Weekly DeFi Index

This week, the market cap and volatility indices dropped by -1.49% and -9.62%, respectively, while the volume index increased by +18.10%.

• Grayscale added  Pendle (PENDLE) and Ethena (ENA) to its Q2 2026 ”Assets Under Consideration” list, signaling potential future institutional products and capital allocation.
• Singapore Gulf Bank introduced a service for institutional clients to mint and redeem U.S. dollar-pegged stablecoins directly from their bank accounts via the Solana blockchain. The service provides 24/7 settlement and will initially support USDC for transactions above $100,000. Future support is planned for USDT, USDe, and USDG.
• Aave is currently modeling estimated bad debt between $124 million and $230 million from the Kelp DAO exploit.

Chart of the Week

The Kelp DAO exploit stemmed from a single point of failure in its cross-chain bridge configuration: a 1-of-1 verifier setup on the LayerZero protocol. This structural flaw allowed attackers to trick the system into releasing funds with a forged message that never existed on the source blockchain.

Kelp DAO used LayerZero to manage its rsETH token across chains, relying on decentralized verifier networks (DVNs) to validate transactions. Critically, Kelp DAO configured its bridge to require approval from only one DVN (operated by LayerZero Labs). Without an independent second verifier, this single point of control was easily exploited. While the LayerZero protocol itself was not breached, attackers compromised the verifier’s data sources by poisoning RPC nodes, launching a DDoS attack, and injecting a forged message.

At the time of writing, among the 3,669 unique Omnichain Apps (OApps), around 45% used a 1-of-1 DVN configuration, 47% used 2-of-2 configurations, and 5.8% used 3-of-3 or higher configurations.

News Highlights

• Kelp DAO, a liquid restaking platform, lost approximately $293 million because of a security exploit in its rsETH bridge contract.
• • An attacker forged a cross-chain transfer message, tricking the Kelp DAO bridge (built on LayerZero) into releasing 116,500 rsETH on Ethereum without actually moving tokens from the sending chain, effectively creating unbacked tokens. The attacker deposited 89,567 of the unbacked rsETH into Aave as collateral, borrowing roughly $190 million in ETH and related assets across Ethereum and Arbitrum.
  • Arbitrum's Security Council froze ~30,766 ETH ($71M) tied to the exploit, moving funds to a frozen wallet with law enforcement input.
  • The exploit caused systemic contagion to the broader DeFi ecosystem. Because rsETH was a recognized collateral on Aave, many users engaged in "looping" strategies —depositing rsETH, borrowing ETH, buying more rsETH, and depositing it again. This created massive leverage. When Kelp was exploited, the value and security of rsETH became compromised, threatening the very foundation of these Aave loans.
  • Aave is currently modeling estimated bad debt between $124 million and $230 million from the exploit. 
  • A group of DeFi protocols launched a joint "escape hatch" mechanism to provide liquidity and exit options for Aave ETH lenders and users engaged in leveraged "looping" strategies.
  • LayerZero attributed the exploit to misconfigurations in Kelp’s specific setup, while Kelp DAO asserted that LayerZero’s default security settings were the fundamental cause of the breach.
• Drift Protocol secured $148 million in funding from Tether and partners as part of a recovery plan following its own major exploit. The protocol is notably replacing Circle’s USDC with Tether’s USDT as its primary stablecoin, reflecting a shift in strategic alliances within the Solana ecosystem.
• Circle is facing a U.S. class-action lawsuit for allegedly failing to freeze $230 million in stolen USDC linked to the Drift Protocol hack. The case could set a legal precedent for a stablecoin issuer’s duty to intervene in illicit fund movements.
• Circle launched its native USDC Bridge to simplify cross-chain transfers with automated gas handling, standardizing interoperability and improving how users move USDC across blockchain networks.
• A 12-bank consortium led by Qivalis (backed by BBVA, BNP Paribas, ING, and UniCredit) selected Fireblocks to build the infrastructure for a MiCA-compliant euro stablecoin targeted for H2 2026. A regulated euro stablecoin could reduce reliance on dollar tokens for European users.
• Tempo introduced “Zones,” a permissioned layer backed by Stripe and Paradigm that provides bank-style privacy for enterprises. This sparked a debate on the balance between institutional privacy and crypto’s self-sovereignty.
• DoorDash is partnering with Tempo to integrate stablecoin payments into its global marketplace, starting with cross-border merchant and delivery worker payouts. Additionally, Stripe, Coastal Bank, and Latin American fintech ARQ are preparing payment operations on stablecoin rails through Tempo.
• Rhea Finance, a DeFi hub on the NEAR Protocol, lost $18.4 million to an oracle manipulation exploit, highlighting the persistent systemic risks that price feed vulnerabilities pose to high-concentration liquidity hubs.

Recent Research Reports

Interested to know more? Access exclusive reports by signing up as a Private member, joining our Crypto.com Exchange VIP Programme, or collecting a Loaded Lions NFT. The latest crypto market insights are also available via the dashboard.

We’re all ears.

Your feedback has always helped us provide insightful crypto market trends. Tell us how we can improve this newsletter further by taking a quick survey below (it will only take less than a minute). Thank you!

Take our survey now

Author

Research and Insights Team

Get the latest market, DeFi & NFT updates delivered to your inbox:

Be the first to hear about new insights:

Disclaimer

The information in this report is provided as general market commentary by Crypto.com and its affiliates, and does not constitute any financial, investment, legal, tax, or any other advice. This report is not intended to offer or recommend any access to products and/or services. While we endeavour to publish and maintain accurate information, we do not guarantee the accuracy, completeness, or usefulness of any information in this report, nor do we adopt nor endorse, nor are we responsible for, the accuracy or reliability of any information submitted by other parties.

This report is not directed or intended for distribution to, or use by, any person or entity who is a citizen or resident of, or located in a jurisdiction, where such distribution or use would be contrary to applicable law or that would subject Crypto.com and/or its affiliates to any registration or licensing requirement.

The brands and the logos appearing in this report are registered trademarks of their respective owners.