|
|
|
|
Welcome to the DefiLlama Newsletter. DefiLlama maintains the deepest DeFi dataset in the world, and now we’re bringing you the most valuable onchain insights each week.
|
Onchain Insights: Charts this Week |
$29b in RWA market cap: only a fraction is active onchain
The tokenized real-world asset market tripled in the last year. The vast majority of those assets are still sitting idle.
DefiLlama tracks just over $29b in onchain RWA market cap (excl stablecoins + governance tokens), and currently bonds dominate over 50% of the market.

Only $2.5B (9.4%) of the active $27.1B RWA market cap is deployed inside DeFi protocols right now. Bonds have a DeFi utilization rate of just 5.4%. Public equities: 1.6%. Equity ETFs: essentially zero (0.006%). The assets are onchain, but are not yet composable.

Private credit is a different story: syrupUSDC posts 20.8% DeFi utilization, syrupUSDT is at 43.4%, Hastra PRIME (reinsurance) at 83.7%, and Superstate's USTB at 36.4%.
These products are designed from the ground up for DeFi integration with features that include permissionless deposit routing, standard oracle pricing and yield passed onchain. The Treasury fund cohort (BUIDL, USYC, BENJI, etc) is the inverse: KYC, restricted transfers, and institutional-only access that limits DeFi composability.
The downside: Aave was a major distribution layer for supplying & borrowing syrupUSDC & syrupUSDT. After the rsETH exploit, Maple proactively withdrew liquidity. Aave also lowered the supply cap parameters.

Until the DeFi landscape becomes much safer, onchain utilization growth from institutional players will likely be muted.
Finding value in the token landscape
There are 144 protocols with MCap/Revenue ratios below 15x on both 1Y revenue and annualized revenue.

Of these, 72 protocols pass revenue to tokenholders. Here are the top 10 ranked by 1Y Holders Revenue (click here for the full list).

Protocols growing Holder Yield in the last 30 days (50k/month minimum):

Only 12 protocols with >$50K/month floor are growing their 30d holder revenue right now.
Total DeFi TVL is down 56% since October
You read that correctly. On the 7th of October, DeFi TVL peaked at $171b. A few days later, 24h DEX volume spiked to $32b, the highest level of activity since January 2025.
Since then, TVL and DEX volume have both dropped over 50%.

On the flipside, stablecoin market cap has added +$15b, a 15.1% increase during this TVL bleed.
USDT was the largest contributor, contributing $10b and 60% of the total stablecoin market cap expansion
USDS more than doubled, now sitting at $8.82b
USDYC grew 300% and USDY & USDG both added 200% to their market caps

Despite adding nearly $10b, USDT’s market share has not increased. Yield-bearing and institutional-grade stablecoins are carving out more collective market share.

The surge of onchain attacks continues
After four exploits in five days, the latest attack surface is crosschain infrastructure.

The pattern among these four incidents is identical: there were no smart contract bugs, the failure was in the trust layer above the contracts. The contracts are working as intended (but they’re being lied to).
The StakeDAO incident on May 27 is small, but instructive. A single compromised deployer key on Arbitrum was used to reconfigure the vsdCRV contract's LayerZero OFT peer, redirecting trust to an attacker-controlled Ethereum contract.
Twenty-five seconds later, a forged cross-chain message triggered the minting of 5,446,744,073,709 vsdCRV, worth $763 billion on paper. The attacker extracted only ~$91K because onchain liquidity for vsdCRV was near-zero.
The through-line across all four incidents is that not one of them was a smart contract bug. In each case, the contracts executed exactly as written:
StakeDAO's vsdCRV contract minted tokens in response to a valid-looking LayerZero instruction (the deployer key that authorized it was simply stolen)
Gravity Bridge released funds against what appeared to be a legitimately signed withdrawal (the signing key was compromised)
Alephium's guardians signed messages they believed were authentic (an off-chain backend flaw made forged messages look real)
Gnosis Pay's Zodiac module processed transactions as designed (an implementation flaw in the module's permission logic, not the Safe core contracts, allowed the attacker to bypass the review queue)
This is why Aave's new listing framework now scrutinizes bridge infrastructure, custodial arrangements, and external dependencies as first-class risk factors, because auditing the contract itself is no longer sufficient.
The TL;DR on what’s changing after Aave's post-mortem:
New listing checklist: seven things Aave will now audit before (and annually after) listing any collateral: unlimited mint risk, upgrade controls, bridged supply integrity, liquidation path clarity, off-chain custody exposure, oracle reliability, and external dependency audits
Automated emergency brake: risk stewards can now zero out an asset's borrowing power instantly, without waiting for a governance vote
295 parameter changes already done: 168 supply-cap cuts, 66 borrow-cap cuts, across all V3 markets
5× bug bounty increase
Annual re-reviews mandatory: any bridge route change, contract upgrade, or key rotation now triggers an immediate re-assessment
Anyone holding or building with cross-chain LSTs or assets with off-chain custody should be paying attention. These are the categories most likely to face supply cap reductions as the review rolls out. Compound, Morpho, and Spark will likely adopt similar standards.
May: bad month to be a DAT
May finished with the lowest DAT inflows of any month since October 2024. Strategy capped off the month by selling 32 BTC over the last week.

Crypto ETFs don’t paint a kind picture either: Bitcoin ETFs have seen three straight weeks of large outflows, with the last two each over $1b.

Hyperliquid ETFs BHYP and THYP have seen strong inflows over the last several weeks.
|
|
DefiLlama Research |
1. The State of RWAfi: Q1 2026
A comprehensive report that includes tokenized treasuries, equities and credit
2. Octra Bridge: the rail between public liquidity and encrypted state
Moving assets into a private environment to encrypt and start using privately across DeFi
|
Yield Watch |
Stablecoin yields are elevated this week: APYUSD is a Pendle PT yield, so the APY reflects a fixed-rate position maturing over time, not a traditional stablecoin pool. Morpho Blue is the most consistent platform with multiple curated USDC/USDT vaults clustering between 8–11%.

Notable names in the 10%+ bracket:
USDT0 (Altura, Hyperliquid):17.47%, $26.9M TVL
USDC (Ember Protocol): 12.57%, $37.6M TVL
MSUSD (Mainstreet): 12.00%, $81.6M TVL
APXUSD (Apyx Protocol): 10.61%, $242M TVL
|
Ask LlamaAI What are the 5 best stablecoin pools right now? Ask LlamaAI anything: protocol comparisons, yield analysis, chain-level breakdowns. It pulls live DefiLlama data and gives you a real answer, not a hallucination.
|
|
New on DefiLlama |
What are you watching this week? What do you want to see in the DefiLlama Newsletter?
Reply and let us know. See you next week.
