DeFi Keeps Growing as a $387 Million Exchange Hack Shakes Crypto

1. Tough Week for DeFi

This has been a challenging week for decentralised finance (DeFi), the version of lending, trading, and saving that runs on blockchain code (smart contracts) instead of through a traditional financial intermediary such as a bank.

On 24 September, Bitget, a cryptocurrency exchange, lost approximately $387 million. It was the largest of the 16 hacks captured in DefiLlama's records for the fortnight. Yet money kept flowing into DeFi. Total value locked (TVL), the crypto users keep in DeFi apps, stood at $96.03 billion. This is approximately ₹9.19 lakh crore, using ₹95.725 to the dollar, the reference rate set by the Reserve Bank of India (RBI) on 11 September.

Ethereum staking reached 43.6 million ETH, and Circle's new Arc chain saw the fastest growth. Meanwhile, DEX and lending deposits rose by 5.50% and 2.87% respectively. Regulators in the US, EU and UK also moved to separate firms that hold customer money from open code. Losses were mainly borne by custodians, while DeFi code largely held up. This theme runs through the rest of the report.

DeFi at a Glance

In the table below, a stablecoin is a token pegged to the US dollar, and perps are perpetual contracts that let traders bet on the future price of an asset, with no expiry date.

2. Five Stories that Shaped the Week

Four of the five biggest stories this week came from either markets or regulators, and not from DeFi itself.

Balancer puts its future to a vote. Balancer is a DEX that allows users to pool tokens for traders to trade against. It is asking holders of its BAL governance token, which carries voting rights, to approve an orderly wind-down, and the vote ends on 29 September. Since a $128 million exploit in November 2025, Balancer has not recovered, and its monthly revenue has dropped to approximately $56,781. If the vote passes, all depositors must withdraw by 30 October.

Regulations take shape for US stablecoins. The Federal Reserve proposed reserve and capital standards for stablecoin issuers under the GENIUS Act. A report by the Congressional Research Service (CRS), which provides analysis to the US Congress, states that the law's ledger protocol exclusion appears to cover DeFi lending and exchanges.

Europe and the UK take action. The European Banking Authority (EBA) suggested bringing crypto lending and DeFi access under MiCA, the EU's crypto rulebook. The UK Financial Conduct Authority (FCA) set out who needs a licence, and applications open on 30 September.

Wall Street reaches DeFi. CME Group plans to launch futures on UNI, Uniswap's governance token, on 19 October, pending regulatory review. A futures contract is an agreement to trade at a set price at a later date, so institutions gain a regulated way to hedge UNI.

3. DeFi Moves to Institutional Platforms

Behind the headlines, DeFi code has continued to move onto platforms built for large institutions.

Arc is Circle's own blockchain, with Chainlink as the official oracle, the service that feeds real-world prices onto a blockchain. Aave, the largest lender by deposits, launched version 4 on Arc with USDC, EURC and tokenised versions of bitcoin and ether (cirBTC and WETH). Its hub-and-spoke design means several markets can share one liquidity hub while each keeps its own risk settings.

For borrowers, Coinbase's existing Morpho loans have interest rates that float with demand. The new fixed-rate option works more like a bank loan, with the rate and repayment date fixed upfront.

4. Where the Last 15 Days of Hacks Came From

DefiLlama's hack database shows approximately $411 million (₹3,934 crore) was lost across 16 incidents between 13 and 28 September.

Of that, approximately $387 million (₹3,705 crore) was stolen from Bitget. Bitget is a centralised exchange that holds customers' crypto for them, and the hackers gained access through its hot wallets, the internet-connected wallets exchanges use for daily withdrawals.

SlowMist, a blockchain security firm, also reported three incidents worth more than $1 million. These are marked with an asterisk, and "est." means the figure is not confirmed.

Bitget started a staged withdrawal process on 28 September. THORChain, a cross-chain swap network, declined to block the hacker's swaps, saying its emergency halt isn't a tool to selectively freeze funds.

What the attacks tell us

The code mainly held. The doors around it, not so much.

Compromised keys, governance attacks and bridge flaws account for all but three of the $1 million-plus incidents. A private key is the secret code that controls a wallet, and whoever controls the key controls the funds. In a governance attack, as in the cases of Drop and Astroport, the attacker uses a project's own voting system to push through a malicious proposal. A bridge moves tokens from one blockchain to another, and a flaw in a bridge can create tokens with nothing behind them.

Among the larger incidents, Nostra was the only one caused by price manipulation, where the attacker pumped a thinly traded token and borrowed against it.

The real question to ask, then, is not only whether the code was audited. The real question is: who controls the keys?

5. More ETH Staked, Slightly Lower Rewards

Staking tells a calmer story. Staking means locking up ETH to help secure the Ethereum network in return for rewards, a bit like earning interest on a fixed deposit. Now, 43.6 million ETH, or 35.68% of all ETH, is staked. With more stakers sharing the same rewards, each staker earns a little less. At a yield (APR) of 2.58%, ₹1 lakh worth of staked ETH would earn around ₹2,580 a year before fees.

Validators, the computers that do this work, have to queue both to start and to leave. The queue to enter has shortened to about 28 days. The queue to leave, which was empty in July, now has about 161,000 ETH waiting to be processed.

6. Lido Still Leads the Pack

Liquid staking works like this: a provider stakes ETH on your behalf and gives you a token, such as Lido’s stETH, which represents the staked ETH, keeps earning rewards, and can still be used elsewhere in DeFi. About 17.3 million ETH is staked using this method.

Lido still dominates, holding more than half of this market, while ether.fi grew fastest among the leaders this week. Providers charge a fee, ranging from 10% at Lido to 25% at Coinbase, so their yields sit just below native staking.

7. Where the Money Moved This Week

Outside of staking, most of the week’s new money flowed to chains other than Ethereum. Ethereum remains by far the biggest DeFi network, but it saw the least growth among the chains tracked below this week.

Among stablecoins, USDC grew more than four times faster than USDT this week. Arc, a chain built around USDC, posted the fastest weekly growth among DeFiLlama's top chains. Together, these suggest Circle's new network is pulling fresh dollars on-chain, though one week is not yet a trend.

8. Two Pools Ask Users to Leave as Uniswap Grows

Those shifts reached liquidity pools too. Pools are the shared pots of tokens that traders swap against. Depositors earn a share of trading fees, but they also carry the protocol’s own risk. This week, two protocols asked their depositors to withdraw their tokens.

9. Regulators Draw a Line Around DeFi Code

In the same week an exchange lost $387 million, the US, the EU and the UK began separating firms that handle customer funds from the code that simply runs and automates processes.

The Fed proposed rules for stablecoin issuers. The CRS found that the GENIUS Act's ledger protocol exclusion appears to cover DeFi lending and exchanges. The EBA would reach DeFi lending mainly through the licensed firms that send clients to it. Guidance from the UK FCA on decentralised protocols is expected in October. The DeFi Education Fund and investment firm a16z have asked the SEC, the US securities regulator, for a "safe harbour" for non-custodial exchanges, where users keep control of their own funds.

The security data backs this up. Of the roughly $411 million lost over the fortnight, about $387 million, or 94%, came from a single custodial platform. The rest clustered on platforms where people, not code, control the funds.

The positive news for DeFi is that the focus on custody leaves room for open, protocol-level frameworks. But gaps remain. The CRS notes that the GENIUS Act does not clearly say who bears anti-money-laundering responsibility once a stablecoin moves into a personal wallet or a DeFi app. Certifying protocols could also turn "open to anyone" into "open to approved platforms".

India has yet to draw its line. Virtual Digital Assets (VDAs), the government's legal term for crypto and tokens, sit in a legal grey area. On 16 September, Bhartruhari Mahtab, Chair of Parliament's Standing Committee on Finance, said the committee does not yet have a unified position. He warned that leaving VDAs unregulated invites misuse.

The UK's October consultation, the responses to the Fed's proposals and India's committee report will show where these lines finally settle.

10. What to Watch Next Week

Several important decisions land in the coming days.