DeFi TVL July 2026 This Week: DeFi Lending Rebounds & $38M Coldcard Hack
The DeFi market closed July on a cautious note, with total TVL settling at $73.9B as broader markets pulled back sharply. Bitcoin fell below $63,100 and Ethereum retreated to $1,868, pushing the Fear & Greed Index deep into Extreme Fear territory at 25.
Despite the risk-off environment, on-chain activity remained robust, with DEX volume reaching $6.4B in the past 24 hours and stablecoin supply holding firm above $307B.
This week's edition covers the DeFi lending market's first monthly rebound of 2026, hitting $22.2B in active loans.
We also examine a critical Coldcard Mk3 firmware flaw that drained $38M in Bitcoin from around 500 wallets, SEC Commissioner Hester Peirce's warning regarding DeFi vaults, and Ostium's $23.75M off-chain exploit.
On the yield front, we have identified five verified positions on Portals Explorer, spanning Ethereum and Base, offering attractive risk-adjusted returns across multiple asset classes and risk profiles.
Let's dive into the data for this week of July 2026.
Market Pulse
- Total Market Cap: $2.25T (-2.1% 24h )
- DeFi TVL: $73.9B (-1.5% 24h | -2.3% 7d)
- BTC Price: $63,007 (-2.7% 24h)
- ETH Price: $1,868 (-2.6% 24h)
- Gas (ETH): ~0.25 Gwei
- Sentiment: Extreme Fear (25)
The final week of July brought a broad market correction, with BTC declining 2.7% and ETH falling 2.6% in the past 24 hours. The Fear & Greed Index dropped to 25, firmly in Extreme Fear territory, reflecting heightened caution among market participants as the summer recess approaches and regulatory uncertainty around the CLARITY Act persists.
Gas fees remain exceptionally low at approximately 0.25 Gwei, presenting a cost-efficient window for yield farmers to reposition across Ethereum mainnet and execute complex vault strategies without significant overhead.
Stablecoin market cap held at $307.96B, demonstrating continued liquidity within the ecosystem despite the price correction. DEX volume reached $6.4B over the past 24 hours, reflecting healthy on-chain trading activity.
The 7-day DEX volume of $40.7B represents an 11% increase week-over-week, suggesting that traders are actively repositioning rather than exiting the market entirely.
The Yield Market Pulse
This week, we highlight five yield opportunities currently tracked on Portals Explorer. These positions span Ethereum and Base, offering diverse strategies for yield generation across stablecoin, synthetic yield, and perpetuals-backed vaults.
1. CAP Staked cap USD (Ethereum)
The CAP Staked cap USD vault on Ethereum is currently generating a 5.50% APY with $71.66M in TVL. This vault accepts CUSD deposits and stakes them within CAP's yield infrastructure to generate a stable, base-layer return.
This position is well-suited for yield farmers seeking a reliable, low-volatility stablecoin return on Ethereum mainnet, particularly given the current low-gas environment.
2. Morpho Gauntlet USDC Prime (Base)
The Morpho Gauntlet USDC Prime vault on Base is offering a 4.39% APY with $430.85M in TVL. This vault is curated by Gauntlet, a simulation-driven DeFi risk management firm that operates over 70 Morpho vaults across Ethereum, Base, and other EVM chains.
The strategy optimizes for risk-adjusted yield across large market cap and high-liquidity collateral markets, prioritizing capital preservation by lending only against blue-chip collateral.
With $430.85M in TVL, this is one of the largest USDC yield vaults on Base, offering institutional-grade risk management for stablecoin depositors seeking reliable returns on Layer 2.
3. Steakhouse Financial Steakhouse Prime Instant (Ethereum)
The Steakhouse Prime Instant vault on Ethereum is generating a 4.09% APY with $92.76M in TVL. This is Steakhouse Financial's flagship USDC lending vault, designed for instant liquidity with no lock-up period.
This position is suitable for investors seeking a liquid, single-digit return on Ethereum USDC with the flexibility to exit at any time, backed by Steakhouse Financial's established risk management framework.
4. Avantis USDC Vault (Base)
The Avantis USDC Vault on Base is currently yielding 10.75% APY with $21.1M in TVL. This vault generates yield by acting as the liquidity counterparty to traders on Avantis, a perpetuals DEX on Base.
Investors should note that yield in perpetuals-backed vaults is correlated with trading volume and market volatility, meaning returns can vary significantly.
However, the current elevated APY makes this a compelling high-yield option for those comfortable with the associated risk profile.
5. PT reUSDe 10DEC2026 (Ethereum)
The PT reUSDe 10DEC2026 position on Ethereum is offering a 17.75% APY with $11.92M in TVL. This is a Pendle Principal Token representing the fixed-yield component of reUSDe, the synthetic dollar backed by Ethena's USDe and Re Protocol's reinsurance infrastructure.
The position matures on December 10, 2026, locking in the current yield for holders who retain the token to maturity.
This position offers one of the highest fixed-rate stablecoin yields currently available on Ethereum, combining Ethena's funding rate yield with Re Protocol's reinsurance premium. Investors should be aware of the smart contract risks inherent in the dual-protocol structure and the fixed maturity date.
TRENDING NOW on Portals Explorer
Track, manage, and optimise your DeFi portfolio across major networks with Portals Explorer. Discover the best yields, monitor your positions, and execute complex transactions with a single click.
Discover all the trending opportunities on Portals Explorer
DeFi News
DeFi Lending Rebounds to $22.2B in Active Loans
The DeFi lending market recorded its first monthly expansion of 2026 in July, surging 7.2% to hit $22.2 billion in active loan balances. This momentum reversed five consecutive months of steady contraction, pushing total DeFi TVL back up to $73.9 billion.
Aave led the sector's recovery, commanding a dominant 46.2% market share with $11 billion in active loans. The rebound indicates renewed appetite for leverage and yield generation among market participants, despite the broader price correction in major crypto assets.
Coldcard Mk3 Firmware Flaw Drains $38M in Bitcoin
Roughly 594 BTC, worth approximately $38 million, was swept from around 500 single-signature wallets in under 30 minutes on July 31, exploiting a flaw in how Coldcard hardware wallets generated private keys.
According to a report published by Block's Bitcoin engineering and security teams, a build setting introduced in Coldcard firmware 4.0.0 in March 2021 caused devices to skip their hardware randomness generator and fall back to a predictable software-based substitute seeded from the chip's serial number and clock registers.
Neither of those values is secret, making the resulting keys guessable. The attack moved 1,324 transactions across 500 wallets in a three-block window, with 562 BTC consolidated into a single address that has not moved.
Coinkite has warned all users who generated a seed on an Mk3 device running firmware 4.0.1 or later to move their funds immediately, while stating that Mk4, Q, and Mk5 devices appear unaffected based on early analysis.
The exposure also extends to paper wallet private keys, seed-splitting masks, and Key Teleport transfers generated on affected devices.
SEC Commissioner Warns DeFi Vaults May Fall Under Securities Laws
SEC Commissioner Hester Peirce issued a public warning on July 22, stating that certain on-chain yield vaults and decentralized lending mechanisms heavily resemble traditional investment funds and may fall squarely under federal securities laws.
Peirce noted that vaults span a wide range of designs, from fully automated smart contracts to products where managers or curators select investment strategies. She cautioned that moving these activities onto blockchain rails does not automatically change their legal status, stating, "Tokenized securities are still securities. That principle holds for vaults."
Following the statement, the MORPHO token fell approximately 5%, underperforming the broader market.
Ostium Suffers $23.75M Exploit via Off-Chain Breach
Ostium, a decentralized perpetuals platform on Arbitrum, suffered a $23.75 million exploit in mid-July. Following an investigation, the protocol confirmed the breach originated from compromised off-chain infrastructure rather than a flaw in its smart contracts.
The attacker gained unauthorized access to submit fraudulent BTC-USD price reports, bypassing the protocol's price verification process. This allowed the attacker to create artificial trading profits at the expense of the public OLP liquidity vault.
Ostium's automated monitoring systems detected the abnormal activity and halted trading, preventing further losses. Trader collateral remained unaffected, as user margin stayed inside the protocol's trading contracts.
Chain Performance Analysis
Ethereum continues to dominate the DeFi landscape with $40.92B in TVL, though it posted a modest 1.01% decline over the past seven days, reflecting the broader market pullback.
Despite this dip, Ethereum's share of total DeFi TVL remains above 55%, reinforcing its position as the primary hub for high-value DeFi activity and institutional capital.
BSC and Tron held their positions as the leading alternative Layer 1s, with $4.87B (+1.90% 7d) and $4.84B (+0.21% 7d) respectively.
BSC's positive weekly performance stands out in an otherwise declining market, driven by sustained activity in its lending and liquid staking sectors.
Solana declined 3.59% over the week to $4.74B, while Base fell 1.87% to $4.51B. Bitcoin's DeFi TVL saw the sharpest weekly decline at -17.20%, falling to $3.53B.
This drop reflects both the broader BTC price correction and the security shock from the Coldcard Mk3 firmware exploit, which drained $38M from around 500 wallets on July 31 and may have dampened short-term confidence in Bitcoin self-custody infrastructure.
Top DeFi Protocols
Lido retains its position as the largest DeFi protocol with $17.578B in TVL, posting a 1.00% weekly gain despite the broader market decline. Its dominance in liquid staking remains unchallenged, with stETH continuing to serve as the primary collateral asset across major lending protocols.
Aave V3 follows at $13.677B, maintaining its status as the premier decentralized lending market and the clear leader in the July lending rebound, commanding 46.2% of the $22.2B in active DeFi loans. Its dominant market share reinforces its position as the go-to protocol for on-chain borrowing activity.
Morpho Blue continues its ascent with $7.584B in TVL, posting a 1.93% weekly gain. The SEC's vault warning had a visible short-term impact on the MORPHO token, though the protocol's underlying TVL growth remained intact. WBTC holds $7.177B, while Binance Staked ETH rounds out the top five at $6.943B.
Looking Ahead
Regulatory Scrutiny Shifts to Yield Vaults
SEC Commissioner Hester Peirce's warning regarding DeFi vaults signals a potential shift in regulatory focus.
As vaults increasingly resemble traditional asset management products, especially those with active curation or discretionary management, protocols may face pressure to implement stricter compliance measures. The market reaction, including the drop in MORPHO's token price, suggests investors are taking this regulatory risk seriously.
Hardware Wallet Security Demands Greater Scrutiny
The Coldcard Mk3 firmware flaw highlights a critical and often overlooked risk in self-custody: the security of the key generation process itself.
As Bitcoin adoption grows and more users move toward hardware wallets for long-term storage, firmware-level vulnerabilities can expose funds that have remained untouched for years.
Wallet manufacturers and users alike will need to treat firmware audits and key generation transparency as non-negotiable security requirements.
Off-Chain Infrastructure Becomes the Primary Attack Vector
The $23.75M Ostium exploit and other major exploits in 2026 emphasise a critical shift in DeFi security: while smart contract exploits remain frequent, the largest financial losses are increasingly driven by off-chain infrastructure compromises.
As protocols secure their on-chain code, attackers are pivoting to target oracle signers, forwarders, and key management systems. Security audits will need to expand beyond smart contracts to encompass the entire operational stack.
Read the previous DeFi TVL Weekly edition: DeFi TVL July 2026 Week 4: Uniswap Permissioned Pools & Hyperliquid RWA Surge
About portals.fi: portals.fi is the DeFi Super App. A one-click gateway to the entire on-chain economy.
Powered by real-time data and seamless execution, portals.fi connects traders to over 20 million assets, thousands of protocols, and every major blockchain.
Disclaimer: The content of this newsletter is for informational purposes only. It is not investment advice. Please do your own research and consult with a qualified financial advisor before making any investment decisions.
DeFi investments carry significant risks, and past performance does not guarantee future results. More details here.
Portals.fi Blog Newsletter
Join the newsletter to receive the latest updates in your inbox.
