DefiingerMulti-Chain DeFi Data, News & Research
Weekly DeFi News ReviewWeekly DeFi Data ReportWeekly DeFi IntelligenceDeFi Yield Market IntelligenceWeekly Deep Dive

DeFi Weekly News Review — September 7–13, 2026

Every material multi-chain DeFi headline from Monday 7 to Sunday 13 September 2026, grouped by theme with the date, source and commentary on each item.

Weekly DeFi News Review2026-09-132 min readDefiinger Research Desk374 words
EthereumTRONBNB ChainSolanaBaseStablecoinsSecurityBridgesReal-World AssetsYield

Below are the multi-chain DeFi headlines we logged between Monday 7 and Sunday 13 September 2026, grouped by theme. Each item carries its date, the outlet it came from, a summary of what happened, and our read on why it matters.

The week ran in two registers. Liquid's rescue negotiation played out on-chain and ended with 85% of the reserve home and a ransom refused — while two more bridges, Nomic and Symbiosis, failed in the same shape Liquid did: value created upstream, accepted downstream.

1 Security Incidents

01The Liquid attacker returns 3,400 BTC — about 85% of the stolen reserve — one day after Blockstream confirms every bridge node is patched; about 598.5 BTC stays with the attacker

Mon 7 Sep · Source: Blockstream · Bitcoin sidechain · Liquid Network

Blockstream posted a PGP-signed message at 09:19 UTC on 7 September confirming the patched nodes were 'safe to return the funds'. A probe transaction carrying 1,000 satoshis and a PGP-encrypted note arrived at 15:31 UTC, and 38 minutes later exactly 3,400 BTC — roughly $268m — landed back in the federation wallet. The remaining 598.5 BTC, about $47m at prevailing prices, stayed at the attacker's withdrawal address. L-BTC is now backed at roughly 85% rather than the 5% low point of 6 September.

Our takeThe conditional return is the first time this negotiation pattern has produced a real recovery at scale. But a 15% self-awarded retainer is not a bug bounty — nobody agreed to it in advance, and the reserve is not whole until the balance comes back.

02Liquid resumes block production and transaction processing on the patched Elements v23.3.4 release, though withdrawals stay disabled pending the final restoration phase

Thu 10 Sep · Source: Blockstream · Bitcoin sidechain · Liquid Network

Blockstream shipped Elements v23.3.4 — the fix for the exploited range-proof cache flaw — on 9 September, and the network returned to block production and transaction processing the next day. Peg-outs remain off while the federation completes what it calls the last phase of restoration. The week also surfaced a disclosure dispute: a Bitcoin Red Team researcher said warning emails about the flaw went unanswered before the exploit; Samson Mow responded that 'no email was ignored'.

Our takeA restart is a sequence, not a switch — and the contested disclosure timeline now matters as much as the technical fix. The version of events that stands will shape how future cache-layer reports get triaged.

03Blockstream refuses to pay a ransom for the remaining 598.5 BTC, stating that 'it is not white-hat activity. It is theft'

Fri 11 Sep · Source: Blockstream · Bitcoin sidechain · Liquid Network

In a statement posted on 11 September, Blockstream said it will not pay for the return of stolen funds, that taking assets without authorisation and withholding them is 'a crime, not responsible disclosure', and that it may pursue the matter with law enforcement and on-chain forensics. The company argued that paying would set a poor standard for open-source developers. The 598.5 BTC has not moved from the address it was withdrawn to.

Our takeThis closes the ambiguity our deep dive flagged last week. Whether the coins come back now depends on forensics rather than negotiation — and the prudent assumption for L-BTC holders remains that the balance is gone unless it moves back verifiably.

04Chainflip halts its network after an attacker reuses memos on already-signed TRON transactions to trigger duplicate refunds, draining 736,442.17 USDT

Sat 12 Sep · Source: Chainflip · TRON · Chainflip

Chainflip reads swap instructions from a memo attached to TRON transfers. The attacker attached their own memo to a transaction the validators had already signed; the system read it as a separate swap, treated it as failed, and refunded it — paying the same deposit twice. The pattern ran eight times in about ninety minutes in the early hours of 12 September, doubling in size each round; six rounds produced payouts totalling 736,442.17 USDT. Detection came only after later USDT payouts began to fail. One pending user swap of 115,654.41 USDT sits untouched in the vault. The network is paused until Monday at the earliest, and the team has committed to making affected users whole.

Our takeThe deposit never left the vault; the refund logic paid against it twice. That is the same upstream-creates-value shape as Liquid, scaled down four hundredfold — and it happened through the input format rather than the mint.

05Symbiosis halts its Bitcoin Bridge after an unauthorised mint of roughly 46.1 billion unbacked syBTC on BNB Chain; the attacker realises about $336,000 and the team recovers 15 BTC

Fri 11 Sep · Source: Symbiosis · BNB Chain · Symbiosis

Blockchain security firm Blockaid detected the breach at about 04:28 UTC on 11 September. An unauthorised call to the BridgeV2 contract minted synthetic syBTC more than 2,000 times Bitcoin's fixed 21 million supply cap. Pool reserves bounded the real damage: the attacker converted about 4.39 WBTC — roughly $336,000 — through Uniswap v4 before the pools were halted. Symbiosis paused the native Bitcoin bridge, rerouted BTC swaps through third-party integrations, recovered about 15 BTC into a team-controlled multisig, and let a 20% white-hat bounty offer lapse on 13 September without takers.

Our takeThe mint was astronomical; the loss was modest, because the attacker could only drain what the pools actually held. Liquid proved the same lesson last week at a hundred times the cost: unbacked supply is only as damaging as the exits it can reach.

06A double-spend bug in Nomic's deposit-forwarding mechanism sends unbacked nBTC to Osmosis, putting roughly $3.15m at risk before validators freeze the flows

Wed 9 Sep · Source: SlowMist · Nomic · nBTC bridge

The attacker exploited a flaw in Nomic's custom forwarding mechanism to double-spend nBTC and send unbacked vouchers across IBC to Osmosis. About 39.84 nBTC — roughly 36% of the backing of Osmosis's Alloyed BTC asset — was affected. Osmosis froze Nomic and Alloyed BTC flows, validators coordinated an upgrade, and 22.65 BTC sitting at the attacker's address was frozen pending a governance vote to seize it and cover the rest from the community pool. Nomic and the IBC layer itself were not compromised.

Our takeThe containment is the story: a chain-level freeze clawed back most of the damage in hours. That remedy exists only because Osmosis has a validator set fast enough to act — the same centralisation Liquid's federation exercised, just sooner.

07Five smaller confirmed drains: Zentra Finance on Citrea, Amnext and BeatSwap on BNB Chain, Cozy V2 on Optimism and ether.fi's legacy AtomicQueue on Ethereum

Week · Source: SlowMist · Multi-chain

Zentra Finance lost about $143,000 of its ctUSD reserve on Citrea on 9 September and set a 14 September deadline for an on-chain return negotiation. Amnext, a dormant no-loss lottery on BNB Chain, was drained of about $116,000 the same day. Cozy V2 on Optimism lost about $163,000 on 7 September to an unclassified exploit. BeatSwap on BNB Chain lost about $77,500 after its liquidity converter used an Uniswap V3 spot price as its sole oracle. ether.fi's legacy AtomicQueue lost about 15.45 ETH — roughly $38,000 — on 11 September through a missing access check that made already-approved addresses act as solvers.

Our takeNone of these approached the week's headline losses, but five venues in seven days is the long tail the weekly totals keep hiding. Two of the five were dormant or legacy systems — unmaintained code does not need a novel exploit, only a visitor.

2 Protocol Launches, Upgrades & Governance

08Uniswap Labs launches the StablePair Hook for v4, bringing dynamic fees to USDC/USDT and USDC/USDG pools on Ethereum mainnet

Thu 10 Sep · Source: Uniswap Labs · Multi-chain · Uniswap

The hook adjusts LP fees by how far a pool's price sits from its reference rate. Swaps that push the price further from the peg pay zero fees — they improve the pool's position — while swaps that pull it back are priced through a Dutch auction that starts high and decays block by block until a trader accepts. Uniswap put the addressable market at $43.4bn of stablecoin-to-stablecoin volume in the second quarter, more than the next three on-chain venues combined, and says more than 90,000 hooks have now been initialised across roughly 20 chains.

Our takeStable pairs are the deepest and most arbitrage-heavy category in DeFi, and until now the arbitrage value leaked to traders. Redirecting it to LPs changes the economics of the largest pair type — the open question is whether the auction actually captures value or just reprices it.

09Aave governance takes up a proposal to onboard Société Générale-FORGE's EURCV euro stablecoin to the V4 Core Instance, alongside a risk update lifting the USDe base borrow rate from 6.00% to 6.30%

Fri 11 Sep · Source: Aave · Ethereum · Aave

The EURCV proposal would put a bank-issued, compliant euro stablecoin into Aave's largest instance as a listed asset. A separate 11 September risk update proposes raising the USDe base borrow rate across several V3 deployments while adjusting Slope1 parameters. They follow the 8 September launch of Aave's official MCP server, which connects AI assistants to live V3 and V4 data. Aave V4 now holds close to $400m in TVL with about $252m in active loans, and 7 September risk actions raised the V3 Core USDC supply cap to $3.0bn and the borrow cap to $2.7bn after utilisation hit 92.4% on supply and 95.7% on borrows.

Our takeA bank-issued euro stablecoin as a lending asset is the RWA-and-lending convergence moving from slide decks to parameter votes. The caps tell the same story from the demand side: USDC borrowing was nearly saturated before the raise.

10Morpho holds steady near $4.9bn in active loans, with Robinhood Chain emerging as a material market at more than $520m locked

Wed 9 Sep · Source: PANews · Multi-chain · Morpho

Morpho's combined TVL sits around $9.7bn, with roughly $4.9bn of outstanding borrowing — essentially holding the $5bn milestone reached at the start of September. Ethereum accounts for about $4.5bn of TVL and Base close to $4bn. The newer development is distribution: Robinhood Chain now carries more than $520m in Morpho Blue markets with about $428m in active loans, part of a network whose seven-day DEX volume passed $12bn.

Our takeOutstanding loans are the number that separates a lending market from a deposit warehouse. Steady near $5bn while the venue base widens is growth of a different kind than TVL — credit demand finding new distribution.

3 Networks, Fees & TVL

11Solana posts the week's largest fee total among tracked chains at $108.3m, up 28.5%, with DEX volume up 14.9% to $18.46bn on flat TVL

Week · Source: DefiLlama · Solana

Fees rose from $84.3m the week before while TVL held at $5.91bn, so capital turnover climbed to 3.12x from 2.72x. Volume growth came as Ethereum's DEX volume slipped 3.5% to $8.60bn.

Our takeThe same chain that led the sample on turnover last week pulled further ahead, and it did it with deposits flat. Usage-led weeks look different from deposit-led ones — and this was the clearest usage-led week since we started tracking the seven chains together.

12Base fees jump 68.8% to $21.6m and DEX volume rises 13.8% to $6.58bn while TVL slips 1.1% to $5.60bn

Week · Source: DefiLlama · Base

Fee revenue moved from $12.8m to $21.6m in one week, the steepest relative fee increase among the tracked chains. Volume and fees rose together while deposits left, and capital turnover climbed to 1.18x from 1.05x.

Our takeA chain can get busier and smaller at the same time. Base this week is the cleanest example: trading activity up double digits, deposits down — activity is being paid for by the capital already there, not by new money.

13Tracked TVL rises 1.2% to $74.87bn, DEX volume climbs 8.2% to $45.21bn and fees jump 17.4% to $240.5m, while stablecoin float slips 0.1% to $284.91bn

Week · Source: DefiLlama · Multi-chain (7 tracked)

Three of seven chains grew TVL (BNB Chain +2.2%, Ethereum +1.5%, TRON +1.3%), two were flat and two slipped. Volume growth was broader: BNB Chain, Solana and Base all gained while Ethereum and Arbitrum lost. Blended turnover recovered to 0.60x from 0.56x, the first rise in several weeks.

Our takeAfter weeks of deposits growing while usage fell, the direction reversed: activity grew faster than capital. One week is not a regime change, but fees rising 17% against a 1% TVL move is the healthier shape of the two.

4 Stablecoin Developments

14Tracked stablecoin float edges down 0.1% to $284.91bn, with TRON the only meaningful gainer at +$400m and Ethereum the largest decliner at −$590m

Week · Source: DefiLlama · Multi-chain

TRON's float rose 0.4% to $94.19bn. Ethereum's fell 0.4% to $147.89bn. Arbitrum added about $110m (+2.8%) while Solana shed roughly $160m and BNB Chain about $70m.

Our takeA flat float against an 8% volume week means the same dollars worked harder. That reads healthier than the reverse — but it also means this activity was not bought with new deposits.

15MoneyGram launches its first stablecoin-backed Visa card in Colombia, supporting USDC at launch with its own MGUSD token planned next

Thu 10 Sep · Source: PANews · Payments · MoneyGram

The 86-year-old payments company has been building stablecoin rails since 2021 through its Stellar-based cash-to-USDC ramps and issued its own dollar token in June. The card extends that stack from remittance corridors into everyday spending.

Our takeIssuers keep multiplying; distribution is the scarce asset. A consumer card that spends stablecoin balances at point of sale is worth more to the rails than another token launch — and Colombia is a remittance-heavy market where the use case is not hypothetical.

5 Institutional Adoption

16On-chain RWA market value edges up 0.81% to $39.07bn while holder count more than doubles to 3.885m; ARK applies to the SEC to tokenize venture-fund shares

Week · Source: PANews · Multi-chain (RWA)

PANews' weekly tally for 4-11 September also counts stablecoin transfer volume at $7.8tn for the month, up 49.4% month over month. ARK's application would list and trade tokenized venture fund shares on an exchange — the firm calls it phase 2.0 of asset-management tokenization. Circle moved to acquire cross-border payment platform Tazapay for about $400m, and nine Swiss institutions including UBS began sandbox testing of a franc-backed stablecoin, CHFD.

Our takeHolder growth of 119% in a month is the standout — tokenized funds are reaching people, not just treasuries. ARK's filing matters because venture shares are the illiquid end of the fund spectrum; if the structure clears, everything more liquid than it is already proven.

6 What the week adds up to

Three bridge-class systems failed within five days — Liquid's aftermath aside, Nomic double-spent nBTC into Osmosis and Symbiosis minted unbacked syBTC by the tens of billions. The dollar outcomes differed by up to nearly three orders of magnitude ($3.15m, $336k and $736k against Liquid's $320m), and the difference was almost entirely how much exit liquidity each attacker could reach before someone pulled a switch.

The recoveries deserve equal billing. Liquid got 3,400 BTC back through a negotiation conducted in OP_RETURN messages; Osmosis froze 22.65 BTC mid-flight; Symbiosis recovered 15 BTC. The controls that worked were all versions of the same thing — a party with the power to stop, and the willingness to use it fast.

Away from security, the week's data finally moved in the healthy direction: fees up 17% and volume up 8% against a 1% TVL gain. Solana posted the largest fee total we have recorded on any tracked chain, and Uniswap began re-pricing the deepest trading category in DeFi.

Key Takeaways

  • Liquid recovered 3,400 BTC — about 85% — and Blockstream refused a ransom for the remaining 598.5 BTC.
  • Chainflip lost 736,442 USDT to memo reuse on signed TRON transactions; the network is paused pending a restart.
  • Nomic and Symbiosis both failed through unbacked bridge mints, echoing Liquid's shape at far smaller cost.
  • Solana posted the week's largest tracked fee total at $108.3m, up 28.5%, on flat TVL.
  • Uniswap's StablePair Hook brought dynamic, auction-priced fees to USDC/USDT and USDC/USDG pools.
  • Tracked TVL rose 1.2% to $74.87bn while stablecoin float slipped 0.1% — usage up, deposits flat.
DE
Defiinger Research Desk

The Defiinger Research Desk compiles multi-chain DeFi data and commentary from public on-chain sources and vetted industry publishers. Our editorial process prioritizes verifiable figures and clearly dated references.

Sources & Methodology

  1. DefiLlama — chain-level TVL, DEX volume, fees and stablecoin series used throughout.
  2. Blockstream — Liquid Network recovery statements, the Elements v23.3.4 release and the 11 September statement.
  3. Chainflip — official incident blog, 'Tron USDT exploit: what happened and what happens next'.
  4. SlowMist — incident records for Nomic, Zentra, Amnext, Cozy V2, ether.fi and BeatSwap.
  5. Symbiosis — statement on the Bitcoin Bridge exploit, the recovered funds and the lapsed bounty.
  6. The Crypto Times — cross-checks on the Chainflip and Symbiosis incidents.
  7. Uniswap Labs — StablePair Hook announcement and v4 hook statistics.
  8. Aave — governance proposals for EURCV onboarding, USDe borrow-rate changes and V3 cap raises.
  9. PANews — RWA weekly (4-11 September), Morpho lending figures and the MoneyGram card launch.

Headlines and figures on this page are drawn from the outlets listed above; commentary is clearly labelled opinion and is not investment advice. Last reviewed 2026-09-13.

Frequently Asked Questions

How do you choose which headlines to include?
We keep items that changed something measurable — capital, protocol parameters, or user access — and drop price-only stories and unverified loss figures.
Why link to home pages instead of the article?
We cite the outlet that reported each item rather than linking to permalinks we have not individually verified.
Which sources do you use?
Blockstream, Chainflip, Symbiosis, SlowMist, DefiLlama, Uniswap Labs, Aave, PANews, The Crypto Times and CoinMarketCap, plus primary statements from protocol operators.
What date range does this cover?
Monday 7 September to Sunday 13 September 2026 inclusive. Every weekly report on the site uses the same Monday-to-Sunday window.
Do you report exploits before they are confirmed?
No. We wait for a security firm, the protocol, or an on-chain trace before quoting a loss figure, and we say so when a number is still provisional.
Is this investment advice?
No. The news column is the record; the commentary is clearly labelled opinion.