DeFi loses $137M; ETH under pressure
Ethereum DeFi protocols have lost more than $137 million to exploits so far in 2026, amplifying security fears as new bridges and lending pools hit the market. ETH price action is fragile too — founder sell‑offs and a $17.86M ETH withdrawal by F2Pool’s founder from Binance have added selling pressure across the ecosystem. (openpr.com), (openpr.com), (bitcoinethereumnews.com)
On-chain trackers and incident autopsies show breaches spanned 15 distinct DeFi projects in Q1 2026, with investigators reporting only about $9 million recovered — roughly a 6.5% recovery rate. (dev.to) Step Finance’s treasury compromise wiped roughly $27.3 million and the team announced it would wind down operations on Feb. 23, 2026 following the loss. (coindesk.com) Post‑mortems attribute the Step Finance collapse to a compromised multisig/private key accessed via a phishing vector, and the STEP token plunged near 80–90% after the breach. (dev.to) Truebit’s January 8, 2026 exploit exploited an integer‑overflow in legacy Solidity code to mint TRU, draining about 8,535 ETH (~$26.6M) in a single transaction according to security firm analyses. (certik.com) Security researchers and incident reports cite five recurring attack vectors—compromised keys, smart‑contract logic flaws, oracle manipulation, cross‑chain bridge weaknesses, and reentrancy—and warn that AI tooling is lowering the cost and speed of exploit development. (dev.to) On-chain intelligence shows a wallet linked to F2Pool co‑founder Wang Chun moved 9,000 ETH into Aave on March 27–28, 2026 and now holds ~79,818 ETH (~$158.7M), while separate July–February founder sales (Vitalik ~8,800 ETH sold in February 2026) coincided with elevated exchange inflows. (lookonchain.com) Aave’s cross‑chain footprint — Aave V3 on Mantle alone holds roughly $516.4M (about 68% of that chain’s TVL) — makes its pools a magnet for large ETH deposits and a focal point for shifts in lending liquidity after these whale movements. (defi-planet.com)
