pool	Chain	TVL	Current APY	7-day comparison	30-day mean
USDC-VELVET on Aerodrome Slipstream	Base	$3.01M	34,765%	-190,225 pp	224,966%
APXUSD-USDC on Curve	Ethereum	$9.40M	7,190.77%	+7,185.87 pp	11,912.57%
WSTETH-AAVE on Balancer V2	Ethereum	$13.38M	1.06%	-260,978 pp	35,170.70%
ETH-01 on Uniswap V4	Ethereum	$1.10M	160.09%	-44.60 pp	1,461.63%
USDC on Growihf	Hyperliquid L1	$9.20M	33.63%	+30.44 pp	1,296.17%

The feed's units are percentage points for the comparison fields, not a claim that a pool earned those rates over the full period. The strongest warning is the combination of a very high current print and a very different baseline: Aerodrome's USDC-VELVET pool shows 34,765% current APY against a 2.29% seven-day base field and a 224,966% 30-day mean. That is a rate-data anomaly until volume, incentives, and exit liquidity are checked.

The opposite case is Balancer's WSTETH-AAVE pool. Its current APY is just 1.06% against a 35,170.70% 30-day mean, with a -260,978 pp seven-day comparison. A collapsed rate can be as important as a spike for farmers who are still carrying impermanent-loss or smart-contract risk after the incentive has disappeared. 7

Position implications

For ETH-linked exposure: The total TVL increase and gains in Lido, SSV, ether.fi Stake, and Binance staked ETH point in the same direction as the large Ethereum snapshot. The feed does not isolate price effects from new deposits, so treat the move as exposure growth, not proof of fresh net inflows. 1 2
For bridge users: AFX's loss came from an AFX-operated bridge, not Arbitrum's native bridge. The distinction matters, but it does not remove the need to review third-party custody, validator, and withdrawal authorization assumptions before moving funds. 8
For stablecoin and lending positions: 42DAO shows why oracle sanity checks and liquidation delays belong in the risk review. A passed contract audit is not evidence that the price-feed configuration can resist a manipulated input. 10
For yield farmers: Reject four- and five-figure APYs until the pool's base yield, incentive schedule, TVL path, volume, and exit liquidity reconcile. The current feed contains both extreme spikes and extreme collapses. 7
For governance-token holders: Mark the four records as closed vote events, not completed parameter changes, until execution evidence appears. Uniswap's stated quorum was not met in the returned score; Lido, Arbitrum, and the other fields require a follow-up check because their quorum or execution data was unavailable. 6

The next checkpoint is whether Ethereum-linked growth can persist without another bridge or oracle failure widening the gap between headline TVL and usable liquidity.

DeFi Week 31: TVL rises, but bridge and oracle risk widens