Below are the multi-chain DeFi headlines we logged between Monday 14 and Sunday 20 September 2026, grouped by theme. Each item carries its date, the outlet it came from, a summary of what happened, and our read on why it matters.
The week ran on two tracks. On the data side it was a quiet deposit week — TVL up, usage soft. On the security side it added a new mechanism: an MEV bot that did not forge anything, it simply outbid a hacker's exploit on priority fees and walked off with about $7.8m of rsETH.
1 Security Incidents
01An MEV bot outruns a hacker's rsETH exploit and takes about 2,900 rsETH — roughly $7.8m — through a flaw in an enabled Safe module, not in Safe itself
Tue 15 Sep · Source: Kelp DAO · Ethereum · Kelp DAO (rsETH)
Kelp DAO's rsETH lost about 2,900 tokens (roughly $7.8m) when an attacker used a flaw in an enabled Safe module to push a withdrawal, and an MEV searcher nicknamed 'Yoink' copied that transaction and paid about 19 ETH in priority fees to get its copy processed first in block 25,980,525 — capturing 2,882.37 rsETH while the original transaction reverted. The root cause was an authorisation check in the module's executor / Multicall contract that accepted target = address(this) as valid, so a genuine signature was enough to let the reorder through. Kelp paused the contract at 0xc70f…80ea0 for 24 hours; Blockaid estimated $7.73m and BlockSec $7.81m.
02An oracle manipulation marks Nostra's NSTR token at about 8,000x its real price and drains about $3.5m through a fake Ekubo pool
Thu 17 Sep · Source: Nostra · Starknet · Nostra
At 13:28 UTC on 17 September an attacker manipulated Nostra's NSTR price oracle from about $0.006 to $49.5 — roughly 8,000x — using a fake pool on the Ekubo DEX, then borrowed against the inflated collateral across ETH, STRK, USDC, USDT, WBTC and DAIv1. About $1.92m reached Ethereum (234.57 ETH plus 1.3m DAI) and about $1.55m stayed on Starknet. Nostra's market cap was below $600k, which made the position cheap to move. The protocol paused fully and offered no bounty.
03Chainflip restarts on v2.2.13 without its TRON route and still owes one pending 115,654 USDT swap after the memo-reuse loss
Wed 16 Sep · Source: Chainflip · TRON · Chainflip
Chainflip shipped v2.2.13 on 15 September and restarted the network on 16 September, removing TRON from the supported set. The trxUSDT liquidity-pool balance was zeroed on restart; one legitimate user swap of 115,654.41 USDT never left the vault and remains payable once the route is restored. The total realisation from the 12 September memo-reuse incident stands at 736,442.17 USDT.
04Symbiosis confirms about 15 BTC recovered and a bridge rewrite in progress, after last week's unbacked syBTC mint
Week · Source: Symbiosis · Symbiosis
Symbiosis reported that roughly 15 BTC of the funds moved in the 11 September BridgeV2 exploit had been recovered into a team-controlled multisig, and that the native Bitcoin bridge is being rewritten with an audit before relaunch. The 20% white-hat bounty offer lapsed on 13 September without takers, so the recovery came from tracing and freezing rather than a negotiated return.
05SlowMist logs a $6.57m loss at the DCENT mobile wallet; PeckShield flags a $16.77m mint-and-dump cluster across FET, NTX, AGIX and WMTx
Week · Source: SlowMist · Multi-chain · SlowMist
SlowMist attributed about $6.57m in drained funds to the DCENT mobile wallet, a private-key or approval compromise on stored keys rather than a smart-contract bug. Separately, PeckShield flagged a coordinated mint-and-dump cluster across Fetch.ai (FET), NTX, SingularityNET (AGIX) and WMTx on 19-20 September, valuing the attacker's remaining minted holdings at about $16.77m (unrealized inventory, not realized losses); realized proceeds from the cluster were about $2.25m, mostly FET converted to ETH.
06The U.S. DOJ freezes about $52m tied to the Xinbi Guarantee Telegram marketplace for illicit crypto movement
Week · Source: U.S. DOJ · Multi-chain · U.S. DOJ
The Department of Justice announced the seizure of approximately $52m in cryptocurrency linked to Xinbi Guarantee, a Telegram-based marketplace alleged to have laundered funds for organised crime and sanctions evasion. The action is a law-enforcement freeze rather than an exploit, and the assets are alleged proceeds rather than DeFi user funds.
2 Protocol Funding & Governance
07Velocity closes an additional $10m from Visa, Circle and Ripple, lifting its Series A to $48m at a $200m valuation
Week · Source: Velocity · Payments · Velocity
Velocity, a stablecoin payments orchestration layer, disclosed a $10m top-up to its Series A from Visa, Circle and Ripple, bringing the round to $48m and the company's valuation to about $200m. The raise is earmarked for expanding direct settlement rails and issuer integrations rather than a new token.
3 Networks, Fees & TVL
08Tracked TVL rises 4.0% to $77.89bn — the largest weekly gain in the sample — while DEX volume edges up 2.4% to $46.31bn and fees fall 8.9% to $219.1m
Week · Source: DefiLlama · Multi-chain (7 tracked)
Three of seven chains grew TVL by more than 4% (Optimism +6.8%, Base +5.7%, Ethereum +5.0%), TRON gained 1.5% and Solana 4.6%; BNB Chain was the only decliner at -3.9%. Volume was narrower: Arbitrum (+34.8%), Optimism (+29.4%) and Ethereum (+21.5%) led, while BNB Chain fell 22.0% and Base 5.8%. Blended turnover slipped to 0.59x from 0.60x.
09Solana remains the fee leader at $104.7m for the week, down 3.3%, earned on TVL that grew 4.6% to $6.18bn
Week · Source: DefiLlama · Solana
Solana's fee total eased from $108.3m to $104.7m while its TVL rose from $5.91bn to $6.18bn, so fee intensity per dollar of TVL slipped slightly. Its weekly DEX volume held the top spot at $19.83bn (+7.4%) and capital turnover reached 3.21x.
4 Stablecoin Developments
10Tracked stablecoin float slips 0.5% to $283.57bn — a second consecutive weekly decline, led by Solana at -4.4%
Week · Source: DefiLlama · Multi-chain
TRON's float eased 0.2% to $94.01bn and Ethereum 0.3% to $147.38bn, while Solana shed 4.4% to $15.74bn. Only Base (+0.8%) and Optimism (+12.2%, on a small base) grew. Ethereum and TRON still hold about 85% of the sample between them.
5 Institutional Adoption
11Beyond the $52m Xinbi freeze, the week's institutional signal was consolidation: Visa, Circle and Ripple co-invest in the same stablecoin payments layer
Week · Source: U.S. DOJ · Regulation · U.S. DOJ
The DOJ action and the Velocity round bookend the week's institutional story — enforcement on one side, infrastructure investment on the other. Velocity's $48m Series A at a $200m valuation, backed by the three largest names in card, issuance and settlement, is the demand-side signal; the freeze is the supply-side cleanup.
6 What the week adds up to
The common thread across the security items is not a shared bug — it is that value moved because someone exploited a step nobody had guarded. rsETH's loss came from a Safe module that trusted its own executor; Nostra's from an oracle a thin market could push 8,000x; Chainflip's from a refund that paid twice. Three different flaws, one lesson: the unguarded step is wherever the last person assumed the previous step had checked it.
The rsETH case is the one to remember because it is new. No signature was forged and no contract was broken — a genuine instruction was issued, and a paid priority fee (about 19 ETH) decided whose copy landed first in the block, with the module's authorisation check letting the reorder through. An MEV bot, not the attacker, collected the rsETH. That is a class of risk — valid instruction, reordered timing — that the bridge and refund bugs of recent weeks did not cover.
Away from security, the week was the mirror of last week. TVL rose 4.0% to $77.89bn while fees fell 8.9% to $219.1m and stablecoin float slipped 0.5% for a second straight week. Capital arrived and trading cooled — the quieter of the two directions, and the one that bounds next week's activity unless liquidity returns.
Key Takeaways
- rsETH lost about 2,900 tokens (~$7.8m) when an MEV bot outbid a hacker's exploit and captured them at block 25,980,525.
- Nostra lost $3.5m on Starknet after an oracle marked NSTR at roughly 8,000x its real price.
- Chainflip restarted without TRON and still owes a pending 115,654 USDT swap; the loss stands at 736,442 USDT.
- Symbiosis confirmed about 15 BTC recovered; the bridge is being rewritten with an audit.
- Confirmed realized losses this week sum to roughly $20m (rsETH ~$7.8m, Nostra $3.5m, DCENT $6.57m, plus about $2.25m realized from the FET/NTX/AGIX/WMTx cluster); PeckShield values the attacker's remaining minted holdings at $16.77m (unrealized).
- Tracked TVL rose 4.0% to $77.89bn while fees fell 8.9% and stablecoin float slipped 0.5%.
DE
Defiinger Research DeskThe Defiinger Research Desk compiles multi-chain DeFi data and commentary from public on-chain sources and vetted industry publishers. Our editorial process prioritizes verifiable figures and clearly dated references.
Sources & Methodology
- DefiLlama — chain-level TVL, DEX volume, fees and stablecoin series used throughout.
- Kelp DAO — statement on the rsETH Safe-module incident and the 24-hour pause.
- Blockaid and BlockSec — independent loss estimates for the rsETH incident.
- Nostra — incident statement on the 17 September oracle exploit; Ekubo — the manipulated pool.
- Chainflip — restart note (v2.2.13) and the TRON route removal.
- Symbiosis — update on the recovered Bitcoin and the bridge rewrite.
- SlowMist — incident records for the DCENT mobile wallet loss.
- PeckShield — the FET/NTX/AGIX/WMTx mint-and-dump cluster (holdings valuation and realized proceeds).
- U.S. DOJ — announcement of the $52m freeze tied to Xinbi Guarantee.
- PANews and Decrypt — the Velocity Series A top-up from Visa, Circle and Ripple.
Headlines and figures on this page are drawn from the outlets listed above; commentary is clearly labelled opinion and is not investment advice. Last reviewed 2026-09-20.
Frequently Asked Questions
How do you choose which headlines to include?
We keep items that changed something measurable — capital, protocol parameters, or user access — and drop price-only stories and unverified loss figures.
Why link to home pages instead of the article?
We cite the outlet that reported each item rather than linking to permalinks we have not individually verified.
Which sources do you use?
Kelp DAO, Blockaid, BlockSec, Nostra, Ekubo, Chainflip, Symbiosis, SlowMist, PeckShield, the U.S. DOJ, PANews, Decrypt, DefiLlama, plus primary statements from protocol operators.
What date range does this cover?
Monday 14 September to Sunday 20 September 2026 inclusive. Every weekly report on the site uses the same Monday-to-Sunday window.
Do you report exploits before they are confirmed?
No. We wait for a security firm, the protocol, or an on-chain trace before quoting a loss figure, and we say so when a number is still provisional.
Is this investment advice?
No. The news column is the record; the commentary is clearly labelled opinion.