DeFi Weekly News Review — September 28–October 4, 2026

Every material multi-chain DeFi headline from Monday 28 September to Sunday 4 October 2026, grouped by theme with the date, source and commentary on each item.

Weekly DeFi News Review2026-10-042 min readDefiinger Research Desk538 words

Ethereum TRON Solana Base Optimism Stablecoins Security Bridges NEAR Lido Bitget Oracles

Below are the multi-chain DeFi headlines we logged between Monday 28 September and Sunday 4 October 2026, grouped by theme. Each item carries its date, the outlet it came from, a summary of what happened, and our read on why it matters.

The week's standout was a first for this column: a breach with a complete arc. NEAR Intents lost about $3.865m on 1 October and had every dollar back within roughly 36 hours. On the data side, the fee level held for a second week while trading stayed soft, and the stablecoin float rebounded after three weekly declines.

1 Security Incidents

01NEAR Intents loses about $3.865m to an Omni-layer bug, then gets every dollar back within roughly 36 hours of the theft

Thu 1 Oct · Source: NEAR Intents / NEAR Protocol · Cross-chain · NEAR Intents

An attacker exploited a bug in the interaction between NEAR Intents' Omni deposit-and-withdrawal system and its smart contract, pulling about $3.865m of USDT out of a BNB Chain treasury contract across five main withdrawals that straddled 30 September and 1 October (Bitquery also logged $10 and $11 test transfers the night before). The protocol's SHIELD monitoring flagged the activity; the flaw was patched within an hour of detection, and deposits and withdrawals on 11 supported networks — BNB Smart Chain, Polygon, TON, Optimism, Avalanche, Stellar and others — stayed paused for about 12 hours. Only USDT on BNB Smart Chain was affected; the core NEAR chain and its token were untouched. On 2 October general manager Alex Shevchenko said the team had identified the person responsible — 'We have identified you, sir' — gave them 48 hours, and published return addresses on Bitcoin, EVM chains and Solana. Blockchain investigator ZachXBT had already traced the funds through KuCoin and a bridge into Bitcoin. Within about 15 hours the recovery address received roughly 34.59 BTC (about $2.95m) between 14:31 and 15:05 UTC, after an opening 1 BNB transaction that read 'Willing to cooperate, reply with your Signal so contact is possible'; a final BNB Chain message at 16:15:28 UTC said the funds were back, acknowledged being 'in the wrong', and recommended bug bounties. Shevchenko confirmed the full amount was returned and closed the investigation the same afternoon, 2 October. Days earlier, NEAR Intents had frozen more than $500,000 of transfers linked to the Bitget breach.

Our takeThis is the counterfactual to last week's Bitget story: a small breach with a complete arc. Detection held, the patch landed inside an hour, the pause was wide enough to matter, and the ultimatum-plus-tracing combination produced a 100% return inside the deadline. Two caveats keep it from being a template: cooperation began only after the theft, the identification claim and the tracing — not after any agreed disclosure process — and the technical post-mortem on how the Omni interaction bug reached production is still pending.

02MetaMask exits about 17,000 Ethereum validators (~523,000 ETH) after an attacker redirects validator fee rewards — the confirmed loss is 0.36 ETH

Thu 1 Oct · Source: MetaMask · Ethereum · MetaMask Staking / Lido

MetaMask disclosed a security incident in its staking infrastructure — the former Consensys Staking unit, which operates non-custodial validators including for Lido — on 1 October. An attacker changed where block-production rewards were sent: on-chain analysis by independent researcher kaden.eth, reported by CoinDesk, found 18 of 19 MetaMask validators that proposed blocks sent their fee payouts to an address funded through Tornado Cash, diverting about 0.36 ETH in total. The withdrawal keys that control staked ETH were untouched, and MetaMask said it had identified no immediate threat to wallets. As a precaution it began exiting roughly 17,000 validators holding about 523,000 ETH — about $1.4bn at 1 October prices — though the company has not confirmed those figures. Lido said the final affected validators should be exited by the end of 7 October, that the full exit-withdrawal-reentry cycle takes about 45 days, and that stETH holders need take no action.

Our takeThe economics of this incident are the story: an attacker who controls only the fee recipient can take rewards but not the stake, so a five-figure-scale exit protected a nine-figure balance. The cost is measured in foregone rewards across a 45-day queue, not in principal — the same asymmetry the Kiln exit showed in 2025. What remains open is the entry path: MetaMask has not said how the fee-recipient settings were reached, and the post-mortem is the document to watch.

03September's loss trackers land at roughly $766m — up about 462% from August, with one centralised breach doing most of the work

Week · Source: PeckShield · Multi-chain · Monthly reporting

Monthly loss roundups from PeckShield and CertiK put September at roughly $766m across incidents, an increase of about 462% over August. The single largest component is the Bitget wallet-backend breach of 24 September; without it, the month sits in line with the recent run of on-chain weeks. The month also included MultiversX's five-day mainnet pause, the Astroport admin-key compromise, and the NEAR Intents exploit that closed the month with a full refund.

Our takeThe topline is a reminder that monthly loss statistics are concentration statistics. One centralised operator signing a fabricated feed moved the month's total by a factor of five; the smart-contract layer beneath it had a comparatively ordinary September. Any read of the 462% figure should name its dominant term.

04Blockstream says an external audit of the Liquid Network is underway, three weeks after the reserve-peg incident

Mon 28 Sep · Source: Blockstream · Bitcoin sidechain · Liquid

Blockstream said on 28 September that an external audit of the Liquid Network is in progress, following the 6 September incident in which an attacker minted unbacked L-BTC through a flaw in its range-proof verification cache. No audit findings have been published yet, and the network has been operating with the incident remediations in place since the restart.

Our takeThe audit is the right next step and the timeline is the test. Liquid's incident report named the mechanism quickly; the external check is what turns a remediation claim into an assurance claim, and its scope — whether it covers the watchman-set assumptions themselves or only the new code — will decide how much it settles.

2 Protocol Funding & Governance

05Jeeves raises $110m led by CoinFund for stablecoin-native corporate banking — annualized stablecoin volume hits $1.5bn from near zero eight months ago

Tue 29 Sep · Source: Jeeves · Payments · Jeeves

Jeeves, a Miami-based fintech offering corporate cards, cross-border payments and spend management settled on stablecoin rails, closed a $110m round led by CoinFund with Andreessen Horowitz, Coinbase Ventures, AllianceBernstein, CRV, GIC, ParaFi, Wintermute and Y Combinator participating. The company says annualized platform volume exceeds $5bn after tripling year over year, and that annualized stablecoin settlement has reached about $1.5bn — from effectively nothing eight months earlier — with 50% to 60% of its international payments now settling in USDC and EURC. The raise funds a stablecoin card programme expanding from 25 to 35 countries and a wallet with payouts to 190 countries.

Our takeThe number to keep is the slope, not the level: $1.5bn of annualized stablecoin settlement inside eight months, at a company whose customers include BMW, H&M and Burger King, is the payments thesis showing up in a conventional corporate-finance product rather than a crypto-native one. This is the same sector the week's smaller rounds point at.

06Walapay closes a $4.6m seed round to build stablecoin settlement between banks and local payment networks

Thu 1 Oct · Source: Walapay · Payments · Walapay

Walapay, a cross-border payment infrastructure company using stablecoins as the settlement layer between regional bank accounts and local payment networks, raised a $4.6m seed round led by Generative Ventures with Commerce Ventures, Polygon, AAF Management, NGC Ventures and others participating. The company says the funds go toward additional licences, banking partnerships and hiring.

Our takeSmall round, structural placement: the seed is buying regulatory licences and bank relationships, which is where the moat in stablecoin payments actually forms. Together with Jeeves, the week's disclosed payments financing exceeded $114m.

07HyperLink raises $2.5m for a prime-brokerage layer on Hyperliquid, which routed $254m last month

Sun 4 Oct · Source: PANews · Trading infrastructure · HyperLink

HyperLink, a prime-brokerage protocol built on Hyperliquid that aggregates trading volume and staking to unlock VIP fee tiers, raised $2.5m from Alliance, North Island Ventures, Reverie, Node Capital and Breed, per PANews' weekly funding roundup. The protocol says it routed about $254m last month — roughly 0.1% of Hyperliquid's total volume — and currently operates on an invite-only basis, accounting for about 1% of Hyperliquid's builder-attributed volume.

Our takeA prime brokerage on a perpetuals DEX is a derivatives-market structure story more than a payments one: the product exists because fee tiers and execution quality on the venue are worth arbitraging at scale. It is also a small round measured against the venue it sits on — the leverage is in the routing, not the raise.

3 Networks, Fees & TVL

08The fee level holds: network fees stay at $243.8M (+0.2%) while DEX volume slips (-0.8%) and TVL dips 0.4% — the first aggregate TVL decline in seven weeks

Week · Source: DefiLlama · Multi-chain (7 tracked)

Network fees landed at $243.8M for the second consecutive week — up just 0.2% — which answers last week's question about which side of the fee/volume divergence would revert: neither did. DEX volume eased 0.8% to $43.64bn and blended turnover was flat at 0.55x. Total TVL slipped 0.4% to $79.57bn, the first weekly decline since the week ending 16 August, with only TRON (+0.4%) and Base (+1.6%) growing. Optimism posted the week's largest relative moves — DEX volume +260.9% and fees +200% to $2.4m — on the sample's smallest bases, in the same window as the Velodrome and Aerodrome merger announcement of 29 September, ahead of the combined Aero launch scheduled for 21 October.

Our takeOne week cannot settle it, but the fee number now has a shape: two consecutive readings near $243m against soft volume reads more like a new operating level than event traffic. The TVL dip is the week's quiet fact — a 0.4% give-back after six up weeks is consolidation, not a reversal. The Optimism spike is a small-base effect worth one more week before connecting it to the merger.

09Velodrome and Aerodrome announce a merger into a single Aero protocol, with launch scheduled for 21 October

Tue 29 Sep · Source: Velodrome / Aerodrome · Optimism · Velodrome / Aerodrome

Velodrome (Optimism) and Aerodrome (Base), the two largest Aerodrome-family DEXes, announced on 29 September that they will merge into a single protocol called Aero, launching 21 October. The combination unites the dominant liquidity venues of two of the tracked chains; the announcement landed in the same week Optimism's DEX volume rose 260.9% on a small base.

Our takeTwo sister protocols formalising a merger is consolidation of a liquidity model that already spans both chains. The volume spike on Optimism is correlated in time, not proven in cause — one week of small-base data is not an attribution, and the 21 October launch is the actual event to measure.

4 Stablecoin Developments

10Tracked stablecoin float rebounds 0.5% to $284.82bn — the first weekly increase in four weeks, with TRON flipping from last week's main drag to the main driver

Week · Source: DefiLlama · Multi-chain

The seven-chain float rose 0.5% to $284.82bn, ending three consecutive weekly declines. The reversal was led by the chain that caused the drain: TRON went from (-1.3%) last week to +1.6% ($94.30bn). Arbitrum added 7.3% to $4.11bn, Base 2.2% and Solana 0.5%, while Ethereum slipped 0.4% to $146.93bn. Ethereum and TRON still hold about 85% of the float between them.

Our takeLast week's watch item fired in the opposite direction: the drain did not confirm as structural, it reversed. One week does not settle the question either way — but the composition of the rebound (the third of the float returning to growth, plus the sample's largest float gainer in Arbitrum) is a broader move than last week's decline was.

11Ethena's ENA incentives for the sUSDe ecosystem stop on 30 September

Wed 30 Sep · Source: Ethena Labs · Issuers · Ethena

Ethena announced on 26 September that it will stop distributing ENA token incentives that subsidise yields in its sUSDe ecosystem, with the change taking effect on 30 September — letting the underlying strategy, the basis-trade spread, carry the rate on its own.

Our takeRemoving a subsidy is the cleanest test of whether a yield was real. If sUSDe rates hold without ENA emissions, the strategy's economics were carrying them; if rates fall, the tokens were paying users to stay. The next few weeks of the yield data answer this directly, and we will chart it.

12The Federal Reserve proposes GENIUS Act rules, including a two-business-day redemption ceiling — while researchers count $76bn of stablecoins sitting on exchanges, outside the rule's reach

Tue 29 Sep · Source: Federal Reserve · Regulation · Federal Reserve

The Federal Reserve Board announced on 24 September two proposed rules implementing the GENIUS Act for payment stablecoin issuers it supervises, published in the Federal Register on 29 September with comments due 30 November. The redemption proposal — section 247.12 — would require supervised issuers to publish their procedures and honour redemption requests within two business days, with extensions possible for safety and stability reasons. The reserve proposal requires one-to-one backing in identified, segregated assets. The scope line matters: the rules bind issuers, not exchanges. Research published alongside the coverage by the Andersen Institute for Finance and Economics counted $76bn of reserve-backed stablecoins held on centralised exchanges as of 28 July — including $61.5bn of USDT and $10.1bn of USDC — a layer governed by venue terms of service, where Tether posts a $100,000 minimum for direct redemption and Coinbase's US agreement obliges it to do nothing at all.

Our takeThis is the clearest official statement yet of where the issuer's duty ends. The two-day clock is a real standard for the institutions that clear through Circle Mint and its equivalents; the $76bn sitting on venues is governed by contracts, not rules. The gap between those two layers is now quantified, and it is the part of the redemption chain a stablecoin holder actually uses.

5 Institutional Adoption

13Seventeen banks join Chainlink and Swift pilots for blockchain payment settlement, signing their own transactions over Swift's blockchain ledger

Mon 28 Sep · Source: Chainlink · Banking · Chainlink / Swift

Chainlink and Swift announced on 28 September, at the Sibos conference in Miami, that 17 banks — including ANZ, BNP Paribas, BNY, Citi, DBS, HSBC, Standard Chartered, UBS and Wells Fargo — are running pilots for blockchain-based payment settlement in which Chainlink's runtime environment (CRE) connects to Swift's blockchain ledger and the participating banks sign transactions with their own keys to initiate on-chain transfers of tokenized value. Swift's network reaches more than 11,500 financial institutions.

Our takeThe design choice is the institutional signal: the banks are not joining a new network, they are extending the ledger infrastructure they already operate into on-chain settlement while keeping transaction signing in their own hands, which leaves the compliance perimeter where it is. Bank-signed settlement over existing institutional rails is a narrower claim than bank adoption of public chains — and it is the claim actually being tested.

14Digital-asset funds take in $3.55bn in a single week — the largest weekly total of the year

Tue 29 Sep · Source: CoinShares · Fund flows · CoinShares

CoinShares' weekly flows report put institutional digital-asset product inflows at $3.55bn for the week, the largest single-week figure of 2026 so far, concentrated in bitcoin and ether products.

Our takeA year-high flows week landing while on-chain TVL consolidates is a divergence worth naming: the institutional buying channel and the on-chain deposit channel are not the same money. The former responds to price direction; the latter, in this sample, has been drifting up on its own schedule.

15Q3 closes with about $300.9bn of stablecoins across all chains, and TRON added roughly $5bn during the quarter

Week · Source: Token Terminal · Q3 data · Token Terminal / RWA

Token Terminal's quarterly review put total stablecoin supply at about $300.9bn across all chains at the end of Q3, with TRON adding roughly $5bn of float during the quarter. The all-chain figure is a wider universe than the seven chains we track, whose combined float stands at $284.82bn.

Our takeThe quarterly lens agrees with the weekly one on the shape: TRON remains the chain where dollar float accumulates, whatever the week-to-week noise. A quarter of net TRON growth through three weekly-decline weeks in September says the structural drift and the weekly volatility are different layers.

16Bitget completes its phased withdrawal restart on schedule and restores its protection fund to $309m, including 3,705 BTC

Week · Source: CoinDesk · Exchanges · Bitget follow-through

Bitget's withdrawal restart held to the schedule published on 26 September: bitcoin withdrawals resumed 28 September, ether on 29 September, USDT on 30 September and remaining services on 2 October. On 30 September the company said it had restored its User Protection Fund to $309m — including 3,705 BTC — after the roughly $387.5m breach of 24 September. The forensic investigation with Mandiant and SlowMist continues, and no recovery percentage has been published.

Our takeLast week we wrote that holding to the restart timetable was the credibility test. It held. A funded schedule plus a replenished reserve is the response machinery working, and it stands in contrast to the incident's unresolved half: the recovery percentage for the $387.5m itself, which is the number still owed to the record.

6 What the week adds up to

The week offered something the incident record rarely contains: a control group. NEAR Intents' exploit ran the same playbook as dozens before it — a bug at a layer junction, five withdrawals, a bridge-and-exchange exit — and then diverged at the response step. Detection held, the patch landed within an hour, the pause was wide, the team claimed identification publicly, and the funds came back whole. Nothing about the breach was novel; everything about the ending was.

Setting it beside Bitget sharpens both stories. Bitget lost roughly $387.5m through its own authorisation process and is still working the recovery; NEAR Intents lost about 1% of that through a contract bug and closed the file within three days. The variable that separated them was not chain technology — it was whether the attacker's exit route stayed traceable, and whether the operator's response moved faster than the laundering did.

Away from security, the data week was the consolidation the numbers have been pointing at. Fees held at $243.8M for a second week while volume stayed soft — the divergence resolving into a level, not a reversion. TVL gave back 0.4%, its first down week in seven. And the stablecoin float, the series' most-watched drain, rebounded 0.5% with TRON flipping from drag to driver. Regulators, meanwhile, put a number on a boundary the market has been negotiating implicitly: the Fed's proposed two-business-day redemption rule governs the issuer, and the $76bn parked on exchanges sits outside it.

Key Takeaways

NEAR Intents lost about $3.865m to an Omni-layer bug on 1 October, patched within an hour, paused 11 networks for ~12 hours — and recovered the full amount within roughly 36 hours of the theft, about 15 hours into a public 48-hour ultimatum.
MetaMask began exiting ~17,000 Ethereum validators (~523,000 ETH) after an attacker diverted 0.36 ETH of validator fee rewards; withdrawal keys and user wallets were untouched, with exits completing by 7 October.
September's tracked losses reached roughly $766m, up about 462% from August — the Bitget breach alone accounts for roughly half.
Network fees held at $243.8M for a second week while DEX volume eased 0.8%; TVL slipped 0.4% to $79.57bn, the first decline in seven weeks.
Stablecoin float rebounded 0.5% to $284.82bn after three weekly declines, led by TRON's reversal to +1.6%.
The Fed proposed a two-business-day redemption ceiling for supervised stablecoin issuers; $76bn of stablecoins sit on exchanges outside that rule. Jeeves raised $110m; 17 banks joined Chainlink-Swift settlement pilots.

Defiinger Research Desk

The Defiinger Research Desk compiles multi-chain DeFi data and commentary from public on-chain sources and vetted industry publishers. Our editorial process prioritizes verifiable figures and clearly dated references.

Sources & Methodology

DefiLlama — chain-level TVL, DEX volume, fees and stablecoin series used throughout.
NEAR Intents — statements by general manager Alex Shevchenko on 2 October (the ultimatum, the published return addresses, the confirmation of full recovery) and the investigation closure the same afternoon.
Bitquery — on-chain measurement of the outflows ($3.865m across five main withdrawals, plus test transfers). ZachXBT — the tracing through KuCoin into Bitcoin.
Crypto Briefing, BSCN and Crypto News Flash — independent coverage of the paused networks, the negotiation messages and the recovery timeline.
MetaMask — the 1 October incident notice and the wallet-safety statement. Lido — the validator-exit confirmation, the 7 October deadline and the 45-day cycle estimate.
kaden.eth (independent security researcher), as reported by CoinDesk — the on-chain analysis of redirected fee recipients and the validator-exit estimate.
PeckShield and CertiK — September monthly loss totals. Blockstream — the Liquid Network external-audit status.
Jeeves — the $110m round announcement. Walapay — the $4.6m seed round. PANews — the weekly funding roundup anchoring the HyperLink item.
Ethena — the ENA incentives change announced on 26 September and effective on 30 September.
Federal Reserve — the GENIUS Act implementation proposals of 24/29 September. CryptoSlate and the Andersen Institute for Finance and Economics — the exchange-held stablecoin analysis.
Chainlink and Swift — the 28 September settlement-pilot announcement at Sibos. CoinShares — the weekly flows report. Token Terminal — the Q3 stablecoin review.
Bitget — the withdrawal-restart completion and the protection-fund replenishment of 30 September.

Headlines and figures on this page are drawn from the outlets listed above; commentary is clearly labelled opinion and is not investment advice. Last reviewed 2026-10-04.

Frequently Asked Questions

How do you choose which headlines to include?

We keep items that changed something measurable — capital, protocol parameters, or user access — and drop price-only stories and unverified loss figures.

Why link to home pages instead of the article?

We cite the outlet that reported each item rather than linking to permalinks we have not individually verified.

Which sources do you use?

NEAR Intents, Bitquery, ZachXBT, Crypto Briefing, MetaMask, Lido, CoinDesk, PeckShield, CertiK, Blockstream, Jeeves, Walapay, PANews, Ethena, the Federal Reserve, CryptoSlate, Chainlink, Swift, CoinShares, Token Terminal, Bitget, DefiLlama, plus primary statements from protocol operators.

What date range does this cover?

Monday 28 September to Sunday 4 October 2026 inclusive. Every weekly report on the site uses the same Monday-to-Sunday window.

Did the NEAR Intents attacker really return everything?

The protocol's general manager confirmed the full amount was returned and closed the investigation on 2 October, the same afternoon the final on-chain message landed. A complete asset-by-asset reconciliation of every return transaction has not been published, so we describe the visible on-chain trail — the Bitcoin returns and the final on-chain message — as partial evidence of a complete claim.

Is this investment advice?

No. The news column is the record; the commentary is clearly labelled opinion.