Weekly DeFi Intelligence — 21–27 September 2026

1 Networks — how active is each chain?

Every chain grew TVL, which has happened once before in this sample — the week of the late-August level shift. Solana led on percentage (+7.1% to $6.6B), Base followed (+5.9%), and Ethereum's +1.8% still pushed it to a fresh sample high of $53.5B. The fee headline is double-barrelled: Solana at $113.7M (+8.6%) and Ethereum at $86.2M (+15.2%) — Ethereum's largest weekly fee total in the sample, earned on volume that grew just 0.7%.

Turnover makes the divergence legible. Solana turned its TVL over 2.77 times this week, down from 3.21x; Ethereum did so 0.20 times, down from 0.20x. Blended turnover sits at 0.55x, down in four of the last five weeks — and the fee aggregate and the volume aggregate are pointing in opposite directions once more, this time with the largest fee gain recorded in any of the series' divergence weeks.

2 Stablecoins — how are stablecoins performing?

Aggregate float across the chains we track stands at $283.3B, down -0.1% week over week — a third consecutive contraction, the longest in our sample. TRON did the damage at -1.3% ($92.8B, a z-score of -3.26 against its own baseline), while Solana rebounded +6.4% to $16.7B and Ethereum was flat (+0.1%).

Three straight declines against a rising TVL is now a trend rather than two noisy weeks — the watch item we named last week fired. The composition changed too: the drain concentrated in TRON, which holds a third of the float, instead of being spread across the sample.

Concentration is unchanged as a structure: Ethereum and TRON hold 84.8% between them, so the float remains a statement about two chains — one flat, one shrinking.

3 DeFi — what happened this week?

The trading picture inverted at the top. Five of seven chains grew volume — Arbitrum (+7.3%), TRON (+6.7%), Base (+4.5%) and Optimism (+4.5%) among them — but the two largest venues both fell: Solana eased 7.6% to $18.32bn and BNB Chain dropped 16.5% to $6.51bn, extending the unwind of its two-week surge for a second week. Five small gains could not offset two large declines, and the aggregate fell 5.0%.

The week's defining security event sat outside the smart-contract category. Bitget detected unauthorised transfers from some of its hot and warm wallets at 18:31 UTC on 24 September, estimated $351.6m that night, and revised the figure to roughly $387.5m the next day after adding Zcash and TRON transfers. The mechanism was unusual: attackers compromised a third-party security product, obtained high-level internal credentials, and fed false transaction data into the wallet-management backend — Bitget's own authorisation process signed the transfers. On-chain reporting puts XRP at about 40% of the revised total and ETH at about 22%; an attacker wallet converted $19.67m of USDT0 into 7,111 ETH within minutes of the first transfers. Mandiant and SlowMist are investigating; the company says on-chain patterns are consistent with North Korea-linked activity and that its Protection Fund (over $464m) covers the loss.

The on-chain ledger was smaller but broad. MultiversX halted its mainnet on 19 September after a VM-level atomicity flaw produced invalid state changes, confirmed the exploit the next day, and restarted block production on 24 September after roughly five days paused, using a targeted recovery that preserves legitimate history. Co-founder Beniamin Mincu said the attacker's accounts were identified, seized and frozen; no confirmed loss figure has been publicly disclosed — SlowMist's incident database lists none — pending the team's technical report. Astroport disclosed on 22 September that admin privileges for its Neutron contracts may have been stolen; Neutron halted the chain to investigate and SlowMist logs about $4.9m. Against that, the Coldcard seed-entropy exploit entered its recovery phase: white-hats consolidated 52.37 BTC (about $4.5m) into Wyoming's Crypto Recovery Trust on 21 September, the first slice of the 1,789.28 BTC (about $154.1m) Galaxy Digital tracks as swept since July, and the trust returned more than 20 BTC to a verified owner on 23 September.

4 Yields — what is happening in the yield market?

Ethereum stablecoin lending sits at 4.17% TVL-weighted against a tokenized T-bill reference of 3.43% — a premium of 0.74pp. That answers last week's watch item in the opposite direction from expected: the premium did not keep compressing, it re-widened from 0.59pp as lending jumped 18 basis points — the largest weekly move since the late-August jump — while the reference crept up 3bp.

Solana staking rebounded from 4.70% to 4.89% — about 0.19pp, inside the band we have treated as MEV-and-tips noise. Arbitrum lending extended its premium to 5.22% — a spread of 1.79pp, the widest in the sample again. ETH liquid staking eased to 2.18% and the blended stablecoin rate rose from 3.99% to 4.11%.

5 Outlook — what to watch next week

The single most informative question is which side of the fee/volume divergence reverts. If volume catches up to fees, the usage story reopens with the largest capital base in the sample behind it; if fees fall back while volume stays soft, this week's fee spike was event traffic, not a new operating level. The second is Bitget's restart schedule — BTC withdrawals resumed on 28 September, with ETH, USDT and the rest due through 2 October — and the recovery percentage that follows it.

6 What would change our mind

7 Risk register

The register's newest line sits outside DeFi proper: compromised operator backends approving payouts. Bitget's case is the sample's largest loss and its mechanism — a trusted internal system signing what it was told — is the centralised twin of the module and oracle failures of recent weeks. The fix is also the twin: bind every payout to verified data, and treat the approval layer as the attack surface.

8 Formulas used in this briefing

9 The numbers behind the five answers

10 How to read this briefing

• The five questions never change, so a changing answer is the signal — read this week against last week rather than in isolation.
• Every number comes from the same dataset used by the data report and news review this week; no column can disagree with another.
• Yield levels are recomputed for the specific week, not quoted from today's snapshot.
• Named judgments are labelled as such. Everything else is arithmetic on public data.
• Where we hold an opinion with real uncertainty, the condition that would overturn it is stated in the table above rather than omitted.

11 In brief

The week's data splits in two. The deposit-and-fee side was strong: every one of the seven chains grew TVL — the second all-green week in our sample and the first since late August — lifting the aggregate 2.5% to $79.86B, and network fees jumped 11.1% to $243.4M. The trading side was weak: DEX volume fell 5.0% to $44.00B and blended turnover dropped from 0.59x to 0.55x. Stablecoin float contracted for a third straight week, down 0.1%.

The security answer left the smart-contract category altogether. Bitget, a centralised exchange, lost roughly $387.5m — detected 24 September at 18:31 UTC, initially estimated at $351.6m and revised the next day — after attackers compromised a third-party security product to obtain high-level internal credentials and fed false transaction data into the wallet-management backend, which then authorised the transfers itself. No private key was stolen and cold wallets were untouched. On-chain, the week was quieter but broad: MultiversX paused its own mainnet over a VM-level atomicity flaw, Astroport lost admin control of its Neutron contracts (about $4.9m per SlowMist), and white-hats rescued 52.37 BTC from the Coldcard seed-entropy exploit into a Wyoming recovery trust.

Yields moved the most in weeks. Ethereum stablecoin lending jumped from 3.99% to 4.17%, pushing the premium over the tokenized T-bill reference (3.43%) back out to 0.74pp from 0.59pp — last week's compression mostly reversed in one week, this time driven by lending demand rather than the reference rate.

12 Weekly scorecard