DeFi Weekly October 2026 Week 5: Binance Hack Hits DeFi

Welcome back to DeFi Weekly, the Portals roundup of the numbers, yields and stories shaping DeFi. What began as a quiet week turned sharply on Thursday, when the largest exchange hack on record spilled over into lending markets, stablecoins and sentiment alike. Below, we look at what changed, what held up, and what is worth watching next.

The impact shows up clearly in the numbers. DeFi TVL fell 7.1% this week to $83.57B. Most of the drop came after a hot-wallet exploit at Binance on 29 October drained an estimated $6.3B, the largest crypto theft on record. BTC closed the week at $76,872 (-5.58% 7d), ETH at $2,236.84 (-6.83% 7d), and the Fear & Greed Index dropped from 51 to 30 (Fear) in a single day.

This edition covers how the exploit reached DeFi, including Aave's emergency freeze of 175 V3 reserves. It also covers Hyperliquid's path to regulated US perpetuals, federal trust bank approval and a Moody's rating for Ripple's RLUSD, weekend pricing for tokenized stocks, and Uniswap's new fee-conversion tool. We also highlight five yields on Portals Explorer that held steady through the sell-off.

Key Takeaways

• As of 30 Oct 2026, DeFi TVL was $83.57B, down 7.1% from $89.97B on 23 Oct.
• Binance estimates losses from its 29 Oct hot-wallet exploit at about $6.3B. It says customer funds were not affected and has set aside more than $6.34B to cover the losses.
• Aave froze 175 V3 reserves across 16 networks within three hours of the first outflow. Its governance forum says the attacker's position is over-collateralized and does not put suppliers at risk.
• Lending rates on curated vaults that stayed open briefly rose. Gauntlet USDC Prime on Base reached 12.72% APY on 30 Oct before easing to 6.24%.
• Savings and treasury-backed rates barely moved: Sky Savings USDS held at 3.79% and Ondo USDY at 3.75%.

Market Pulse (30 Oct 2026, 21:00 UTC)

The week had two halves. From 23 to 29 October, DeFi TVL eased about 1.6% as ETH and BTC drifted lower. Then, after the Binance exploit on the evening of 29 October, TVL fell another 5.6% in a single day. More than $1.5B in forced liquidations were reported over the following day. A sharp sell-off in US technology stocks on 30 October added to the pressure.

Most of the TVL decline is price, but not all of it. ETH's 6.83% weekly drawdown explains roughly half of Ethereum's 13.0% TVL decline. The rest came from withdrawals, concentrated in lending: Aave V3 TVL fell 13.3% on the week, and 10.6% of that fell in the final day as depositors pulled funds from frozen and near-fully-utilized markets. How TVL is measured, and what it misses.

Gas held near 0.10 Gwei through the stress. Cheap blockspace made it easy to unwind positions fast, which likely sped up the outflows.

Top Yields on Portals Explorer

In a week when one of the largest lending markets froze, we highlight five opportunities that stayed open and kept their rates close to their seven-day averages. Each one has more than $400M in TVL, takes most or all of its yield from base sources rather than token incentives, and was checked against the protocol's own data at the publication cutoff. Rates are live readings and will change.

1. Sky Savings USDS (Ethereum)

Sky Savings USDS is offering 3.79% APY on $4.51B in deposits, and the rate has not moved all week. That stability is structural: the rate is the Sky Savings Rate, set by Sky governance rather than by borrower demand, and the sUSDS contract reported 3.80% when read directly at the cutoff.

Deposits did slip, by about 7.7% over the week, as some holders exited stablecoin positions. The main considerations are governance changes to the rate and the collateral behind USDS itself. Portals added sUSDS savings in September.

View on Portals Explorer

2. Ondo U.S. Dollar Yield (Ethereum)

USDY is a tokenized note backed by short-term US Treasuries and bank deposits, and its 3.75% APY matches the rate Ondo publishes on its USDY page. The Ethereum deployment holds $1.30B, and Ondo reports about $2.4B across all chains.

Its weekly range of 3.716% to 3.750% was among the narrowest on Explorer this week, which is what treasury-backed RWAs are designed to deliver. USDY is not available to US persons and carries issuer and transfer restrictions that onchain-native stablecoins do not.

View on Portals Explorer

3. Gauntlet USDC Prime (Base)

This vault shows what happened to lending rates after the exploit. Gauntlet USDC Prime, a Morpho vault on Base, sat near 4.8% for most of the week. It then climbed to a peak of 12.72% on 30 October, in the hours after Aave froze its largest markets, before easing to 6.24%.

Morpho's own vault data confirms the 6.24% net APY, with no performance fee, on $402.92M in deposits. The seven-day average of 5.69% is a better guide than the peak. At this utilization, exit liquidity depends on repayments, and returns depend on Gauntlet's allocation across underlying markets.

View on Portals Explorer

4. Ethena Staked USDe (Ethereum)

At 5.05% APY on $1.17B, sUSDe is the highest-yielding stablecoin option in this list that did not see a utilization spike. Ethena reported a 5.00% staking yield on 28 October and a 30-day average of 4.88%, both close to what Explorer shows.

The rate tracks perp funding plus staked ETH rewards, so it compresses when funding flips negative. With the hedges held on CEX derivatives venues, an exchange incident like this week's belongs on any sUSDe risk list. We rate this one medium risk.

View on Portals Explorer

5. Rocket Pool ETH (Ethereum)

For ETH-denominated yield, rETH is offering 2.15% APY on $809.28M, in line with the 2.15% APR that Rocket Pool's own data reports. The rate stepped up from a seven-day average of 1.85% late in the week, in line with consensus and execution rewards repricing.

Rocket Pool's permissionless node operator set keeps it one of the more decentralized LSTs, though USD returns this week were dominated by ETH's drawdown. LSTs compared: how Lido works.

View on Portals Explorer

Smart contract and depeg risk apply across all five, and displayed rates can move after deposit.

DeFi News

Binance Hot-Wallet Exploit Drains About $6.3B, and Aave Freezes 175 Markets

On the evening of 29 October, an attacker drained Binance hot wallets on 11 chains. Binance put the losses at about $6.3B, while Elliptic's analysis puts them at $6.43B, the largest crypto theft on record. Binance said the breach was initially traced to what was suspected to be a compromised employee laptop, and that its investigation later found further breach points. On Ethereum, the attacker used an EIP-7702 delegation to take control of a hot wallet. Binance said customer funds were not touched, set aside more than $6.34B in company funds to cover the losses, and aims to restart withdrawals by Sunday 1 November.

The DeFi spillover was immediate. One wallet linked to the attacker supplied about 60M USDT to Aave V3 and borrowed 19,762 WETH, and Aave's guardians responded by freezing 175 V3 reserves across 16 networks and 117 V4 reserves by 23:04 UTC. Aave says the attacker's position is over-collateralized and does not put suppliers at risk. Withdrawals still pushed some reserves to 92% to 100% utilization, so Aave temporarily capped borrow rates at 10% APR on its largest stablecoin reserves and on WETH in its V4 Ethereum Core market.

Stablecoin issuers froze funds too, and Elliptic has verified $2.84B frozen so far, mostly USDT and USDC. Some stolen stablecoins were swapped for ETH on DEXs before the freezes landed. Elliptic says the attack is likely the work of North Korea's TraderTraitor group, which is linked to Lazarus, though no government has confirmed the attribution. For context on this year's incidents, see DeFi exploits in 2026 H1.

Hyperliquid Moves Toward Regulated US Perpetuals With Kraken's Parent and ICE

On 26 October, Hyperliquid said it intends to make Payward, Kraken's parent company, its first CFTC-regulated HIP-3 deployer. Under the plan, Payward's Bitnomial would deploy and clear the markets, using a new optional HIP-3* feature that lets deployers restrict access through onchain allowlists.

Hyperliquid said the first version is live on testnet and the specification is still preliminary. Three days later, NYSE parent ICE disclosed a strategic investment in Trade[XYZ], one of Hyperliquid's largest market deployers, to build a separate US perpetuals venue called ICE[XYZ].

Both plans need CFTC approval, and neither has a launch date. Even so, two major US market operators committing to Hyperliquid's infrastructure in the same week is a strong signal for its perp DEX lead, and for permissioned markets becoming a normal part of onchain derivatives.

Ripple's RLUSD Gets a Federal Trust Bank Charter and a Moody's A2 Rating

On 26 October, Ripple announced final OCC approval for Ripple National Trust Bank, which will manage reserves for the RLUSD stablecoin and act as its collateral trustee.

Two days later, Moody's rated RLUSD A2 long-term and P-1 short-term, and Coinbase listed RLUSD across its retail app, Exchange and Prime. RLUSD has a market cap of about $2.5B, according to Ripple.

A rating from a major agency gives treasury and institutional desks a familiar way to underwrite a stablecoin, which matters as stablecoin supply keeps growing. The same week showed the other side of issuer control: RLUSD linked to the Binance exploit was frozen, about $200M according to Binance co-CEO Yi He, though Ripple has not given a figure.

Chainlink Launches 24/7 Pricing for Tokenized Stocks, With Aave Horizon First

Chainlink is rolling out Chainlink 24/7, which extends price feeds for tokenized stocks and commodities into weekends and market holidays. While the underlying exchanges are closed, prices are derived from quotes across several perpetual futures venues. Aave is the launch partner, starting with tokenized US stocks on Aave Horizon, which stayed open during this week's freeze.

Weekend pricing closes a real gap: tokenized equities trade around the clock, while their reference markets do not.

Off-hours prices still come from derivatives rather than trades in the stocks themselves, which lending markets will need to reflect in their liquidation parameters. Chainlink has not yet published full technical details, so treat the specifics as preliminary.

Uniswap Opens Its TJAR Fee-Conversion Tool to Apps, Starting With Robinhood

On 29 October, Uniswap Labs opened TJAR, an open-source tool that converts fees collected in many tokens into a single token an app chooses. It is built on the Token Jar system that Uniswap uses for its own protocol fees. Robinhood is the first named user, receiving its Uniswap API fees in USDC and USDG through TJAR, and the tool is live on seven chains. Token Jar processed more than $15.3M in conversions in September.

Uniswap's documentation confirms that governance can set an optional TJAR protocol fee, and that none is set today. If one is switched on later, TJAR becomes another revenue line for Uniswap.

Chain Performance Analysis

Ethereum ended the week with $42.96B in DeFi TVL, down 13.0% from $49.40B on 23 October, and took the largest share of the weekly decline.

ETH's drawdown accounts for about half of that drop. The rest reflects withdrawals from lending markets after the Binance exploit, concentrated on 30 October.

Base held $5.79B after a 5.5% decline, a smaller drop than Ethereum, Solana or BSC. BSC fell 9.8%, the steepest decline after Ethereum, in a week when BNB came under pressure after the exploit. Tron was the only chain in the group to rise organically, by 0.9%.

Bitcoin's 37.2% increase is almost entirely a one-day step of about $2.07B on 28 October, which appears to reflect newly counted assets rather than new deposits, so it should be read with caution.

Top DeFi Protocols

Aave V3 had the largest decline of any top protocol, at 13.3%, after its emergency freeze. SparkLend was nearly flat, down 0.3%, the steadiest of the eight. LSTs fell roughly in line with ETH, which points to price effects rather than unstaking.

Looking Ahead

Binance Withdrawals and Proof of Reserves

Binance aims to restart withdrawals on Sunday 1 November and to publish a full proof of reserves on Monday 2 November. Whether both happen on schedule, and where the stolen funds that have not been frozen move next, will shape sentiment in the week ahead. So will any official attribution of the attack.

Aave's Unfreeze Plan

Aave's governance forum describes a four-wave unfreeze plan, and its second wave had been executed as of the forum's latest update. Reopening the 175 V3 reserves, and the path of borrow rates once the temporary 10% caps are lifted, will show how quickly lending liquidity returns. It will also show whether depositors who left come back.

Tokenized Stocks Without Weekend Gaps

Chainlink's 24/7 feeds go live first on Aave Horizon. Meanwhile, the issuer-objection process for tokenized stocks continues under the SEC's innovation exemption, and a growing list of the companies named in OKX and ICE’s tokenized stock plans, including Walmart and Eli Lilly, have now objected. The contrast between issuer-sponsored and third-party tokenization is worth watching, as is the wider RWA market.

Read last week's edition: DeFi Weekly October 2026 Week 4: Aero Launch

About portals.fi: Portals is the DeFi Super App. A one-click gateway to the entire onchain economy. Powered by real-time data and seamless execution, Portals connects traders to over 20 million assets, thousands of protocols, and every major blockchain.

Disclaimer: The content of this newsletter is for informational purposes only. It is not investment advice. Please do your own research and consult with a qualified financial advisor before making any investment decisions. DeFi investments carry significant risks, and past performance does not guarantee future results. More details here.