Total DeFi TVL

$79.5B

-2.35% 7d

DEX Volume 7d

$41.7B

+1.87% 7d

Total Fees 7d

$382M

+2.04% 7d

Stables MCap

$318.9B

-1.11% 7d

Welcome to the DefiLlama Newsletter. DefiLlama maintains the deepest DeFi dataset in the world, and now we’re bringing you the most valuable onchain insights each week.

Onchain Insights: Charts this Week

$29b in RWA market cap: only a fraction is active onchain

The tokenized real-world asset market tripled in the last year. The vast majority of those assets are still sitting idle.

DefiLlama tracks just over $29b in onchain RWA market cap (excl stablecoins + governance tokens), and currently bonds dominate over 50% of the market.

Only $2.5B (9.4%) of the active $27.1B RWA market cap is deployed inside DeFi protocols right now. Bonds have a DeFi utilization rate of just 5.4%. Public equities: 1.6%. Equity ETFs: essentially zero (0.006%). The assets are onchain, but are not yet composable.

Private credit is a different story: syrupUSDC posts 20.8% DeFi utilization, syrupUSDT is at 43.4%, Hastra PRIME (reinsurance) at 83.7%, and Superstate's USTB at 36.4%.

These products are designed from the ground up for DeFi integration with features that include permissionless deposit routing, standard oracle pricing and yield passed onchain. The Treasury fund cohort (BUIDL, USYC, BENJI, etc) is the inverse: KYC, restricted transfers, and institutional-only access that limits DeFi composability.

The downside: Aave was a major distribution layer for supplying & borrowing syrupUSDC & syrupUSDT. After the rsETH exploit, Maple proactively withdrew liquidity. Aave also lowered the supply cap parameters.

Until the DeFi landscape becomes much safer, onchain utilization growth from institutional players will likely be muted.

Finding value in the token landscape

There are 144 protocols with MCap/Revenue ratios below 15x on both 1Y revenue and annualized revenue.

Of these, 72 protocols pass revenue to tokenholders. Here are the top 10 ranked by 1Y Holders Revenue (click here for the full list).

Protocols growing Holder Yield in the last 30 days (50k/month minimum):

Only 12 protocols with >$50K/month floor are growing their 30d holder revenue right now.

Total DeFi TVL is down 56% since October

You read that correctly. On the 7th of October, DeFi TVL peaked at $171b. A few days later, 24h DEX volume spiked to $32b, the highest level of activity since January 2025.

Since then, TVL and DEX volume have both dropped over 50%.

On the flipside, stablecoin market cap has added +$15b, a 15.1% increase during this TVL bleed.

  • USDT was the largest contributor, contributing $10b and 60% of the total stablecoin market cap expansion

  • USDS more than doubled, now sitting at $8.82b

  • USDYC grew 300% and USDY & USDG both added 200% to their market caps

Despite adding nearly $10b, USDT’s market share has not increased. Yield-bearing and institutional-grade stablecoins are carving out more collective market share.

The surge of onchain attacks continues

After four exploits in five days, the latest attack surface is crosschain infrastructure.

The pattern among these four incidents is identical: there were no smart contract bugs, the failure was in the trust layer above the contracts. The contracts are working as intended (but they’re being lied to).

The StakeDAO incident on May 27 is small, but instructive. A single compromised deployer key on Arbitrum was used to reconfigure the vsdCRV contract's LayerZero OFT peer, redirecting trust to an attacker-controlled Ethereum contract.

Twenty-five seconds later, a forged cross-chain message triggered the minting of 5,446,744,073,709 vsdCRV, worth $763 billion on paper. The attacker extracted only ~$91K because onchain liquidity for vsdCRV was near-zero.

The through-line across all four incidents is that not one of them was a smart contract bug. In each case, the contracts executed exactly as written:

  • StakeDAO's vsdCRV contract minted tokens in response to a valid-looking LayerZero instruction (the deployer key that authorized it was simply stolen)

  • Gravity Bridge released funds against what appeared to be a legitimately signed withdrawal (the signing key was compromised)

  • Alephium's guardians signed messages they believed were authentic (an off-chain backend flaw made forged messages look real)

  • Gnosis Pay's Zodiac module processed transactions as designed (an implementation flaw in the module's permission logic, not the Safe core contracts, allowed the attacker to bypass the review queue)

This is why Aave's new listing framework now scrutinizes bridge infrastructure, custodial arrangements, and external dependencies as first-class risk factors, because auditing the contract itself is no longer sufficient.

The TL;DR on what’s changing after Aave's post-mortem:

  • New listing checklist: seven things Aave will now audit before (and annually after) listing any collateral: unlimited mint risk, upgrade controls, bridged supply integrity, liquidation path clarity, off-chain custody exposure, oracle reliability, and external dependency audits

  • Automated emergency brake: risk stewards can now zero out an asset's borrowing power instantly, without waiting for a governance vote

  • 295 parameter changes already done: 168 supply-cap cuts, 66 borrow-cap cuts, across all V3 markets

  • 5× bug bounty increase

  • Annual re-reviews mandatory: any bridge route change, contract upgrade, or key rotation now triggers an immediate re-assessment

Anyone holding or building with cross-chain LSTs or assets with off-chain custody should be paying attention. These are the categories most likely to face supply cap reductions as the review rolls out. Compound, Morpho, and Spark will likely adopt similar standards.

May: bad month to be a DAT

May finished with the lowest DAT inflows of any month since October 2024. Strategy capped off the month by selling 32 BTC over the last week.

Crypto ETFs don’t paint a kind picture either: Bitcoin ETFs have seen three straight weeks of large outflows, with the last two each over $1b.

Hyperliquid ETFs BHYP and THYP have seen strong inflows over the last several weeks.

LlamaAI

Ask LlamaAI

Run a 90-day Monte Carlo forecast for ZEC with 10,000 simulations and show p5/p50/p95 bands.

Unpack with LlamaAI

DefiLlama Research

1. The State of RWAfi: Q1 2026

A comprehensive report that includes tokenized treasuries, equities and credit

2. Octra Bridge: the rail between public liquidity and encrypted state

Moving assets into a private environment to encrypt and start using privately across DeFi

Yield Watch

Stablecoin yields are elevated this week: APYUSD is a Pendle PT yield, so the APY reflects a fixed-rate position maturing over time, not a traditional stablecoin pool. Morpho Blue is the most consistent platform with multiple curated USDC/USDT vaults clustering between 8–11%.

Notable names in the 10%+ bracket:

  • USDT0 (Altura, Hyperliquid):17.47%, $26.9M TVL

  • USDC (Ember Protocol): 12.57%, $37.6M TVL

  • MSUSD (Mainstreet): 12.00%, $81.6M TVL

  • APXUSD (Apyx Protocol): 10.61%, $242M TVL

Ask LlamaAI

What are the 5 best stablecoin pools right now?

Ask LlamaAI anything: protocol comparisons, yield analysis, chain-level breakdowns. It pulls live DefiLlama data and gives you a real answer, not a hallucination.

Find Stablecoin Pools

New on DefiLlama

Export custom DefiLlama datasets

Prompts to turn LlamaAI into your personal analyst

What are you watching this week? What do you want to see in the DefiLlama Newsletter?

Reply and let us know. See you next week.

Keep Reading