Below are the multi-chain DeFi headlines we logged between Monday 5 October and Sunday 11 October 2026, grouped by theme. Each item carries its date, the outlet it came from, a summary of what happened, and our read on why it matters.
The week split in two directions. On markets it was the sample's first broad risk-off week — TVL fell 3.3%, volume 16.8% and fees 12.3% as a leverage flush and ETF outflows pulled risk capital out of every venue at once. On security it was a week about permissions rather than exploits: a privileged operator key drained a BNB Chain pool, a passed governance proposal emptied a treasury, and a forgotten six-year-old keeper gave up its collateral.
1 Security Incidents
01A single operator key drains about $12.5m from 79thVault's 79AU pool on BNB Chain
Wed 7 Oct · Source: GoPlus Security · BNB Chain · 79thVault
79thVault, a BNB Chain project built around the 79AU token, lost about $12.5m on 7 October when the PancakeSwap 79AU/USDT pair that held most of the token's dollar liquidity was drained. The 79AU contract carries a function reserved for an OPERATOR_ROLE that moves 79AU out of a chosen address to any recipient and then forces the pool to re-sync its recorded reserves. Between about 07:25 and 08:19 UTC that role — held by a single hot wallet with no multisig and no timelock — called the function seven times, moving 2.01 million 79AU out of the pair to one address in tranches of 10,000 to 500,000 tokens. That address sold the tokens back into the same pool across roughly 95 swaps, pulling the pool's USDT reserve down from about $15.2m to about $3.9m. The proceeds were converted to 16,249 BNB, about $12.5m at the time, and sent to a consolidation address. Most of the haul came back: on 9 October the attacker returned 15,000 BNB — roughly 92% of the total, about $11m — to a wallet the team designated, a transfer PeckShield, CertiK and the project itself confirmed on-chain. The team said the funds would go back into the liquidity pool and the resulting LP tokens be burned. The 79AU contract's source is not verified on BscScan, and the project's 8 October statement attributed the loss to 'weaknesses in account permission management' rather than to a bug in the token. Whether the operator key leaked or an insider moved the funds is unresolved.
02Onyx DAO's treasury is drained of 620 million XCN (~$2.91m) through a passed governance proposal
Tue 6 Oct · Source: Blockaid · Ethereum · Onyx DAO
Blockaid flagged on 6 October that an attacker moved 620 million XCN — Onyx's governance token, worth about $2.91m at the time — out of the project's treasury contract on Ethereum to wallets linked to the attacker. The transfer executed through Onyx's own governance framework: a malicious proposal cleared the proposal threshold, the quorum requirement and the protocol's standard two-day timelock, then released the funds from the treasury at 0x28CA…da93. Onyx has now reported protocol vulnerabilities in 2023 and 2024 that together cost more than $3.8m.
03Mezo patches a veBTC contract flaw that let an attacker take 5.52 BTC from 36 users
Mon 5 Oct · Source: Mezo · Bitcoin · Mezo
Mezo disclosed on 7 October that a flaw in its VotingEscrow contract let an attacker seize 37 veBTC positions belonging to 36 users and redeem about 5.52 BTC. The vulnerability sat in how the contract verified who had authorised a transfer: when certain calls passed through an external code library, the sender's identity was lost, and crafted data could make the contract treat the attacker as the position owner. The attacker targeted positions whose bitcoin lock periods had already expired, which could be redeemed immediately. The stolen BTC was bridged from Mezo to Ethereum at 19:09 UTC on 5 October and swapped for 174.61 ETH six minutes later. Mezo paused bridge withdrawals and halted the chain on 6 October, resumed at 15:00 UTC after disabling meta-transactions and deploying a fix, and said it would reimburse affected users from protocol funds. It offered the attacker a settlement — return about 4.415 BTC, roughly 80% of the loss, and keep the rest as a bounty — with an expiry of 14 October, 23:59 UTC.
04A dormant 2020 liquidation keeper gives up 200 WETH (~$540k) through one missing access check
Tue 6 Oct · Source: Defimon Alerts · Ethereum · MakerDAO keeper
On 6 October an address funded through Tornado Cash drained 200 WETH, about $539,800, from a third-party liquidation keeper that had bid in MakerDAO's ETH-A collateral auctions back in 2020. The keeper — an upgradeable proxy contract run by an unidentified operator — had won four ETH-A auctions (numbers 1457 to 1460, 50 WETH each) and never called the close function to settle them, so the 200 WETH had sat inside MakerDAO's ETH-A Flipper contract for six years. One function in the keeper's implementation was missing the ds-auth access check its other functions carried; calling it settled the four stale auctions and withdrew the freed WETH to an address the caller chose. The transaction was mined in Ethereum block 26,131,471 at 06:13:11 UTC. MakerDAO's own contracts behaved as designed, and no owner of the keeper has come forward.
05Liquid Network's bitcoin redemptions stay frozen 35 days on, with a 602.53 BTC reserve shortfall
Sun 11 Oct · Source: Blockstream · Bitcoin sidechain · Liquid
As of 11 October the Liquid Network's peg-outs remained suspended, 35 days after the 6 September exploit drained roughly 4,000 BTC from the federation's reserve. Explorer data put the reserve at 3,632.23 BTC against 4,234.76 L-BTC in circulation — a shortfall of about 602.53 BTC, with reserves covering about 85.8% of outstanding tokens. Blockstream had recovered about 3,400 BTC by 7 September; the remainder is still being traced. Normal block production and internal L-BTC transfers resumed on 10 September, but one-for-one redemption for bitcoin has not, and Liquid has tied a restart to three conditions: full reserve backing, the Elements v23.3.4 software upgrade and its independent audit, and a migration of peg-out keys to cold storage. Blockstream has said it will not pay a ransom for the missing funds.
2 Protocol Funding & Governance
06Polymarket rewrites its core contracts as Protocol V2, with a mainnet switch set for 2 November
Week · Source: Polymarket · Prediction markets · Polymarket
Polymarket introduced Protocol V2, a rebuild of the conditional-token framework it has run since 2019. V2 unifies position-token contracts into a single ERC-1155, standardises pUSD as the collateral asset, and replaces the market-specific plumbing with one exchange and one router. It natively supports binary, negative-risk and combinatorial markets, adds an OracleAggregator that can pull from multiple sources including UMA and Chainlink, and integrates a cross-chain bridging module. Testing runs on mainnet from 5 to 30 October, with the switch for new markets scheduled for 2 November, alongside a Rust-based Data API V2.
07RWA perpetuals overtake crypto on Hyperliquid — about half of weekly volume is now real-world assets
Sat 10 Oct · Source: Hyperliquid · Perp DEX · Hyperliquid
As of 10 October, real-world-asset perpetuals accounted for roughly 52% of Hyperliquid's weekly volume — about $25.1bn — making the venue's dominant use case exposure to equities, commodities and indices rather than to crypto. Equities were about 48% of the RWA mix, commodities 28% and indices 18%. Hyperliquid routes most of its protocol revenue to token buybacks, so a growing share of that revenue is now funded by traders pricing stocks and indices rather than by crypto speculators.
08Aave's risk stewards double V4 caps on the Arc USDC and Ethena spokes
Fri 9 Oct · Source: Aave · Lending · Aave
A LlamaRisk note published on 9 October set out cap increases to be made through Aave's Risk Steward process. On the Arc Core Hub USDC Maple Spoke, the USDC draw cap would rise from 23 million to 46 million and the syrupUSDC add cap from 25 million to 50 million, after the USDC draw cap reached full use and syrupUSDC add-cap use reached 87.8%; the two largest syrupUSDC positions are about 97% of the reserve, sitting at health factors of 1.02 and 1.01. On the Ethereum Plus Hub Ethena Ecosystem Spoke, the USDe add cap would rise from 30 million to 40 million, USDC and USDT add caps from 6 million to 12 million with matching draw caps from 6.375 million to 12 million, and USDC/USDT slope 1 from 4.50% to 4.60% with the USDe base rate from 6.30% to 6.60%.
3 Markets, Fees & TVL
09The week in data: TVL falls 3.3% and fees 12.3% as the sample's first broad risk-off week lands
Week · Source: DefiLlama · Multi-chain (7 tracked)
Every headline line in the seven-chain sample fell this week. Total TVL dropped 3.3% to $76.92bn — the largest weekly decline in the series — with only TRON (+0.7%) growing. DEX volume fell 16.8% to $36.29bn and network fees 12.3% to $213.7M, both also the sharpest declines in the sample. Blended turnover slid to 0.47x from 0.55x, the weakest reading since the week ending 16 August. Solana led fees for a tenth consecutive week at $99.6m (-10.8%) — its first sub-$100m week since the week ending 6 September — while BNB Chain posted the steepest falls (volume -33.3%, fees -34.4%). Stablecoin float was the exception, easing only 0.2% to $284.34bn.
10US spot bitcoin ETFs lose $681m and ether funds $542m as a leverage flush clears more than $2.4bn of positions
Week · Source: SoSoValue · Market structure · ETF flows
US spot bitcoin ETFs recorded $681.1m of net outflows over 5-9 October, ending a three-week inflow streak, while ether ETFs lost $542.07m — their second-largest weekly outflow of the year — for combined redemptions above $1.2bn. Fidelity's FBTC (-$380.36m) and ARK 21Shares' ARKB (-$207.21m) led the bitcoin exits, against a marginal $1.02m inflow for BlackRock's IBIT. Solana ETFs lost $24.81m, ending a 14-week inflow streak; XRP ETFs gained $11.31m for a 13th straight positive week and NEAR ETFs took in $35.99m. The fund flows ran alongside a derivatives unwind: bitcoin fell from near $86,600 early in the week to an intraday low near $80,350 before recovering toward $82,500, and more than $2.4bn of leveraged positions were liquidated across the week, between 85% and 93% of them longs. Short-term holders sent about 55,600 BTC to exchanges at a loss during the decline.
4 Stablecoin Developments
11ESMA tells EU platforms to exit non-MiCA stablecoins by 8 January 2027
Thu 8 Oct · Source: ESMA · Regulation · ESMA
The European Securities and Markets Authority issued guidance on 8 October directing national regulators to require MiCA-authorised crypto-asset service providers to exit exposure to stablecoins that do not comply with the regulation within three months, giving a final deadline of 8 January 2027. Platforms must stop offering non-compliant stablecoins to EU customers — no new purchases, trading or transfers — though they may still let customers sell, convert, withdraw or transfer existing holdings. ESMA named no specific tokens; reporting points to USDT and PayPal USD as the largest non-compliant examples by market value. Full MiCA rules for crypto platforms took effect on 1 July 2026.
12Circle and Tether push back on MiCA's bank-reserve requirement in the same week
Mon 5 Oct · Source: CryptoSlate · Issuers · Circle / Tether
Circle and Tether — normally competitors — argued to EU authorities against the MiCA provision that would require large stablecoin issuers to hold a substantial share of reserves in bank deposits. Separately, Circle's terms allow it to delay European USDC redemptions temporarily when a reserve rebalancing cannot cross borders in time, a provision it cites in defending its cross-border co-issuance model under MiCA.
13Kyrgyzstan liquidates the issuer of its gold-backed USDKG stablecoin, months after UK sanctions
Thu 8 Oct · Source: The Defiant · Sovereign stablecoins · Kyrgyzstan
Kyrgyzstan's cabinet ordered the liquidation of OJSC EVA, the issuer of the gold-backed USDKG stablecoin, and of Coin Nomad Exchange, the country's first state-owned crypto exchange. The order was dated 20 August and became public on 8 October; it cited state participation and asset management, not any breach. The UK had designated the issuer in May 2026 over suspected support for Russia, three months earlier, and that designation had already cut the token's access to UK-linked venues. No official link between the sanctions and the wind-down has been drawn. Holders can redeem USDKG for fiat currency or USDT, with no published deadline.
14Dubai's VARA requires virtual-asset firms to hold 100% cover of customer liabilities, reconciled daily
Tue 6 Oct · Source: Dubai VARA · Regulation · Dubai
Dubai's Virtual Assets Regulatory Authority issued a circular on 6 October requiring virtual-asset service providers to maintain 100% coverage of customer liabilities throughout the audit review period, with matching assets on a 1:1 basis and daily reconciliation. Independent audits must cover hot, warm and cold wallets, third-party infrastructure and custodians, and must review asset segregation, wallet control and rehypothecation or lending.
5 Institutional Adoption
15Hong Kong and Malaysia set up a joint workstream on cross-border stablecoin use
Tue 6 Oct · Source: Hong Kong Monetary Authority · Central banks · Hong Kong / Malaysia
The Hong Kong Monetary Authority and Bank Negara Malaysia will establish a joint policy-focused workstream to promote compliant cross-border stablecoin use cases, according to the HKMA. The two authorities also plan closer tokenisation exchanges and stronger real-time settlement links, and will explore connectivity between Hong Kong's CMU and Malaysia's RENTAS securities depositories.
16Thailand's SEC opens a domestic crypto ETF market from 16 October
Thu 8 Oct · Source: Thailand SEC · Regulation · Thailand
Thailand's Securities and Exchange Commission issued 11 rules on 8 October, effective 16 October, establishing a domestic crypto ETF framework. Initially the funds may invest only in bitcoin or ether, must trade domestically, follow passive strategies and maintain annual average exposure of at least 80% to a single crypto asset, with regulated custodians holding the assets. Mutual and private-equity funds may invest; securities firms may not finance purchases, and retail access to overseas crypto ETFs through Thai brokers remains temporarily prohibited.
6 What the week adds up to
The security stories this week had a common shape, and it was not a broken contract. 79thVault lost about $12.5m to a role that let one address move tokens out of its own pool; Onyx lost its treasury to a governance proposal that cleared every check; MakerDAO lost 200 WETH to a function on a forgotten keeper that simply did not check who was calling. In each case the underlying protocol behaved as designed, and in each case the loss came from the boundary around it — who was allowed to call, and with what constraints.
That is the through-line with the earlier incidents this quarter. The Bitget breach moved a fabricated feed; the Safe-module exploit forged an authorisation; the 79thVault drain used a permission. Different layers, one lesson: the effective security perimeter of a position is every contract and role that can move it, not the one that holds it. The Mezo case makes the point sharply — the flaw there survived two audits.
The market week was simpler and, in the sample's terms, unprecedented. The first week we have logged in which every headline line fell at once: TVL 3.3%, volume 16.8%, fees 12.3%. The driver was off-chain — a price decline, a $2.4bn leverage flush and more than $1.2bn of ETF outflows — and the on-chain data is its mirror rather than its cause. The one line that held was the dollar layer: stablecoin float eased 0.2% while the risk layer repriced, which is the reverse of the September pattern and the most useful signal in a red week.
Regulators, meanwhile, kept drawing lines. ESMA put a three-month clock on non-compliant stablecoins in the EU; Dubai required 100% cover, daily reconciled, with rehypothecation inside the audit scope; and Kyrgyzstan moved to wind down a state-issued stablecoin months after its issuer was designated. The through-line there is different: the rules are converging on redemption access and reserve encumbrance, which is where the recent failures actually happened.
Key Takeaways
- A single operator key drained about $12.5m from 79thVault's 79AU pool on BNB Chain on 7 October — no multisig, no timelock, and a contract unverified on the explorer; the attacker returned 15,000 BNB, about 92% of the haul, two days later.
- Onyx DAO's treasury lost 620 million XCN (~$2.91m) after a malicious governance proposal cleared the threshold, quorum and a two-day timelock; Mezo patched a veBTC flaw after about 5.52 BTC was taken from 36 users.
- Liquid Network's bitcoin redemptions stayed frozen 35 days on, with reserves at about 85.8% of outstanding L-BTC — a 602.53 BTC shortfall.
- The sample's first broad risk-off week: TVL -3.3% to $76.92bn, DEX volume -16.8%, fees -12.3%, turnover 0.47x; only TRON grew.
- US spot bitcoin ETFs lost $681m and ether funds $542m (combined above $1.2bn) as a leverage flush cleared more than $2.4bn of positions.
- ESMA set an 8 January 2027 deadline for EU platforms to exit non-compliant stablecoins; Dubai required 100% daily-reconciled cover; Kyrgyzstan moved to liquidate its USDKG issuer months after the company was sanctioned.
DE
Defiinger Research DeskThe Defiinger Research Desk compiles multi-chain DeFi data and commentary from public on-chain sources and vetted industry publishers. Our editorial process prioritizes verifiable figures and clearly dated references.
Sources & Methodology
- DefiLlama — chain-level TVL, DEX volume, fees and stablecoin series used throughout.
- GoPlus Security, Defimon Alerts, CertiK and PeckShield — the on-chain analysis of the 79thVault operator-role drain and the 15,000 BNB return of 9 October. Crypto Times and ForkLog — independent coverage.
- Blockaid — the Onyx DAO treasury transfer and the compromised and receiving addresses.
- Mezo — the 7 October incident report (the VotingEscrow flaw, the affected positions, the reimbursement, the settlement offer). BlockFence — coverage.
- Defimon Alerts and DeFiHackLabs — the MakerDAO ETH-A keeper analysis; the Ethereum transaction receipt cited for the block and timestamp.
- Blockstream and The Defiant — the Liquid Network reserve figures, the peg-out conditions and the audit status; Crypto Briefing — the recovery timeline.
- Polymarket — the Protocol V2 announcement and the 2 November mainnet switch. AInvest — the Hyperliquid RWA perp volume data.
- Aave governance (LlamaRisk) — the V4 cap increases of 9 October. The Defiant — the Lido post-quantum working-group proposal.
- SoSoValue — the 5-9 October ETF flow data. CoinGlass and CoinMarketCap — the liquidation totals and the price range.
- ESMA — the 8 October guidance and the 8 January 2027 deadline. CryptoSlate and Crypto Briefing — the Circle/Tether reserve arguments and the redemption-delay provision.
- Dubai VARA — the 6 October circular. The Defiant — the Kyrgyzstan USDKG liquidation.
- HKMA — the Malaysia workstream statement. Thailand SEC — the 8 October crypto ETF rules.
Headlines and figures on this page are drawn from the outlets listed above; commentary is clearly labelled opinion and is not investment advice. Last reviewed 2026-10-11.
Frequently Asked Questions
How do you choose which headlines to include?
We keep items that changed something measurable — capital, protocol parameters, or user access — and drop price-only stories and unverified loss figures.
Why link to home pages instead of the article?
We cite the outlet that reported each item rather than linking to permalinks we have not individually verified.
Which sources do you use?
GoPlus Security, Defimon Alerts, Blockaid, CertiK, Mezo, Blockstream, Crypto Times, ForkLog, The Defiant, Crypto Briefing, CryptoSlate, Polymarket, Aave governance, SoSoValue, ESMA, Dubai VARA, the HKMA, the Thailand SEC, Solana/DefiLlama and DefiLlama, plus primary statements from protocol operators.
What date range does this cover?
Monday 5 October to Sunday 11 October 2026 inclusive. Every weekly report on the site uses the same Monday-to-Sunday window.
Have any of the 79thVault funds been recovered?
Most of them. On 9 October the attacker returned 15,000 BNB — about 92% of the 16,249 BNB taken, and roughly $11m — to a wallet the team designated; PeckShield, CertiK and the project all confirmed the transfer on-chain, and the team said the funds would go back into the liquidity pool with the resulting LP tokens burned. A residue including a 30 BNB transfer onward to KuCoin was not returned, and whether the operator key leaked or an insider moved the funds is unresolved.
Is this investment advice?
No. The news column is the record; the commentary is clearly labelled opinion.